import { describe, expect, it } from "@effect/vitest";

import {
  canCreateWorkspaceConnectionsForHost,
  isTenantAdminMember,
  type TenantMemberRow,
} from "./admin-access";
import {
  connectionOwnerOptionsForAccess,
  normalizeConnectionOwner,
} from "../plugins/connection-owner";

const member = (overrides: Partial<TenantMemberRow> = {}): TenantMemberRow => ({
  role: "member",
  status: "active",
  isCurrentUser: false,
  ...overrides,
});

describe("isTenantAdminMember", () => {
  it("an active admin of the tenant may see the admin sections", () => {
    expect(isTenantAdminMember([member({ role: "admin", isCurrentUser: true })])).toBe(true);
  });

  // Self-host (Better Auth) issues `owner` where cloud (WorkOS) issues `admin`;
  // both hosts' admin middleware accept either.
  it("self-host's owner role counts too", () => {
    expect(isTenantAdminMember([member({ role: "owner", isCurrentUser: true })])).toBe(true);
  });

  it("a plain member does not", () => {
    expect(isTenantAdminMember([member({ role: "member", isCurrentUser: true })])).toBe(false);
  });

  // A pending invite carries a role but no access yet — treating it as admin
  // would show a section the server refuses.
  it("a pending admin invite is not yet an admin", () => {
    expect(
      isTenantAdminMember([member({ role: "admin", status: "pending", isCurrentUser: true })]),
    ).toBe(false);
  });

  it("another member's admin role says nothing about the viewer", () => {
    expect(
      isTenantAdminMember([
        member({ role: "admin", isCurrentUser: false }),
        member({ role: "member", isCurrentUser: true }),
      ]),
    ).toBe(false);
  });

  it("fails closed when the list has no row for the viewer", () => {
    expect(isTenantAdminMember([])).toBe(false);
    expect(isTenantAdminMember([member({ role: "admin" })])).toBe(false);
  });

  it("an unknown role is not an admin", () => {
    expect(isTenantAdminMember([member({ role: "billing", isCurrentUser: true })])).toBe(false);
  });
});

describe("canCreateWorkspaceConnectionsForHost", () => {
  it("allows Workspace connection creation on single-user hosts", () => {
    expect(canCreateWorkspaceConnectionsForHost(null, false)).toBe(true);
  });

  it("allows organization admins and refuses organization members", () => {
    expect(canCreateWorkspaceConnectionsForHost("org_123", true)).toBe(true);
    expect(canCreateWorkspaceConnectionsForHost("org_123", false)).toBe(false);
  });

  it("clamps a stale Workspace form owner when an admin becomes a member", () => {
    const adminOptions = connectionOwnerOptionsForAccess("org_123", true);
    const selectedOwner = normalizeConnectionOwner("org", adminOptions);
    expect(selectedOwner).toBe("org");

    const memberOptions = connectionOwnerOptionsForAccess("org_123", false);
    expect(normalizeConnectionOwner(selectedOwner, memberOptions)).toBe("user");
  });
});