import { test } from 'node:test';
import assert from 'node:assert/strict';
import { expandRoles, allows, ROLES } from '../src/roles.js';
import { StaffIam } from '../src/store.js';
import { verifyPassword } from '../src/passwords.js';

test('owner expands to all permissions', () => {
  assert.deepEqual(expandRoles(['owner']), ['*']);
  assert.equal(allows(['*'], 'cs.credit'), true);
  assert.equal(allows(expandRoles(['cs']), 'cs.credit'), true);
  assert.equal(allows(expandRoles(['cs']), 'accounting.export'), false);
  assert.ok(ROLES.sales);
});

test('cannot deactivate last owner; passwords hash', () => {
  const iam = new StaffIam().seed();
  const owner = iam.findByUsername('admin');
  assert.ok(verifyPassword(process.env.ADMIN_KEY || 'admin-dev-key', owner.passwordHash));
  assert.throws(() => iam.update('admin', { active: false }, 'admin'), /last owner/);
  const cs = iam.create({ username: 'anna', password: 'anna-pass-1', name: 'Anna', roles: ['cs'], actor: 'admin' });
  assert.deepEqual(cs.roles, ['cs']);
});