import { test } from 'node:test';
import assert from 'node:assert/strict';
import { authorize } from '../src/policy.js';
import { accessAddress, parseAddress, PLANES } from '../src/subjects.js';

test('five access planes', () => {
  assert.deepEqual([...PLANES], ['zapier', 'web', 'api', 'leaf', 'staff']);
});

test('web may read statement and reload, not archive or jobs', () => {
  assert.equal(authorize({ plane: 'web', subject: 'verae.billing.statement.get' }).allow, true);
  assert.equal(
    authorize({ plane: 'web', subject: 'verae.billing.balance.adjust', kind: 'reload' }).allow,
    true,
  );
  assert.equal(
    authorize({ plane: 'web', subject: 'verae.billing.balance.adjust', kind: 'credit' }).allow,
    false,
  );
  assert.equal(authorize({ plane: 'web', subject: 'verae.archive.put' }).allow, false);
  assert.equal(authorize({ plane: 'web', subject: 'verae.zapier.jobs.watch' }).allow, false);
});

test('leaf may archive and jobs, not billing adjust', () => {
  assert.equal(authorize({ plane: 'leaf', subject: 'verae.archive.put' }).allow, true);
  assert.equal(authorize({ plane: 'leaf', subject: 'verae.archive.reply.abc' }).allow, true);
  assert.equal(authorize({ plane: 'leaf', subject: 'verae.zapier.jobs.watch' }).allow, true);
  assert.equal(authorize({ plane: 'leaf', subject: 'verae.billing.balance.adjust' }).allow, false);
  assert.equal(authorize({ plane: 'leaf', subject: 'verae.billing.statement.get' }).allow, false);
});

test('zapier may meter and jobs, not customer statement or credits', () => {
  assert.equal(authorize({ plane: 'zapier', subject: 'verae.zapier.jobs.watch' }).allow, true);
  assert.equal(authorize({ plane: 'zapier', subject: 'verae.billing.usage.recorded' }).allow, true);
  assert.equal(authorize({ plane: 'zapier', subject: 'verae.billing.statement.get' }).allow, false);
  assert.equal(authorize({ plane: 'zapier', subject: 'verae.billing.balance.adjust' }).allow, false);
  assert.equal(authorize({ plane: 'zapier', subject: 'verae.archive.put' }).allow, false);
});

test('api may statement and usage, not credits or archive', () => {
  assert.equal(authorize({ plane: 'api', subject: 'verae.billing.statement.get' }).allow, true);
  assert.equal(authorize({ plane: 'api', subject: 'verae.billing.usage.recorded' }).allow, true);
  assert.equal(authorize({ plane: 'api', subject: 'verae.billing.balance.adjust' }).allow, false);
  assert.equal(authorize({ plane: 'api', subject: 'verae.archive.query' }).allow, false);
});

test('staff may credit and statement, not archive', () => {
  assert.equal(authorize({ plane: 'staff', subject: 'verae.billing.balance.adjust', kind: 'credit' }).allow, true);
  assert.equal(authorize({ plane: 'staff', subject: 'verae.billing.statement.get' }).allow, true);
  assert.equal(authorize({ plane: 'staff', subject: 'verae.archive.put' }).allow, false);
});

test('access-prefixed address is mapped to internal', () => {
  const addr = accessAddress('leaf', 'verae.archive.put');
  assert.equal(addr, 'verae.access.leaf.archive.put');
  const parsed = parseAddress(addr);
  assert.equal(parsed.plane, 'leaf');
  assert.equal(parsed.internal, 'verae.archive.put');
  assert.equal(authorize({ plane: 'leaf', subject: addr }).allow, true);
  assert.equal(authorize({ plane: 'web', subject: addr }).allow, false);
});

test('allow echoes veraeUserId for hop tracing', () => {
  const out = authorize({
    plane: 'web',
    subject: 'verae.billing.statement.get',
    principal: 'cust_1',
    veraeUserId: 'vu_deadbeefdeadbeef',
    traceId: 'tr-1',
  });
  assert.equal(out.allow, true);
  assert.equal(out.veraeUserId, 'vu_deadbeefdeadbeef');
  assert.equal(out.traceId, 'tr-1');
});

test('unknown plane and authz subjects denied', () => {
  assert.equal(authorize({ plane: 'partner', subject: 'verae.archive.put' }).allow, false);
  assert.equal(authorize({ plane: 'web', subject: 'verae.access.authz.check' }).allow, false);
});