import assert from 'node:assert/strict'
import test from 'node:test'

import { resolveAdminPermission } from '../src/utils/admin-auth.ts'

type StorageLike = {
  getItem: (key: string) => string | null
  setItem: (key: string, value: string) => void
  removeItem: (key: string) => void
}

function installLocalStorage(entries: Record<string, string>) {
  const store = new Map(Object.entries(entries))
  const storage: StorageLike = {
    getItem: (key) => (store.has(key) ? (store.get(key) as string) : null),
    setItem: (key, value) => {
      store.set(key, value)
    },
    removeItem: (key) => {
      store.delete(key)
    },
  }
  ;(globalThis as { localStorage?: StorageLike }).localStorage = storage
  return store
}

function installAdminSessionSnapshot(permissions: string[]) {
  return installLocalStorage({
    'order-site-admin-token': 'token',
    'order-site-admin-token-expires-at': new Date(Date.now() + 60_000).toISOString(),
    'order-site-admin-permissions': JSON.stringify(permissions),
  })
}

test('会话接口返回的权限列表优先于本地快照（管理员刚收回权限的场景）', () => {
  installAdminSessionSnapshot(['consignment.manage'])

  // 本地快照里有 manage，但会话接口的最新列表没有 → 以会话为准
  assert.equal(resolveAdminPermission(['consignment.view'], 'consignment.manage'), false)
  assert.equal(resolveAdminPermission(['consignment.view'], 'consignment.view'), true)
})

test('会话返回空权限数组时判定为无权限，不回退本地快照', () => {
  installAdminSessionSnapshot(['consignment.manage', 'consignment.review'])

  assert.equal(resolveAdminPermission([], 'consignment.manage'), false)
  assert.equal(resolveAdminPermission([], 'consignment.review'), false)
})

test('会话权限缺失（接口失败/未返回）时回退本地快照', () => {
  installAdminSessionSnapshot(['consignment.review'])

  assert.equal(resolveAdminPermission(undefined, 'consignment.review'), true)
  assert.equal(resolveAdminPermission(null, 'consignment.manage'), false)
})

test('没有登录会话时即使快照里有权限也不放行', () => {
  installLocalStorage({ 'order-site-admin-permissions': JSON.stringify(['consignment.manage']) })

  assert.equal(resolveAdminPermission(undefined, 'consignment.manage'), false)
})

test('空权限名一律拒绝（避免调用方漏传参数时误放行）', () => {
  installAdminSessionSnapshot(['consignment.manage'])

  assert.equal(resolveAdminPermission(['consignment.manage'], ''), false)
  assert.equal(resolveAdminPermission([''], 'consignment.manage'), false)
})