import { afterEach, describe, expect, test } from 'bun:test';
import { createRole } from 'officerdb';
import { db } from 'officerdb/db';
import { roles } from 'officerdb/schema';
import { like } from 'drizzle-orm';
import { roleDevGrants } from './os-user-postgres';

/*
  `roleDevGrants` is the replacement for the hardcoded `role === 'Developer'` gate — see the comment above
  it. What matters here is that it reads the ROW, not the name: a role called something else entirely gets
  dev tooling if and only if its `grantsPostgres`/`grantsDocker` columns say so, and a role that does not
  exist reads as neither rather than throwing.
*/

const PREFIX = 'zz-test-devgrants-';
const name = (suffix: string) => `${PREFIX}${suffix}`;

afterEach(async () => {
  await db.delete(roles).where(like(roles.name, `${PREFIX}%`));
});

describe('roleDevGrants', () => {
  test('reads both flags off a role that is not named Developer', async () => {
    const created = await createRole({ name: name('custom-dev'), grantsPostgres: true, grantsDocker: true });
    expect(created.ok).toBe(true);

    expect(await roleDevGrants(name('custom-dev'))).toEqual({ grantsPostgres: true, grantsDocker: true });
  });

  test('a role with grantsDocker false does not get docker, even with grantsPostgres true', async () => {
    const created = await createRole({ name: name('pg-only'), grantsPostgres: true, grantsDocker: false });
    expect(created.ok).toBe(true);

    expect(await roleDevGrants(name('pg-only'))).toEqual({ grantsPostgres: true, grantsDocker: false });
  });

  test('a role granted neither gets neither', async () => {
    const created = await createRole({ name: name('plain') });
    expect(created.ok).toBe(true);

    expect(await roleDevGrants(name('plain'))).toEqual({ grantsPostgres: false, grantsDocker: false });
  });

  test('a role that does not exist reads as neither, matching "absence denies" rather than throwing', async () => {
    await expect(roleDevGrants(name('never-created'))).resolves.toEqual({
      grantsPostgres: false,
      grantsDocker: false,
    });
  });
});