import { describe, expect, test } from 'bun:test';
import { listProvisionableUsers, getUsers, OWNER_USER_ID } from 'officerdb';

describe('what a plugin is told about users', () => {
  // The whole point of the projection. `users` holds `password` (the hash) and `os_user`, and `getUsers()`
  // is `select *` — so a plugin reaching for the obvious function gets every account's password hash.
  // This asserts the narrow one cannot, no matter what is added to the table later.
  test('never carries a password hash or an os user', async () => {
    const rows = await listProvisionableUsers();
    if (!rows.length) return; // a server with only an owner is a legitimate state

    const keys = Object.keys(rows[0]!).sort();
    expect(keys).toEqual(['email', 'id', 'name', 'role', 'username']);
    for (const row of rows) {
      expect(row).not.toHaveProperty('password');
      expect(row).not.toHaveProperty('osUser');
    }
  });

  // The owner bypasses every permission check and already has whatever upstream account they want.
  // Provisioning them is at best a no-op and at worst a second admin nobody asked for.
  test('excludes the owner', async () => {
    const rows = await listProvisionableUsers();
    expect(rows.some((r) => r.id === OWNER_USER_ID)).toBe(false);
  });

  test('includes everyone else', async () => {
    const all = await getUsers();
    const provisionable = await listProvisionableUsers();
    expect(provisionable.length).toBe(all.filter((u) => u.id !== OWNER_USER_ID).length);
  });
});