import { describe, expect, it } from "vitest";
import { createCapabilityReviewDigest } from "./capabilityReviewDigest";

function plugin(overrides: Partial<{ pluginId: string; version: string; scope: string | null }> = {}) {
  return {
    pluginId: overrides.pluginId ?? "com.example.digest",
    version: overrides.version ?? "1.0.0",
    manifest: {
      capabilities: [
        { name: "secret.read", scope: overrides.scope ?? "tenant" },
        { name: "http.outbound", scope: "tenant" },
        { name: "log", scope: null },
      ],
      hooks: [{ name: "workflow.executed", export: "onWorkflowExecuted" }],
    },
  };
}

describe("createCapabilityReviewDigest", () => {
  it("is stable regardless of requested capability order", () => {
    expect(createCapabilityReviewDigest(plugin(), ["secret.read", "http.outbound"])).toBe(
      createCapabilityReviewDigest(plugin(), ["http.outbound", "secret.read"])
    );
  });

  it("only binds selected capabilities into the review digest", () => {
    const selected = createCapabilityReviewDigest(plugin(), ["log"]);
    const selectedWithUnmanifested = createCapabilityReviewDigest(plugin(), ["log", "db.write"]);
    const broaderGrant = createCapabilityReviewDigest(plugin(), ["log", "secret.read"]);

    expect(selectedWithUnmanifested).toBe(selected);
    expect(broaderGrant).not.toBe(selected);
  });

  it("binds manifest hook consent items into the review digest", () => {
    const hookReviewDigest = createCapabilityReviewDigest(plugin(), ["hook:workflow.executed"]);
    const capabilityReviewDigest = createCapabilityReviewDigest(plugin(), ["log"]);
    const combinedReviewDigest = createCapabilityReviewDigest(plugin(), ["log", "hook:workflow.executed"]);

    expect(hookReviewDigest).not.toBe(capabilityReviewDigest);
    expect(combinedReviewDigest).not.toBe(capabilityReviewDigest);
    expect(combinedReviewDigest).not.toBe(hookReviewDigest);
  });

  it("does not allow a partial review digest to stand in for a broader submitted grant set", () => {
    const partialReviewDigest = createCapabilityReviewDigest(plugin(), ["log"]);
    const submittedGrantSetDigest = createCapabilityReviewDigest(plugin(), ["log", "secret.read"]);

    expect(submittedGrantSetDigest).not.toBe(partialReviewDigest);
  });

  it("changes when plugin identity version or capability scope changes", () => {
    const baseline = createCapabilityReviewDigest(plugin(), ["secret.read"]);

    expect(createCapabilityReviewDigest(plugin({ pluginId: "com.example.other" }), ["secret.read"])).not.toBe(baseline);
    expect(createCapabilityReviewDigest(plugin({ version: "1.0.1" }), ["secret.read"])).not.toBe(baseline);
    expect(createCapabilityReviewDigest(plugin({ scope: "workspace" }), ["secret.read"])).not.toBe(baseline);
  });
});