import { describe, expect, it } from "vitest";
import {
  AdminFallbackLoginRejected,
  assertAdminFallbackLoginAllowed,
  evaluateAdminFallbackLogin,
  isAdminFallbackUiVisible,
  readAdminFallbackPolicy,
} from "./admin-fallback.server";

describe("readAdminFallbackPolicy", () => {
  it("returns disabled+empty by default", () => {
    expect(readAdminFallbackPolicy({})).toEqual({ enabled: false, allowlist: [] });
  });

  it("parses ADMIN_FALLBACK_LOGIN_EMAILS comma-separated, lowercased", () => {
    expect(
      readAdminFallbackPolicy({
        ADMIN_FALLBACK_LOGIN_ENABLED: "true",
        ADMIN_FALLBACK_LOGIN_EMAILS: " Bootstrap@example.test , ops@example.test , ",
      })
    ).toEqual({
      enabled: true,
      allowlist: ["bootstrap@example.test", "ops@example.test"],
    });
  });

  it("accepts common truthy values", () => {
    for (const value of ["1", "true", "yes", "on", "TRUE"]) {
      expect(readAdminFallbackPolicy({ ADMIN_FALLBACK_LOGIN_ENABLED: value }).enabled).toBe(true);
    }
  });

  it("rejects non-truthy values", () => {
    for (const value of ["0", "false", "no", "", "off", "maybe"]) {
      expect(readAdminFallbackPolicy({ ADMIN_FALLBACK_LOGIN_ENABLED: value }).enabled).toBe(false);
    }
  });
});

describe("evaluateAdminFallbackLogin", () => {
  it("rejects when disabled even if allowlist matches", () => {
    const result = evaluateAdminFallbackLogin("bootstrap@example.test", {
      enabled: false,
      allowlist: ["bootstrap@example.test"],
    });
    expect(result.ok).toBe(false);
    if (!result.ok) expect(result.reason).toBe("disabled");
  });

  it("rejects when email not in allowlist", () => {
    const result = evaluateAdminFallbackLogin("intruder@example.test", {
      enabled: true,
      allowlist: ["bootstrap@example.test"],
    });
    expect(result.ok).toBe(false);
    if (!result.ok) expect(result.reason).toBe("email-not-allowlisted");
  });

  it("accepts when enabled AND email in allowlist (case-insensitive)", () => {
    const result = evaluateAdminFallbackLogin("Bootstrap@Example.test", {
      enabled: true,
      allowlist: ["bootstrap@example.test"],
    });
    expect(result.ok).toBe(true);
  });
});

describe("assertAdminFallbackLoginAllowed", () => {
  it("throws AdminFallbackLoginRejected when disabled", () => {
    expect(() => assertAdminFallbackLoginAllowed("anyone@example.test", { enabled: false, allowlist: [] })).toThrowError(AdminFallbackLoginRejected);
  });

  it("throws AdminFallbackLoginRejected when not in allowlist", () => {
    expect(() => assertAdminFallbackLoginAllowed("nobody@example.test", { enabled: true, allowlist: ["other@example.test"] })).toThrowError(AdminFallbackLoginRejected);
  });

  it("passes silently when both conditions are met", () => {
    expect(() => assertAdminFallbackLoginAllowed("ok@example.test", { enabled: true, allowlist: ["ok@example.test"] })).not.toThrow();
  });
});

describe("isAdminFallbackUiVisible", () => {
  it("reflects enabled flag only (allowlist intentionally ignored at UI layer)", () => {
    expect(isAdminFallbackUiVisible({ ADMIN_FALLBACK_LOGIN_ENABLED: "true" })).toBe(true);
    expect(isAdminFallbackUiVisible({ ADMIN_FALLBACK_LOGIN_ENABLED: "false" })).toBe(false);
    expect(isAdminFallbackUiVisible({})).toBe(false);
  });
});