package authz_test

import (
	"context"
	"testing"

	"chat-agent-system/internal/authz"
)

func TestService_ListCapabilities_DisabledWithoutPool(t *testing.T) {
	svc := authz.NewService(nil)
	caps, err := svc.ListCapabilities(context.Background(), 1)
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}
	if caps != nil {
		t.Fatalf("expected nil caps when pool disabled, got %v", caps)
	}
}

func TestService_IsSystemAdmin_ByRoleID(t *testing.T) {
	svc := authz.NewService(nil)
	admin, err := svc.IsSystemAdmin(context.Background(), 1, "role-admin")
	if err != nil || !admin {
		t.Fatalf("expected admin by role_id, got (%v, %v)", admin, err)
	}
}

func TestUpsertProjectMember_RejectsDocRolesWithoutDB(t *testing.T) {
	a := authz.NewAuthorizer(nil)
	if err := a.UpsertProjectMember(context.Background(), 1, 2, "author"); err == nil {
		t.Fatal("expected author role to be rejected")
	}
	if err := a.UpsertProjectMember(context.Background(), 1, 2, authz.RoleOwner); err != nil {
		t.Fatalf("owner should be allowed: %v", err)
	}
	bad := "viewer"
	if err := a.UpsertProjectMemberSpec(context.Background(), 1, 2, authz.MemberUpsert{
		ProjectRole:  authz.RoleMember,
		DocumentDuty: &bad,
	}); err == nil {
		t.Fatal("document_duty=viewer must be rejected")
	}
}

func TestGetProjectMember_DisabledWithoutPool(t *testing.T) {
	a := authz.NewAuthorizer(nil)
	rec, err := a.GetProjectMember(context.Background(), 1, 2)
	if err != nil || rec != nil {
		t.Fatalf("disabled authorizer must not invent a member, got (%v, %v)", rec, err)
	}
}