import { afterEach, describe, expect, it, vi } from 'vitest';

import { readSessionCapabilities } from '../../src/sessionClient';

afterEach(() => vi.unstubAllGlobals());

function json(value: unknown, status = 200): Response {
  return new Response(JSON.stringify(value), { status, headers: { 'Content-Type': 'application/json' } });
}

describe('session capability client', () => {
  it('reads bounded identity, environment and effective permissions', async () => {
    vi.stubGlobal('fetch', vi.fn(async () => json({
      subject: 'operator-42', role: 'editor', environment: 'development',
      permissions: { view: true, operate: true, edit: true, admin: false },
    })));

    await expect(readSessionCapabilities()).resolves.toEqual({
      subject: 'operator-42', role: 'editor', environment: 'development',
      permissions: { view: true, operate: true, edit: true, admin: false }, source: 'session',
    });
  });

  it('falls back to the legacy capability probe when the endpoint is absent', async () => {
    const fetch = vi.fn(async () => fetch.mock.calls.length === 1 ? json({}, 404) : json({}, 405));
    vi.stubGlobal('fetch', fetch);

    const result = await readSessionCapabilities();

    expect(result).toMatchObject({ role: 'editor+', environment: '', permissions: { view: true, operate: true, edit: true, admin: false }, source: 'fallback' });
    expect(fetch).toHaveBeenNthCalledWith(2, '/api/v1/widgets/preview', expect.objectContaining({ method: 'GET', cache: 'no-store' }));
  });

  it('preserves an explicit authentication failure', async () => {
    vi.stubGlobal('fetch', vi.fn(async () => json({}, 401)));
    await expect(readSessionCapabilities()).rejects.toMatchObject({ status: 401 });
  });
});