import { describe, expect, mock, test } from "bun:test";

mock.module("cloudflare:workers", () => ({ env: {} }));

const { isAdminEmail, mayBootstrapAdminAtSignup, mayBypassClosedSignups } = await import("./admin-bootstrap");

const PROD = { PUBLIC_URL: "https://gitfor.dev", ADMIN_EMAIL: "Owner@Gitfor.dev", BOOTSTRAP_TOKEN: "t".repeat(24) };
const DEV = { PUBLIC_URL: "http://localhost:3000", GITFOR_LOCAL: "true" };

describe("first-admin bootstrap (DEPLOY-P3 / AUTH-P5)", () => {
  test("in production the first signup is not admin without the bootstrap token", () => {
    expect(mayBootstrapAdminAtSignup(null, PROD)).toBe(false);
    expect(mayBootstrapAdminAtSignup("wrong", PROD)).toBe(false);
    expect(mayBootstrapAdminAtSignup("t".repeat(24), PROD)).toBe(true);
  });

  test("a short or unset BOOTSTRAP_TOKEN never matches", () => {
    expect(mayBootstrapAdminAtSignup("abc", { ...PROD, BOOTSTRAP_TOKEN: "abc" })).toBe(false);
    expect(mayBootstrapAdminAtSignup("", { ...PROD, BOOTSTRAP_TOKEN: "" })).toBe(false);
  });

  test("only loopback dev makes the first signup admin by itself", () => {
    expect(mayBootstrapAdminAtSignup(null, DEV)).toBe(true);
    expect(mayBootstrapAdminAtSignup(null, { ...DEV, PUBLIC_URL: "https://gitfor.dev" })).toBe(false);
    expect(mayBootstrapAdminAtSignup(null, { PUBLIC_URL: "http://localhost:3000" })).toBe(false);
  });

  test("ADMIN_EMAIL matches case-insensitively and only when set", () => {
    expect(isAdminEmail("owner@gitfor.dev", PROD)).toBe(true);
    expect(isAdminEmail("other@gitfor.dev", PROD)).toBe(false);
    expect(isAdminEmail("", { ...PROD, ADMIN_EMAIL: "" })).toBe(false);
  });

  test("closed signups admit only the token holder (or loopback dev), never a typed ADMIN_EMAIL", () => {
    expect(mayBypassClosedSignups(null, PROD)).toBe(false);
    expect(mayBypassClosedSignups("t".repeat(24), PROD)).toBe(true);
    expect(mayBypassClosedSignups(null, DEV)).toBe(true);
  });
});