import { describe, expect, mock, test } from "bun:test";
import type { Permission, RepoRow, Viewer } from "~/lib/types";

mock.module("cloudflare:workers", () => ({
  env: {},
  waitUntil: () => undefined,
  WorkflowEntrypoint: class {},
  DurableObject: class {},
  WorkerEntrypoint: class {},
}));

const grants = new Map<string, Permission>();
const orgAdmins = new Set<string>();
const orgMembers = new Set<string>();

mock.module("./repos", () => ({
  hasPermission: (actual: Permission, needed: Permission) => {
    const rank = { none: 0, read: 1, write: 2, admin: 3 };
    return rank[actual] >= rank[needed];
  },
  repoPermission: async (repo: RepoRow, viewer: Viewer) =>
    grants.get(`${repo.id}:${viewer.id}`) ?? (repo.visibility === "public" ? "read" : "none"),
  canAdministerAccount: async (accountId: string, viewer: Viewer) =>
    accountId === viewer.id || orgAdmins.has(`${accountId}:${viewer.id}`),
  canCreateInAccount: async (accountId: string, viewer: Viewer) =>
    accountId === viewer.id ||
    orgAdmins.has(`${accountId}:${viewer.id}`) ||
    orgMembers.has(`${accountId}:${viewer.id}`),
}));

const { assertCanFork, assertCanTransfer } = await import("./fork-policy");

const bob: Viewer = { id: "u-bob", name: "bob", displayName: null, email: "b@x", isAdmin: false, emailVerified: true };
const privateRepo = { id: "A", visibility: "private", allow_forking: 0 } as RepoRow;
const publicRepo = { id: "P", visibility: "public", allow_forking: 0 } as RepoRow;

async function status(promise: Promise<unknown>): Promise<number | "ok"> {
  try {
    await promise;
    return "ok";
  } catch (error) {
    return (error as { status: number }).status;
  }
}

describe("assertCanFork (GIT-A8 / AZ-A7)", () => {
  test("public repositories fork into any account the viewer can create in", async () => {
    orgMembers.add("org-evil:u-bob");
    expect(await status(assertCanFork(publicRepo, { id: "org-evil" }, bob))).toBe("ok");
    expect(await status(assertCanFork(publicRepo, { id: "org-other" }, bob))).toBe(403);
  });

  test("a reader cannot fork a private repository unless the owner allows it", async () => {
    grants.set("A:u-bob", "read");
    expect(await status(assertCanFork(privateRepo, { id: "u-bob" }, bob))).toBe(403);
    expect(await status(assertCanFork({ ...privateRepo, allow_forking: 1 }, { id: "u-bob" }, bob))).toBe("ok");
  });

  test("a writer can fork a private repository into their own account", async () => {
    grants.set("A:u-bob", "write");
    expect(await status(assertCanFork(privateRepo, { id: "u-bob" }, bob))).toBe("ok");
  });

  test("a private fork may only land in an organization the forker administers", async () => {
    grants.set("A:u-bob", "write");
    orgMembers.add("org-evil:u-bob");
    expect(await status(assertCanFork(privateRepo, { id: "org-evil" }, bob))).toBe(403);
    orgAdmins.add("org-mine:u-bob");
    expect(await status(assertCanFork(privateRepo, { id: "org-mine" }, bob))).toBe("ok");
  });
});

describe("assertCanTransfer (authz-P1/P2)", () => {
  test("a repo-level admin who does not own the account cannot transfer", async () => {
    orgAdmins.add("org-dest:u-bob");
    expect(await status(assertCanTransfer({ owner_id: "org-src" }, { id: "org-dest" }, bob))).toBe(403);
    orgAdmins.add("org-src:u-bob");
    expect(await status(assertCanTransfer({ owner_id: "org-src" }, { id: "org-dest" }, bob))).toBe("ok");
  });

  test("a plain org member cannot transfer into that org", async () => {
    orgMembers.add("org-member:u-bob");
    expect(await status(assertCanTransfer({ owner_id: "u-bob" }, { id: "org-member" }, bob))).toBe(403);
    expect(await status(assertCanTransfer({ owner_id: "org-src" }, { id: "u-bob" }, bob))).toBe("ok");
  });
});