import { isSuperAdminContext, assertSuperAdmin } from '../../src/comm/guard/super-admin';
import { CoolCommException } from '@cool-midway/core';

describe('后端权限隔离 - 平台超级管理员专属守卫 (Super Admin Guard TDD)', () => {
  describe('1. isSuperAdminContext 身份研判', () => {
    it('username 为 admin 的系统初始超管应判定为 true', () => {
      const ctx = { admin: { username: 'admin', userId: 1 } };
      expect(isSuperAdminContext(ctx)).toBe(true);
    });

    it('携带 isSuper: true 标识的平台超级管理员应判定为 true', () => {
      const ctx = { admin: { username: 'root_operator', isSuper: true, userId: 2 } };
      expect(isSuperAdminContext(ctx)).toBe(true);
    });

    it('角色包含 admin 标签的管理员应判定为 true', () => {
      const ctx = { admin: { username: 'ops_manager', roleLabels: ['admin', 'ops'], userId: 3 } };
      expect(isSuperAdminContext(ctx)).toBe(true);
    });

    it('普通企业租户账号应判定为 false', () => {
      const ctx = { admin: { username: 'vanguard_owner', tenantId: 1, roleLabels: ['tenant_owner'], userId: 10 } };
      expect(isSuperAdminContext(ctx)).toBe(false);
    });

    it('租户下的一线业务员应判定为 false', () => {
      const ctx = { admin: { username: 'sales_tom', tenantId: 1, roleLabels: ['sales_rep'], userId: 25 } };
      expect(isSuperAdminContext(ctx)).toBe(false);
    });

    it('缺失 admin 上下文或未登录状态应判定为 false', () => {
      expect(isSuperAdminContext({})).toBe(false);
      expect(isSuperAdminContext({ admin: null })).toBe(false);
    });
  });

  describe('2. assertSuperAdmin 越权拦截断言', () => {
    it('超级管理员访问时不应抛出异常', () => {
      const ctx = { admin: { username: 'admin' } };
      expect(() => assertSuperAdmin(ctx)).not.toThrow();
    });

    it('非超级管理员访问时必须抛出 403 CoolCommException 阻止越权', () => {
      const ctx = { admin: { username: 'tenant_user', tenantId: 2 } };
      expect(() => assertSuperAdmin(ctx)).toThrow(CoolCommException);
      try {
        assertSuperAdmin(ctx);
      } catch (err: any) {
        expect(err.statusCode || err.status).toBe(403);
        expect(err.message).toContain('权限不足');
      }
    });
  });
});