import { test } from "node:test";
import assert from "node:assert/strict";

import { grant, holds, PACKAGE_TEAM, READ_TEAM, teamFor, type Forge } from "../provisioner/teams.ts";

// Defends novox/hq issue 624: the lab reads the forge with a credential of its own that can write no
// package. A consumer that contributes {"access": "read"} joins a team with code and package read only.

function aForge(): { forge: Forge; did: string[] } {
  const did: string[] = [];
  const teams: Record<string, number> = {};
  const forge: Forge = {
    async ensureOrg(org) { did.push(`org ${org}`); },
    async ensureTeam(org, team, packageWrite) {
      did.push(`team ${org}/${team} packages:${packageWrite ? "write" : "read"}`);
      return (teams[team] ??= Object.keys(teams).length + 1);
    },
    async ensureUser(username) { did.push(`user ${username}`); },
    async addUserToTeam(id, username) { did.push(`add ${username} to ${id}`); },
    async removeUserFromTeam(id, username) { did.push(`remove ${username} from ${id}`); },
    async holdsTeamMember(org, team, username) { did.push(`holds ${username} in ${org}/${team}`); return true; },
  };
  return { forge, did };
}

test("a consumer that asks nothing, or write, publishes: the package team", () => {
  assert.deepEqual(teamFor({}), { team: PACKAGE_TEAM, packageWrite: true });
  assert.deepEqual(teamFor({ access: "write" }), { team: PACKAGE_TEAM, packageWrite: true });
});

test("a consumer that asks to read joins the readers, who write no package", () => {
  assert.deepEqual(teamFor({ access: "read" }), { team: READ_TEAM, packageWrite: false });
  assert.throws(() => teamFor({ access: "admin" }), /not "read" or "write"/);
});

test("a reader is made, put on the readers team, and taken off the package team", async () => {
  const { forge, did } = aForge();
  await grant(forge, { as: "lab-shanks", password: "pw", values: { access: "read" } });
  assert.deepEqual(did, [
    "org novox",
    "team novox/readers packages:read",
    "user lab-shanks",
    "add lab-shanks to 1",
    "team novox/packages packages:write",
    "remove lab-shanks from 2",
  ]);
  did.length = 0;
  await holds(forge, { as: "lab-shanks", password: "pw", values: { access: "read" } });
  assert.deepEqual(did, ["holds lab-shanks in novox/readers"]);
});

test("a publisher is made and put on the package team, as before", async () => {
  const { forge, did } = aForge();
  await grant(forge, { as: "build-agent-ace", password: "pw", values: {} });
  assert.deepEqual(did, ["org novox", "team novox/packages packages:write", "user build-agent-ace", "add build-agent-ace to 1"]);
});