import { describe, expect, it } from "vitest";

import { hasScope } from "./permissions";
import type { CloudUser } from "./types";

const baseUser: Omit<CloudUser, "scopes"> = {
  id: "user-a",
  username: "operator",
  display_name: "Operator",
  role: "operator",
  enabled: true,
  must_change_password: false,
  created_at: "2026-01-01T00:00:00+00:00",
  updated_at: "2026-01-01T00:00:00+00:00",
  last_login_at: null,
};

describe("Provider navigation permission", () => {
  it("requires the Provider administration scope", () => {
    expect(hasScope({ ...baseUser, scopes: ["tasks:read"] }, "llm-providers:admin")).toBe(false);
    expect(hasScope({ ...baseUser, scopes: ["llm-providers:admin"] }, "llm-providers:admin")).toBe(true);
    expect(hasScope({ ...baseUser, scopes: ["*"] }, "llm-providers:admin")).toBe(true);
  });
});