/**
 * scopesToOwnRequisitions — mirrors backend users.permissions.scopes_to_own_requisitions.
 *
 *   node permissions-scope.test.mjs
 */
import {
  isAdmin,
  isHiringManager,
  seesAllCandidates,
  scopesToOwnRequisitions,
} from './src/auth/permissions.js'

let failed = 0
function ok(name, cond, extra) {
  if (cond) {
    console.log(`ok    ${name}`)
    if (extra) console.log(`        ${extra}`)
  } else {
    failed += 1
    console.log(`FAIL  ${name}`)
    if (extra) console.log(`        ${extra}`)
  }
}

const recruiter = {
  id: 'aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa',
  role_name: 'recruiter',
  permissions: ['candidates.view', 'jobs.view'],
}
ok('recruiter is not requisition-scoped', !scopesToOwnRequisitions(recruiter))
ok('recruiter does not see all candidates', !seesAllCandidates(recruiter))

const custom = {
  ...recruiter,
  role_name: 'AI_TEAM_MANAGER',
  permissions: ['candidates.view', 'jobs.view', 'requisitions.create'],
}
ok('requisitions.create alone does not scope jobs/candidates', !scopesToOwnRequisitions(custom))
ok('custom role is not hiring-manager portal', !isHiringManager(custom))
ok('custom role is not admin', !isAdmin(custom))

ok(
  'Access Control requisitions.configure enables the scope',
  scopesToOwnRequisitions({
    ...custom,
    permissions: ['candidates.view', 'jobs.view', 'requisitions.create', 'requisitions.configure'],
  }),
)

const manage = {
  ...custom,
  permissions: ['candidates.view', 'candidates.manage', 'requisitions.configure'],
}
ok(
  'candidates.manage wins over requisitions.configure',
  !scopesToOwnRequisitions(manage) && seesAllCandidates(manage),
)

ok(
  'admin is not requisition-scoped',
  !scopesToOwnRequisitions({ role_name: 'admin', permissions: ['requisitions.create'] }) &&
    isAdmin({ role_name: 'admin' }),
)

ok(
  'hiring_manager stays portal-locked and requisition-scoped',
  isHiringManager({ role_name: 'hiring_manager' }) &&
    scopesToOwnRequisitions({ role_name: 'hiring_manager', permissions: ['candidates.view'] }),
)

ok(
  'requisitions.manage is admin, not this scope',
  isAdmin({ role_name: 'ops_lead', permissions: ['requisitions.manage'] }) &&
    !scopesToOwnRequisitions({ role_name: 'ops_lead', permissions: ['requisitions.manage'] }),
)

if (failed) {
  console.log(`\n${failed} failed`)
  process.exit(1)
}
console.log('\nall passed')