/**
 * TASK-0131 — SSO enforce-mode resolution (unit, mocked Prisma).
 *
 * `resolveEnforcedSsoOrgs` is the free function `AuthService.login` calls
 * BEFORE bcrypt: email → user → org memberships → the orgs with an ACTIVE,
 * ENFORCED `SsoProvider`. Empty list = normal password login; non-empty =
 * `403 {reason:"sso_required", orgs:[slugs]}`.
 */
import { beforeEach, describe, expect, it, vi } from "vitest";
import { resolveEnforcedSsoOrgs } from "../enforcement.js";

interface PrismaMock {
  user: { findUnique: ReturnType<typeof vi.fn> };
  ssoProvider: { findMany: ReturnType<typeof vi.fn> };
}
const mockPrisma = (): PrismaMock => ({
  user: { findUnique: vi.fn() },
  ssoProvider: { findMany: vi.fn() }
});

beforeEach(() => vi.clearAllMocks());

describe("TASK-0131 resolveEnforcedSsoOrgs", () => {
  it("returns [] for an unknown email (no user)", async () => {
    const prisma = mockPrisma();
    prisma.user.findUnique.mockResolvedValue(null);
    expect(await resolveEnforcedSsoOrgs(prisma as never, "ghost@nowhere.test")).toEqual([]);
    expect(prisma.ssoProvider.findMany).not.toHaveBeenCalled();
  });

  it("returns [] for a user with NO org memberships", async () => {
    const prisma = mockPrisma();
    prisma.user.findUnique.mockResolvedValue({ orgMemberships: [] });
    expect(await resolveEnforcedSsoOrgs(prisma as never, "solo@nowhere.test")).toEqual([]);
    expect(prisma.ssoProvider.findMany).not.toHaveBeenCalled();
  });

  it("returns the orgs with ENFORCED providers (enforce=true only)", async () => {
    const prisma = mockPrisma();
    prisma.user.findUnique.mockResolvedValue({
      orgMemberships: [{ organizationId: "org_a" }, { organizationId: "org_b" }, { organizationId: "org_c" }]
    });
    prisma.ssoProvider.findMany.mockResolvedValue([
      { organizationId: "org_a", type: "SAML", organization: { slug: "acme" } },
      { organizationId: "org_c", type: "OIDC", organization: { slug: "globex" } }
    ]);
    const res = await resolveEnforcedSsoOrgs(prisma as never, "alice@acme.test");
    expect(res).toEqual([
      { orgId: "org_a", slug: "acme", type: "SAML" },
      { orgId: "org_c", slug: "globex", type: "OIDC" }
    ]);
    // scoped to the user's orgs + only the enforced ones
    expect(prisma.ssoProvider.findMany).toHaveBeenCalledWith({
      where: { organizationId: { in: ["org_a", "org_b", "org_c"] }, enforce: true },
      select: { organizationId: true, type: true, organization: { select: { slug: true } } }
    });
  });

  it("returns [] when none of the user's orgs enforce SSO", async () => {
    const prisma = mockPrisma();
    prisma.user.findUnique.mockResolvedValue({ orgMemberships: [{ organizationId: "org_a" }] });
    prisma.ssoProvider.findMany.mockResolvedValue([]);
    expect(await resolveEnforcedSsoOrgs(prisma as never, "alice@acme.test")).toEqual([]);
  });

  it("lowercases the email before the user lookup", async () => {
    const prisma = mockPrisma();
    prisma.user.findUnique.mockResolvedValue({ orgMemberships: [] });
    await resolveEnforcedSsoOrgs(prisma as never, "ALICE@acme.test");
    expect(prisma.user.findUnique).toHaveBeenCalledWith({
      where: { email: "alice@acme.test" },
      select: { orgMemberships: { select: { organizationId: true } } }
    });
  });
});