import { describe, expect, it } from "vitest";
import {
  browserAllowedOperationNames,
  capabilityCallsEnabledForHost,
  createBrowserOperationPolicy,
  isBrowserAllowedOperationName,
} from "./browser-operation-policy.js";

describe("browser operation policy", () => {
  it("pins the authored console boundary independently from generated inventory", () => {
    expect(browserAllowedOperationNames).toEqual([
      "workflow.health",
      "workflow.sources.list",
      "workflow.capabilities.list",
      "workflow.capabilities.inspect",
      "workflow.draft_workspaces.list",
      "workflow.draft_workspaces.get",
      "workflow.draft_workspaces.inspect_authoring_contract",
      "workflow.draft_workspaces.create_empty",
      "workflow.draft_workspaces.create_from_capability",
      "workflow.draft_workspaces.add_step_from_capability",
      "workflow.draft_workspaces.update_capability_step",
      "workflow.draft_workspaces.set_route",
      "workflow.draft_workspaces.set_contract",
      "workflow.draft_workspaces.set_start",
      "workflow.draft_workspaces.set_step_input_bindings",
      "workflow.draft_workspaces.set_step_output_bindings",
      "workflow.draft_workspaces.validate",
      "workflow.draft_workspaces.set_workflow_output_bindings",
      "workflow.artifacts.list",
      "workflow.artifacts.inspect",
      "workflow.deployments.list",
      "workflow.deployments.inspect",
      "workflow.deployments.validate",
      "workflow.runs.list",
      "workflow.runs.inspect",
      "workflow.runs.start",
      "workflow.runs.resume",
      "workflow.runs.trace",
    ]);
    expect(isBrowserAllowedOperationName("workflow.health")).toBe(true);
    expect(browserAllowedOperationNames).toContain(
      "workflow.draft_workspaces.add_step_from_capability",
    );
    expect(browserAllowedOperationNames).not.toContain(
      "workflow.draft_workspaces.replace_document",
    );
    expect(browserAllowedOperationNames).not.toContain(
      "workflow.draft_workspaces.patch",
    );
    expect(browserAllowedOperationNames).not.toContain(
      "workflow.draft_workspaces.remove_step",
    );
    expect(isBrowserAllowedOperationName("workflow.admin.auth.list")).toBe(false);
  });

  it("classifies static, conditional, and unexposed operations", () => {
    const disabled = createBrowserOperationPolicy({
      enableCapabilityCalls: false,
    });
    const enabled = createBrowserOperationPolicy({
      enableCapabilityCalls: true,
    });

    expect(disabled.classify("workflow.health")).toBe("allowed");
    expect(disabled.classify("workflow.capabilities.call")).toBe("disabled");
    expect(enabled.classify("workflow.capabilities.call")).toBe("allowed");
    expect(disabled.classify("workflow.admin.auth.list")).toBe("unknown");
  });

  it.each([
    ["127.0.0.1", undefined, true],
    ["localhost", undefined, true],
    ["::1", undefined, true],
    ["0.0.0.0", undefined, false],
    ["192.168.1.20", undefined, false],
    ["192.168.1.20", "0", false],
    ["192.168.1.20", "1", true],
    ["192.168.1.20", "true", false],
  ] as const)(
    "computes capability-call access for host %s with override %s",
    (hostname, override, expected) => {
      expect(capabilityCallsEnabledForHost(hostname, override)).toBe(expected);
    },
  );
});