import {describe, expect, it, vi, beforeEach} from 'vitest';

vi.mock('../../src/models/calendar/users/users.service.js', () => ({
	checkSession: vi.fn()
}));

import * as UserService from '../../src/models/calendar/users/users.service.js';
import * as CredentialService from '../../src/models/calendar/events/credentials.service.js';

/**
 * The public calendar is read anonymously by nachklang.art to show the next
 * upcoming event. That is a load-bearing property, not an accident: the
 * calendar auth migration (docs/calendar-auth-migration.md) keeps the shared
 * credentials only for the iCal export and moves everything else onto session
 * cookies, and the failure mode of getting that wrong is the public website
 * silently losing its events feed.
 *
 * So this pins both halves: public needs nothing, and the restricted calendars
 * still need something.
 */
describe('hasAccess', () => {
	beforeEach(() => {
		vi.resetAllMocks();
		process.env.MEMBER_CREDENTIAL = 'member-secret';
		process.env.CHOIR_CREDENTIAL = 'choir-secret';
		process.env.MANAGEMENT_CREDENTIAL = 'management-secret';
	});

	it('lets anyone read the public calendar with no session and no password', async () => {
		await expect(CredentialService.hasAccess('public', '', '', '', '127.0.0.1')).resolves.toBe(true);

		// It must not even reach the session check - an anonymous read of the
		// public calendar should not depend on the users table being available.
		expect(UserService.checkSession).not.toHaveBeenCalled();
	});

	it.each([
		['members', 'member-secret'],
		['choir', 'choir-secret'],
		['management', 'management-secret'],
		['birthdays', 'choir-secret']
	])('refuses %s without a credential and allows it with one', async (calendar, secret) => {
		(UserService.checkSession as any).mockResolvedValue(null);

		await expect(CredentialService.hasAccess(calendar, '', '', '', '127.0.0.1')).resolves.toBe(false);
		await expect(CredentialService.hasAccess(calendar, '', '', 'wrong', '127.0.0.1')).resolves.toBe(false);
		await expect(CredentialService.hasAccess(calendar, '', '', secret, '127.0.0.1')).resolves.toBe(true);
	});

	it('refuses an unknown calendar outright', async () => {
		await expect(CredentialService.hasAccess('nope', '', '', 'member-secret', '127.0.0.1')).resolves.toBe(false);
	});
});