import { Request, Response } from 'express';
import { requireOrgAccess } from '../../../src/middleware/requireOrgAccess';

function buildReqRes(auth: Partial<Request['auth']> | undefined, orgId: string) {
  const req = { auth, params: { orgId } } as unknown as Request;
  const json = jest.fn();
  const status = jest.fn().mockReturnValue({ json });
  const res = { status } as unknown as Response;
  const next = jest.fn();
  return { req, res, next, status, json };
}

describe('requireOrgAccess', () => {
  test('lascia passare admin anche su un orgId diverso dal proprio', () => {
    const { req, res, next, status } = buildReqRes(
      { userId: 'u1', email: null, organizationId: 'org-mio', roles: ['admin'] },
      'org-altrui',
    );

    requireOrgAccess(req, res, next);

    expect(next).toHaveBeenCalled();
    expect(status).not.toHaveBeenCalled();
  });

  test('lascia passare capo-gruppo sulla propria organizzazione', () => {
    const { req, res, next, status } = buildReqRes(
      { userId: 'u1', email: null, organizationId: 'org-1', roles: ['capo-gruppo'] },
      'org-1',
    );

    requireOrgAccess(req, res, next);

    expect(next).toHaveBeenCalled();
    expect(status).not.toHaveBeenCalled();
  });

  test('risponde 403 se capo-gruppo prova ad accedere a un altro orgId', () => {
    const { req, res, next, status, json } = buildReqRes(
      { userId: 'u1', email: null, organizationId: 'org-1', roles: ['capo-gruppo'] },
      'org-2',
    );

    requireOrgAccess(req, res, next);

    expect(next).not.toHaveBeenCalled();
    expect(status).toHaveBeenCalledWith(403);
    expect(json).toHaveBeenCalled();
  });

  test('risponde 403 se manca il ruolo capo-gruppo (e non è admin)', () => {
    const { req, res, next, status } = buildReqRes(
      { userId: 'u1', email: null, organizationId: 'org-1', roles: ['censito'] },
      'org-1',
    );

    requireOrgAccess(req, res, next);

    expect(next).not.toHaveBeenCalled();
    expect(status).toHaveBeenCalledWith(403);
  });

  test('risponde 403 se req.auth è assente', () => {
    const { req, res, next, status } = buildReqRes(undefined, 'org-1');

    requireOrgAccess(req, res, next);

    expect(next).not.toHaveBeenCalled();
    expect(status).toHaveBeenCalledWith(403);
  });
});