import assert from 'node:assert/strict';
import test from 'node:test';
import { isExternalIdentity, pickManagementLoginError } from './admin-auth.ts';

test('pickManagementLoginError prefers wrong-portal message', () => {
  const message = pickManagementLoginError({ error_code: 'WRONG_PORTAL', message: 'Ignored' });
  assert.equal(
    message,
    'This login is only for internal management users. External users must use the public login page.',
  );
});

test('pickManagementLoginError uses payload message when available', () => {
  const message = pickManagementLoginError({ message: 'Invalid credentials' });
  assert.equal(message, 'Invalid credentials');
});

test('pickManagementLoginError falls back when payload has no message', () => {
  const message = pickManagementLoginError({});
  assert.equal(message, 'Sign in failed.');
});

test('isExternalIdentity returns true for public audience', () => {
  assert.equal(isExternalIdentity({ audience: 'public' }), true);
});

test('isExternalIdentity returns true for external user type', () => {
  assert.equal(isExternalIdentity({ user: { user_type: 'external_user' } }), true);
});

test('isExternalIdentity returns true for external account type', () => {
  assert.equal(isExternalIdentity({ user: { accountType: 'external' } }), true);
});

test('isExternalIdentity returns false for internal/admin identity', () => {
  assert.equal(isExternalIdentity({ audience: 'admin', user: { userType: 'employee' } }), false);
});
