import { describe, expect, it } from 'vitest';
import { isExternalIdentity, pickManagementLoginError } from './admin-auth';

describe('admin-auth', () => {
  it('pickManagementLoginError prefers wrong-portal message', () => {
    const message = pickManagementLoginError({ error_code: 'WRONG_PORTAL', message: 'Ignored' });
    expect(message).toBe(
      'This login is only for internal management users. External users must use the public login page.',
    );
  });

  it('pickManagementLoginError uses payload message when available', () => {
    const message = pickManagementLoginError({ message: 'Invalid credentials' });
    expect(message).toBe('Invalid credentials');
  });

  it('pickManagementLoginError falls back when payload has no message', () => {
    const message = pickManagementLoginError({});
    expect(message).toBe('Sign in failed.');
  });

  it('isExternalIdentity returns true for public audience', () => {
    expect(isExternalIdentity({ audience: 'public' })).toBe(true);
  });

  it('isExternalIdentity returns true for external user type', () => {
    expect(isExternalIdentity({ user: { user_type: 'external_user' } })).toBe(true);
  });

  it('isExternalIdentity returns true for external account type', () => {
    expect(isExternalIdentity({ user: { accountType: 'external' } })).toBe(true);
  });

  it('isExternalIdentity returns false for internal/admin identity', () => {
    expect(isExternalIdentity({ audience: 'admin', user: { userType: 'employee' } })).toBe(false);
  });
});
