import { describe, expect, it } from "vitest";
import { extractOidcRoles } from "../src/index";

function unsignedToken(payload: Record<string, unknown>) {
  return `header.${Buffer.from(JSON.stringify(payload)).toString("base64url")}.signature`;
}

describe("OIDC role extraction", () => {
  it("combines realm and configured-client roles from Keycloak tokens", () => {
    const roles = extractOidcRoles({
      clientId: "minecraft-account-manager-admin",
      profile: { groups: ["support"] },
      accessToken: unsignedToken({
        realm_access: { roles: ["minecraft-account-manager-admin"] },
        resource_access: {
          "minecraft-account-manager-admin": { roles: ["settings-editor"] },
        },
      }),
    });

    expect(roles).toEqual([
      "support",
      "minecraft-account-manager-admin",
      "settings-editor",
    ]);
  });

  it("treats malformed token payloads as having no roles", () => {
    expect(extractOidcRoles({ clientId: "admin", accessToken: "invalid" })).toEqual([]);
  });
});