const {
  assertRequestedUserMatchesSession,
  requireAdmin,
  requireSession,
} = require('./_session');

describe('cloud function session helper', () => {
  const originalFetch = global.fetch;

  afterEach(() => {
    global.fetch = originalFetch;
  });

  it('resolves user id from Parse session token', async () => {
    global.fetch = vi.fn().mockResolvedValue({
      ok: true,
      json: async () => ({ objectId: 'user-a', username: 'alice' }),
    });

    const session = await requireSession({ body: { sessionToken: 'token-a', userId: 'user-a' } });

    expect(session.userId).toBe('user-a');
    expect(global.fetch).toHaveBeenCalledWith(expect.stringContaining('/parse/users/me?include=company'), expect.objectContaining({
      headers: expect.objectContaining({ 'X-Parse-Session-Token': 'token-a' }),
    }));
  });

  it('rejects forged request user id', async () => {
    const session = { userId: 'user-a' };

    expect(() => assertRequestedUserMatchesSession({ body: { userId: 'user-b' } }, session)).toThrow('没有访问该账号数据的权限');
  });

  it('requires admin role for admin actions', async () => {
    global.fetch = vi.fn().mockResolvedValue({
      ok: true,
      json: async () => ({ objectId: 'user-a', role: 'user' }),
    });

    await expect(requireAdmin({ body: { sessionToken: 'token-a' } })).rejects.toMatchObject({ status: 403 });
  });
});