import { describe, expect, it } from "vitest";
import {
  assertConnectionBindingNarrows,
  authorityContext,
  capability,
  unsafeOpaqueId,
  type Connection,
  type ConnectionId,
  type CredentialReferenceId,
  type PrincipalId,
  type ProjectId,
  type ProviderId,
} from "@awp/contracts";
describe("capability ceilings", () => {
  const read = capability("project.read"),
    write = capability("project.write");
  const principal = {
    id: unsafeOpaqueId<PrincipalId>("owner"),
    kind: "human" as const,
    capabilities: [read],
  };
  it("rejects authority broadening", () =>
    expect(() => authorityContext(principal, [read, write])).toThrow(/broadening/));
  it("rejects project connection binding broadening", () => {
    const c: Connection = {
      id: unsafeOpaqueId<ConnectionId>("c"),
      providerId: unsafeOpaqueId<ProviderId>("p"),
      credentialReferenceId: unsafeOpaqueId<CredentialReferenceId>("cred"),
      status: "connected",
      capabilities: [read],
      resources: ["repo:a"],
    };
    expect(() =>
      assertConnectionBindingNarrows(c, {
        projectId: unsafeOpaqueId<ProjectId>("project"),
        connectionId: c.id,
        capabilities: [read, write],
        resources: ["repo:a"],
        revision: 1,
      }),
    ).toThrow(/broadens/);
  });
});