import { describe, expect, it } from 'vitest'
import { assertCanEditFields, assertCanManageGroups } from './authz.js'
import { isFieldAuthorizationError } from './errors.js'

describe('authz (capability only)', () => {
  it('allows when capability present', () => {
    expect(() => assertCanEditFields({ id: 'u', canEditFields: true })).not.toThrow()
    expect(() => assertCanManageGroups({ id: 'u', canManageGroups: true })).not.toThrow()
  })
  it('throws FieldAuthorizationError when capability absent', () => {
    try { assertCanEditFields({ id: 'u' }); throw new Error('no throw') }
    catch (e) { expect(isFieldAuthorizationError(e)).toBe(true) }
    expect(() => assertCanManageGroups({ id: 'u', canManageGroups: false })).toThrow()
  })
})