/**
 * Team member owner-invariant guards — S2-002 / S2-003 regression tests.
 */
import { describe, it, expect } from 'vitest'
import {
  guardDeleteTeamMember,
  guardPatchTeamMemberRole,
} from '../src/lib/team-member-guards'
import { isOwnerRole } from '../src/lib/system-roles'

describe('team member owner guards', () => {
  it('DELETE guard rejects removing the OWNER member with 400', () => {
    const result = guardDeleteTeamMember({
      actorUserId: 'admin-user',
      targetUserId: 'owner-user',
      targetMember: { role: 'OWNER' },
    })

    expect(result).toEqual({
      ok: false,
      status: 400,
      error: 'Cannot remove the owner',
    })
  })

  it('DELETE guard allows removing a non-owner member', () => {
    const result = guardDeleteTeamMember({
      actorUserId: 'owner-user',
      targetUserId: 'member-user',
      targetMember: { role: 'MEMBER' },
    })

    expect(result).toEqual({ ok: true })
  })

  it('PATCH guard rejects granting OWNER role with 403', () => {
    const result = guardPatchTeamMemberRole({
      targetMember: { role: 'MEMBER' },
      newRoleName: 'OWNER',
    })

    expect(result).toEqual({
      ok: false,
      status: 403,
      error: 'Use /team/transfer to grant ownership',
    })
  })

  it('PATCH guard rejects changing an existing OWNER role with 403', () => {
    const result = guardPatchTeamMemberRole({
      targetMember: { role: 'OWNER' },
      newRoleName: 'ADMIN',
    })

    expect(result).toEqual({
      ok: false,
      status: 403,
      error: "Cannot change owner's role; use /team/transfer",
    })
  })

  it('isOwnerRole matches seeded OWNER casing only', () => {
    expect(isOwnerRole('OWNER')).toBe(true)
    expect(isOwnerRole('owner')).toBe(false)
  })
})