import { AdminUsersService } from './admin-users.service';

/** SEC-07: a role's saved permissions are limited to rids the server knows. */
describe('AdminUsersService.setRoles', () => {
  let createMany: jest.Mock;
  let service: AdminUsersService;

  beforeEach(() => {
    createMany = jest.fn();
    const prisma = {
      userType: { findUnique: jest.fn(async () => ({ id: 90, permissions: [] })) },
      permission: { deleteMany: jest.fn(), createMany },
      $transaction: jest.fn(async () => []),
    };
    service = new AdminUsersService(prisma as never, {} as never, {} as never);
  });

  it('keeps catalogue rids and their tree parents, drops anything else', async () => {
    await service.setRoles(90, [
      'order.list',
      'order', // tree parent of order.list
      'persons', // tree parent of persons.*
      'notify.create.single.customer', // legacy tree leaf no route checks
      'made.up.permission',
      'order.list', // duplicate
      '',
    ]);
    const rows = createMany.mock.calls[0][0].data.map((d: { rid: string }) => d.rid);
    expect(rows.sort()).toEqual(['order', 'order.list', 'persons']);
  });
});