import { describe, expect, test } from "bun:test";
import * as authz from "../src/index.ts";

describe("@wrnexus/authz exports", () => {
  test("keeps the pre-existing surface", () => {
    for (const name of [
      "defineRbac",
      "hasRole",
      "any",
      "all",
      "attr",
      "authorize",
      "requireRole",
      "requirePermission",
      "allow",
      "deny",
      "decision",
      "owner",
      "anyDecision",
      "allDecisions",
      "authorizeDecision",
      "filterAuthorized",
    ]) {
      expect(typeof (authz as Record<string, unknown>)[name]).toBe("function");
    }
  });

  test("adds the registry, store, engine, and middleware surface", () => {
    for (const name of [
      "defineAuthz",
      "mergeCatalogs",
      "emptyCatalog",
      "memoryPermissionStore",
      "cachedPermissionStore",
      "memoryAuditSink",
      "consoleAuditSink",
      "createAuthzResolver",
      "expandRoles",
      "permissionMatches",
      "deniedBy",
      "authzMiddleware",
      "can",
      "decideFor",
      "guardPermission",
      "filterCan",
      "scopeKey",
      "safeRecord",
    ]) {
      expect(typeof (authz as Record<string, unknown>)[name]).toBe("function");
    }
  });

  test("exports the locals key used to reach the per-request resolver", () => {
    expect(typeof (authz as Record<string, unknown>).AUTHZ_LOCALS_KEY).toBe("string");
  });
});