/**
 * Role-Based Access Control Tests
 * Verifies that different roles have correct permissions
 */

import { test, expect } from '@playwright/test';

test.describe('Role-Based Access Control', () => {
  test('SUPER_ADMIN should see Staff Management in navigation', async ({ page }) => {
    // Login as super admin
    await page.goto('/staff/login');
    await page.fill('input[type="text"]', 'asim');
    await page.fill('input[type="password"]', 'AsimMawidi2025!');
    await page.click('button[type="submit"]');
    await page.waitForURL('/staff/dashboard');

    // Should see Staff Management nav item
    await expect(page.locator('nav >> text=Staff Management')).toBeVisible();

    // Should be able to access staff management page
    await page.click('nav >> text=Staff Management');
    await expect(page).toHaveURL('/staff/dashboard/staff');
    await expect(page.locator('h1')).toContainText('Staff Management');
  });

  test('SUPER_ADMIN should see revenue in overview', async ({ page }) => {
    await page.goto('/staff/login');
    await page.fill('input[type="text"]', 'asim');
    await page.fill('input[type="password"]', 'AsimMawidi2025!');
    await page.click('button[type="submit"]');
    await page.waitForURL('/staff/dashboard');

    // Should see revenue card
    await expect(page.locator('text=Revenue Today')).toBeVisible();
  });

  test('unauthenticated access to staff routes should redirect', async ({ page }) => {
    const staffRoutes = [
      '/staff/dashboard',
      '/staff/dashboard/demos',
      '/staff/dashboard/contacts',
      '/staff/dashboard/users',
      '/staff/dashboard/analytics',
      '/staff/dashboard/staff',
    ];

    for (const route of staffRoutes) {
      await page.goto(route);
      // Should redirect to staff login
      await expect(page).toHaveURL('/staff/login', { timeout: 5000 });
    }
  });

  test('staff API routes should require authentication', async ({ page }) => {
    // Try to access API without auth
    const response = await page.request.get('/api/staff/dashboard/overview');

    // Should return 401 Unauthorized or redirect
    expect([401, 302, 307]).toContain(response.status());
  });

  test('role should be displayed in header', async ({ page }) => {
    await page.goto('/staff/login');
    await page.fill('input[type="text"]', 'asim');
    await page.fill('input[type="password"]', 'AsimMawidi2025!');
    await page.click('button[type="submit"]');
    await page.waitForURL('/staff/dashboard');

    // Should see role in header
    await expect(page.locator('text=SUPER ADMIN')).toBeVisible();
  });

  test('role badge should be shown in sidebar', async ({ page }) => {
    await page.goto('/staff/login');
    await page.fill('input[type="text"]', 'asim');
    await page.fill('input[type="password"]', 'AsimMawidi2025!');
    await page.click('button[type="submit"]');
    await page.waitForURL('/staff/dashboard');

    // Check sidebar role badge
    const sidebar = page.locator('aside');
    await expect(sidebar.locator('text=SUPER ADMIN')).toBeVisible();
  });
});

test.describe('Permission Enforcement', () => {
  test('staff management page requires SUPER_ADMIN role', async ({ page }) => {
    // This test assumes we have a STAFF role user
    // For now, verify that the page exists and loads for super admin

    await page.goto('/staff/login');
    await page.fill('input[type="text"]', 'asim');
    await page.fill('input[type="password"]', 'AsimMawidi2025!');
    await page.click('button[type="submit"]');
    await page.waitForURL('/staff/dashboard');

    // Navigate to staff management
    await page.goto('/staff/dashboard/staff');

    // Super admin should see the page
    await expect(page.locator('h1')).toContainText('Staff Management');
    await expect(page.locator('button:has-text("Add Staff Member")')).toBeVisible();
  });

  test('navigation items are filtered by role', async ({ page }) => {
    await page.goto('/staff/login');
    await page.fill('input[type="text"]', 'asim');
    await page.fill('input[type="password"]', 'AsimMawidi2025!');
    await page.click('button[type="submit"]');
    await page.waitForURL('/staff/dashboard');

    // SUPER_ADMIN should see all nav items
    const navItems = page.locator('nav a');
    const count = await navItems.count();

    // Should have at least 6 items (Overview, Demos, Contacts, Users, Analytics, Staff)
    expect(count).toBeGreaterThanOrEqual(6);
  });
});
