import test from 'node:test';
import assert from 'node:assert/strict';
import { BadRequestException, ForbiddenException } from '@nestjs/common';
import { GoalsService } from '../src/goals/goals.service.js';

const admin = { actor: 'goal-admin', role: 'org-admin', project: 'default', tenant: 'goal-test' };

test('goal project selector exposes only active allowlisted registry entries', () => {
  const result = new GoalsService().projects(admin);
  assert.ok(result.projects.some((project) => project.project_id === 'AINative_OKR_CASAN4'));
  assert.ok(result.projects.every((project) => project.context_roots.every((contextRoot) => !contextRoot.startsWith('/'))));
  assert.ok(result.projects.every((project) => project.project_id !== 'CASAN_DEMO_PROJECT_A'));
});

test('goal start rejects project ids outside the server registry before model routing', async () => {
  await assert.rejects(
    new GoalsService().start({ goal: 'Review the current application architecture safely', projectId: '../../tmp' }, admin),
    BadRequestException,
  );
});

test('goal project creation is restricted to organization administrators', () => {
  assert.throws(
    () => new GoalsService().createProject({ projectId: 'denied-project', domain: 'Denied Project' }, { ...admin, role: 'viewer' }),
    ForbiddenException,
  );
});