import { describe, expect, it } from "vitest";
import { isOwnerOrPrivileged } from "./authorisation";

describe("isOwnerOrPrivileged", () => {
	it("allows the owner to act on their own resources", () => {
		expect(isOwnerOrPrivileged(7, 7, false)).toBe(true);
	});

	it("allows a privileged user to act on anyone", () => {
		expect(isOwnerOrPrivileged(7, 999, true)).toBe(true);
	});

	it("blocks a non-privileged user acting on someone else (the IDOR case)", () => {
		expect(isOwnerOrPrivileged(7, 999, false)).toBe(false);
	});

	it("allows a privileged owner (both conditions)", () => {
		expect(isOwnerOrPrivileged(7, 7, true)).toBe(true);
	});
});