import { describe, it, expect } from 'vitest';
import { makeFakePorts } from '@insignia/iios-testkit';
import { PolicyDeniedError } from '@insignia/iios-contracts';
import { decideOrThrow } from './fail-closed';

describe('decideOrThrow (fail-closed gate)', () => {
  it('returns the decision when OPA allows', async () => {
    const ports = makeFakePorts();
    const decision = await decideOrThrow(ports, {});
    expect(decision.allow).toBe(true);
  });

  it('throws PolicyDeniedError when OPA denies', async () => {
    const ports = makeFakePorts();
    ports.opa.deny('blocked');
    await expect(decideOrThrow(ports, {})).rejects.toBeInstanceOf(PolicyDeniedError);
  });

  it('throws PolicyDeniedError when OPA times out (never implicit-allow)', async () => {
    const ports = makeFakePorts();
    ports.opa.timeout();
    await expect(decideOrThrow(ports, {})).rejects.toBeInstanceOf(PolicyDeniedError);
  });
});
