import test from 'node:test';
import assert from 'node:assert/strict';
import {runTenant,authorize} from '../src/tenant/engine.mjs';
const metric=(r,key)=>r.metrics.find(([name])=>name===key)[1];

test('Tenant policies block foreign rows, omitted filters, edits and expired sessions',async()=>{
 const bad=await runTenant({preset:'cross-tenant',variant:'broken'});assert.equal(metric(bad,'Foreign rows'),1);
 const good=await runTenant({preset:'cross-tenant',variant:'safe'});assert.equal(metric(good,'Foreign rows'),0);assert.equal(metric(good,'Response status'),404);
 const all=await runTenant({preset:'missing-filter',variant:'safe'});assert.equal(metric(all,'Rows returned'),1);
 const edit=await runTenant({preset:'viewer-edit',variant:'safe'});assert.equal(metric(edit,'Response status'),403);
 const old=await runTenant({preset:'expired',variant:'safe'});assert.equal(metric(old,'Response status'),401);
 assert.equal(authorize({tenant:'a',memberships:['b'],role:'editor',expires:99},'read',1).status,403);
});