import { describe, expect, it } from "vitest";
import { canDisplayClientSecret } from "./clientSecretPolicy";

describe("client secret policy", () => {
  it("allows client secret display for server-side apps", () => {
    expect(
      canDisplayClientSecret({
        type: "private",
      }),
    ).toBe(true);
  });

  it("still allows client secret display for server-side apps even when headless login is enabled in metadata", () => {
    expect(
      canDisplayClientSecret({
        type: "private",
      }),
    ).toBe(true);
  });

  it("does not allow client secret display for PKCE apps", () => {
    expect(
      canDisplayClientSecret({
        type: "pkce",
      }),
    ).toBe(false);
  });
});
