from src.domain.project_auth.auth_contract import normalize_auth_contract


def test_legacy_email_is_not_a_password_provider():
    contract = normalize_auth_contract(providers=["email", "magic_link"])
    assert contract["identity_channels"] == ["email"]
    assert contract["auth_methods"] == ["passwordless"]
    assert contract["connections"] == [
        {"id": "local_magic_link", "method": "passwordless", "channel": "email"}
    ]


def test_oidc_connection_does_not_change_principal_or_role_vocabulary():
    contract = normalize_auth_contract(
        identity_channels=["oidc"],
        auth_methods=["oidc"],
        connections=[{"id": "microsoft_entra_xyz", "method": "oidc", "channel": "oidc"}],
    )
    assert contract["auth_methods"] == ["oidc"]
    assert contract["connections"][0]["id"] == "microsoft_entra_xyz"
    assert contract["audiences"] == ["staff", "customer"]