package sshpush

import (
	"context"
	"testing"
)

// TestAuthorizeApplyMissingToken (P04, T3, C-44) verifies that
// AuthorizeApply returns an error when ORCA_OIDC_TOKEN is unset.
// The apply path MUST refuse to run without a verified operator
// token.
func TestAuthorizeApplyMissingToken(t *testing.T) {
	// Ensure the env var is unset for this test.
	t.Setenv("ORCA_OIDC_TOKEN", "")
	_, err := AuthorizeApply(context.Background(), "https://idp.example.com", "orca-cli")
	if err == nil {
		t.Fatal("expected error when ORCA_OIDC_TOKEN is unset, got nil")
	}
}

// TestAuthorizeApplyMissingIssuer verifies that AuthorizeApply returns
// an error when the issuer is empty (apply requires an OIDC issuer).
func TestAuthorizeApplyMissingIssuer(t *testing.T) {
	t.Setenv("ORCA_OIDC_TOKEN", "some-token")
	_, err := AuthorizeApply(context.Background(), "", "orca-cli")
	if err == nil {
		t.Fatal("expected error when issuer is empty, got nil")
	}
}