readJsonBodyOrError: vi.fn(),

sendJson: vi.fn(),

sendMethodNotAllowed: vi.fn(),

sendMissingScopeForbidden: vi.fn(),

};

});

};

});

const { readJsonBodyOrError, sendJson, sendMethodNotAllowed } = await import("./http-common.js");

const { readJsonBodyOrError, sendJson, sendMethodNotAllowed, sendMissingScopeForbidden } =

await import("./http-common.js");

const { authorizeGatewayHttpRequestOrReply, resolveTrustedHttpOperatorScopes } =

await import("./http-utils.js");

const { authorizeOperatorScopesForMethod } = await import("./method-scopes.js");

allowed: false,

missingScope: "operator.write",

});

const mockedSendJson = vi.mocked(sendJson);

mockedSendJson.mockClear();

const mockedSendMissingScopeForbidden = vi.mocked(sendMissingScopeForbidden);

mockedSendMissingScopeForbidden.mockClear();

vi.mocked(readJsonBodyOrError).mockClear();

const result = await handleGatewayPostJsonEndpoint(

expect(vi.mocked(authorizeOperatorScopesForMethod)).toHaveBeenCalledWith("chat.send", [

"operator.approvals",

]);

expect(mockedSendJson).toHaveBeenCalledWith(

expect(mockedSendMissingScopeForbidden).toHaveBeenCalledWith(

expect.anything(),

403,

expect.objectContaining({

ok: false,

error: expect.objectContaining({

type: "forbidden",

message: "missing scope: operator.write",

}),

}),

"operator.write",

);

expect(vi.mocked(readJsonBodyOrError)).not.toHaveBeenCalled();

});