package mysql

import (
	"context"
	"testing"

	"git.yuntuo.hk/k2safe/orbit/internal/consoleauth"
	"git.yuntuo.hk/k2safe/orbit/internal/fault"
	"git.yuntuo.hk/k2safe/orbit/platform/auth"
)

func TestConsolePermissionInputAndFixedVersion(t *testing.T) {
	base := consoleauth.ApplicationInput{Kind: "SET_PERMISSIONS", NamespaceID: testID(t), CredentialID: testID(t), ExpectedRevision: 4, Reason: "enable scheduled tasks", Actions: []string{"tasks:submit", "schedules:read", "schedules:manage"}}
	if err := validateApplicationInput(base); err != nil {
		t.Fatal(err)
	}
	for _, tc := range []struct {
		name   string
		mutate func(*consoleauth.ApplicationInput)
	}{
		{"missing actions", func(in *consoleauth.ApplicationInput) { in.Actions = nil }},
		{"empty actions", func(in *consoleauth.ApplicationInput) { in.Actions = []string{} }},
		{"duplicate", func(in *consoleauth.ApplicationInput) { in.Actions = []string{"tasks:read", "tasks:read"} }},
		{"unknown", func(in *consoleauth.ApplicationInput) { in.Actions = []string{"unknown:action"} }},
		{"wildcard", func(in *consoleauth.ApplicationInput) { in.Actions = []string{"*"} }},
		{"expiry", func(in *consoleauth.ApplicationInput) { in.ValidDays = 7 }},
		{"grace", func(in *consoleauth.ApplicationInput) { in.GraceDays = 7 }},
		{"capability", func(in *consoleauth.ApplicationInput) { in.Capabilities = []string{"schedules"} }},
		{"queue", func(in *consoleauth.ApplicationInput) { in.Queue = "changed" }},
		{"missing version", func(in *consoleauth.ApplicationInput) { in.ExpectedRevision = 0 }},
		{"missing reason", func(in *consoleauth.ApplicationInput) { in.Reason = "" }},
	} {
		t.Run(tc.name, func(t *testing.T) {
			in := base
			tc.mutate(&in)
			if fault.Code(validateApplicationInput(in)) != "INVALID_ARGUMENT" {
				t.Fatal("invalid permission request accepted")
			}
		})
	}
	for _, kind := range []string{"CREATE", "ROTATE", "SET_EXPIRY", "FINALIZE"} {
		in := base
		in.Kind = kind
		for _, actions := range [][]string{{"tasks:read"}, {}} {
			in.Actions = actions
			if fault.Code(validateApplicationInput(in)) != "INVALID_ARGUMENT" {
				t.Fatalf("%s accepted actions", kind)
			}
		}
	}
	// 拒绝旧格式携带新语义及新格式冒充旧操作；这里不得访问数据库。
	for _, version := range []int{0, 1, 2, 4} {
		op := consoleauth.ApplicationOperation{Version: version, Input: base, OperationID: testID(t), ApplicationID: testID(t), NamespaceID: base.NamespaceID, CredentialID: base.CredentialID}
		if _, err := NewConsoleApplicationStore(nil, "admin").ApplyApplication(context.Background(), auth.Token{}, op); fault.Code(err) != "INVALID_ARGUMENT" {
			t.Fatalf("permission version %d accepted: %v", version, err)
		}
	}
	in := base
	in.Kind = "SET_EXPIRY"
	in.Actions = nil
	op := consoleauth.ApplicationOperation{Version: 3, Input: in, OperationID: testID(t), ApplicationID: testID(t), NamespaceID: in.NamespaceID, CredentialID: in.CredentialID}
	if _, err := NewConsoleApplicationStore(nil, "admin").ApplyApplication(context.Background(), auth.Token{}, op); fault.Code(err) != "INVALID_ARGUMENT" {
		t.Fatal("v3 accepted legacy action", err)
	}
}