package auth

import (
	"testing"

	"steward/internal/model"
)

func TestPasswords(t *testing.T) {
	h, err := HashPassword("correct horse")
	if err != nil {
		t.Fatal(err)
	}
	if !CheckPassword(h, "correct horse") || CheckPassword(h, "wrong horse") || CheckPassword("", "") {
		t.Error("password check")
	}
	if _, err := HashPassword("short"); err == nil {
		t.Error("short password accepted")
	}
}

func TestTokens(t *testing.T) {
	tok, pid, hash := NewToken()
	gotPID, secret, err := ParseToken(tok)
	if err != nil || gotPID != pid || !CheckSecret(secret, hash) {
		t.Fatalf("token %q: %v", tok, err)
	}
	if _, _, err := ParseToken("jarl_abc_def"); err == nil {
		t.Error("a Jarl token was accepted")
	}
}

func TestPermissions(t *testing.T) {
	op := &model.User{Username: "op", Grants: Roles["operator"]}
	p := &Principal{User: op}
	if !p.Can(ResConfig, true) || !p.Can(ResAudit, false) || p.Can(ResAudit, true) || p.IsAdmin() {
		t.Error("operator")
	}
	admin := &model.User{Username: "admin", Admin: true}
	p = &Principal{User: admin, Token: &model.Token{Grants: []model.Grant{{Resource: ResLeases, Access: Read}}}}
	if !p.Can(ResLeases, false) || p.Can(ResLeases, true) || p.Can(ResConfig, false) || p.IsAdmin() {
		t.Error("restricted admin token")
	}
	if !Narrower(Roles["leases"], Roles["operator"]) || Narrower(Roles["operator"], Roles["viewer"]) {
		t.Error("narrower")
	}
	if _, err := ParseGrant("leases"); err == nil {
		t.Error("grant without access accepted")
	}
	if g, err := ParseGrant("Config:Write"); err != nil || g.Resource != "config" {
		t.Errorf("grant %v %v", g, err)
	}
}