package main

import (
	"strings"
	"testing"
)

// novox/hq ADR 0259 §8: who can become root here without a person, as the self-check asks it.
func TestWhoCanBecomeRootWithoutAPerson(t *testing.T) {
	var calls []call
	run := byLine(map[string]Ran{
		"id -nG ops":            {Stdout: "ops wheel\n"},
		"sudo -n -l -U ops":     {Stdout: "User ops may run the following commands on anchor:\n    (ALL : ALL) NOPASSWD: ALL\n"},
		"id -nG agents":         {Stdout: "agents\n"},
		"sudo -n -l -U agents":  {Stdout: "User agents is not allowed to run sudo on anchor.\n"},
		"id -nG builder":        {Stdout: "builder docker\n"},
		"id -nG careful":        {Stdout: "careful wheel\n"},
		"sudo -n -l -U careful": {Stdout: "User careful may run the following commands on anchor:\n    (ALL : ALL) ALL\n"},
		"id -nG ghost":          {Status: 1, Stderr: "id: 'ghost': no such user"},
	}, &calls)
	got, err := machine(run, 1000).Escalations([]string{"ops", "agents", "builder", "careful", "ghost", "root"})
	if err != nil {
		t.Fatal(err)
	}
	want := map[string]bool{"ops": true, "agents": false, "builder": true, "careful": false, "ghost": false, "root": true}
	for _, e := range got {
		if e.Root != want[e.Account] || e.Why == "" {
			t.Errorf("%s: root %v (%s), want %v", e.Account, e.Root, e.Why, want[e.Account])
		}
	}
	if _, err := machine(run, 1000).Escalations([]string{"a b"}); err == nil || !strings.Contains(err.Error(), "not an account name") {
		t.Errorf("an account name that is not one was asked: %v", err)
	}
}