package broker

import "testing"

// 1840/AC9: a process account declaring the state `x` may watch and list the keys of its module's own bucket (a consumer
// created and deleted on KV_<module>_x), read and write it, and has no grant on another module's bucket or on a mirror of the
// controller's, whatever it is named after.
func TestAProcessMayWatchItsOwnStateAndNoOthers(t *testing.T) {
	p := Principal{Kind: KindProcess, Node: "novox", Module: "mesh-mail", Process: "send", State: []string{"x"}}
	got := perms(t, p)
	for _, s := range []string{
		"$JS.API.CONSUMER.CREATE.KV_mesh-mail_x",
		"$JS.API.CONSUMER.CREATE.KV_mesh-mail_x.watcher",
		"$JS.API.CONSUMER.CREATE.KV_mesh-mail_x.watcher.$KV.mesh-mail_x.>",
		"$JS.API.CONSUMER.DELETE.KV_mesh-mail_x.watcher",
		"$JS.API.DIRECT.GET.KV_mesh-mail_x.$KV.mesh-mail_x.key",
		"$JS.API.STREAM.INFO.KV_mesh-mail_x",
		"$JS.FC.KV_mesh-mail_x.watcher",
		"$KV.mesh-mail_x.key",
	} {
		if !allowed(got.Publish, s) {
			t.Errorf("the process may not publish %s, so it cannot watch or list its own state", s)
		}
	}
	for _, other := range []string{"mesh-other_x", "mesh-mail_y", DeclaredPackagesBucket, AssignmentsBucket} {
		for _, s := range []string{
			"$JS.API.CONSUMER.CREATE.KV_" + other,
			"$JS.API.CONSUMER.CREATE.KV_" + other + ".watcher",
			"$JS.API.CONSUMER.CREATE.KV_" + other + ".watcher.$KV." + other + ".>",
			"$JS.API.CONSUMER.DELETE.KV_" + other + ".watcher",
			"$JS.API.DIRECT.GET.KV_" + other + ".$KV." + other + ".key",
			"$JS.API.STREAM.INFO.KV_" + other,
			"$JS.FC.KV_" + other + ".watcher",
			"$KV." + other + ".key",
		} {
			if allowed(got.Publish, s) {
				t.Errorf("the process may publish %s, on a bucket that is not its own state", s)
			}
		}
	}
}