package broker

import "testing"

// The build agent's credential is the module principal `<node>.build-agent` (Username, KindModule): its manifest's
// `reads: ["mesh-delivery.pulls"]` reaches that principal as a read and a watch of mesh-delivery's bucket of pull requests'
// keys — the direct get of a key, the consumer a watch makes, the stream's info — and as no write and no direct
// subscription of the bucket's subjects (novox/hq ADR 0406 §4, issue 974).
func TestTheBuildAgentReadsAndWatchesThePullRequestsKeys(t *testing.T) {
	seat := Seat{Name: TheBuildSeat, Scope: "node", Accepts: []string{"build"}, Emits: []string{"built", "started"}}
	p := Principal{Kind: KindModule, Node: "one", Module: "build-agent", Holds: []Seat{seat},
		Reads: []string{"mesh-delivery.pulls"}, PasswordHash: "x"}
	if got := p.Username(); got != "one.build-agent" {
		t.Fatalf("the build agent's credential is %q", got)
	}
	perms, err := PermissionsFor(p)
	if err != nil {
		t.Fatal(err)
	}
	for _, s := range []string{
		"$JS.API.STREAM.INFO.KV_mesh-delivery_pulls",
		"$JS.API.DIRECT.GET.KV_mesh-delivery_pulls.>",
		"$JS.API.CONSUMER.CREATE.KV_mesh-delivery_pulls.>",
		"$JS.API.CONSUMER.DELETE.KV_mesh-delivery_pulls.>",
		// And the two check workers it takes from.
		"$JS.API.CONSUMER.MSG.NEXT.CHECKS_READY.CHECKS_READY_worker",
		"$JS.API.CONSUMER.MSG.NEXT.CHECKS_OTHER.CHECKS_OTHER_worker",
		"$JS.ACK.CHECKS_OTHER.CHECKS_OTHER_worker.>",
	} {
		has(t, perms.Publish, s)
	}
	hasNot(t, perms.Publish, "$KV."+PullsBucket+".>")
	hasNot(t, perms.Publish, "mesh.seat.node-build-agent.check.>")
	for _, s := range perms.Subscribe {
		if s == "$KV."+PullsBucket+".>" {
			t.Fatalf("the build agent subscribes the bucket's subjects directly: %v", perms.Subscribe)
		}
	}
}