package broker

import "testing"

// The controller asks a tool that answers a software-issued credential in its own name, and nothing else under
// `call` (novox/hq ADR 0305 §2, issue 526): the grant is composed from the records, so the installer's first user
// list, a controller with no records, carries none.
func TestTheControllerAsksAnIssuedCredentialsToolInItsOwnNameAlone(t *testing.T) {
	r := Records{Nodes: []string{"n", "ace"}, Assigned: map[string][]Declared{
		"n":   {{Module: "x", Issued: []string{"t"}}},
		"ace": {{Module: "plex", Issued: []string{"plex_issued_credential"}}, {Module: "kometa"}},
	}}
	users, err := Users(r)
	if err != nil {
		t.Fatal(err)
	}
	controller := users[0]
	if controller.Kind != KindController {
		t.Fatalf("the first user is %s", controller.Username())
	}
	perms, err := PermissionsFor(controller)
	if err != nil {
		t.Fatal(err)
	}
	for _, s := range []string{
		"mesh.mod.x.call.t.n.controller",
		"mesh.mod.plex.call.plex_issued_credential.ace.controller",
	} {
		if !MayPublish(perms, s) {
			t.Errorf("the controller may not publish %s", s)
		}
	}
	for _, s := range []string{
		"mesh.mod.x.call.t.n.ace.node-tools",
		"mesh.mod.x.call.t.n." + CallerToken("ace.node-tools"),
		"mesh.mod.plex.call.plex_issued_credential.ace." + CallerToken("ace.node-tools"),
		"mesh.mod.plex.call.plex_status.ace.controller",
		"mesh.mod.kometa.call.t.ace.controller",
		"mesh.seat.mesh-controller.call.status.controller",
	} {
		if MayPublish(perms, s) {
			t.Errorf("the controller may publish %s", s)
		}
	}

	bare, err := PermissionsFor(Principal{Kind: KindController})
	if err != nil {
		t.Fatal(err)
	}
	if MayPublish(bare, "mesh.mod.x.call.t.n.controller") {
		t.Fatal("a controller composed with no records is granted a caller-named call")
	}
}