package broker

import (
	"slices"
	"testing"
)

// Issue 1840/S3 (ADR 0507 §5), 1840/AC5: a module whose manifest reads mesh-controller.declared-packages may name it in
// `reads`, and reads the bucket and writes none; the controller writes it, so it is no mirror written by another, and it is
// one of the controller's own buckets, asserted at its start.
func TestAModuleReadingDeclaredPackagesReadsAndWritesNone(t *testing.T) {
	if !slices.Contains(controllerReadableStates(), "declared-packages") ||
		BucketName(ControllerSeat, MirrorDeclaredPackages) != DeclaredPackagesBucket {
		t.Fatalf("a module cannot name %s in `reads`: %v", DeclaredPackagesBucket, controllerReadableStates())
	}
	if _, other := MirrorsWrittenByAnother[MirrorDeclaredPackages]; other {
		t.Error("the controller writes the declared packages itself")
	}
	if !IsControllerBucket(DeclaredPackagesBucket) || !slices.Contains(ControllerBuckets(), DeclaredPackagesBucket) {
		t.Errorf("%s is not among the controller's buckets", DeclaredPackagesBucket)
	}
	perms, err := PermissionsFor(Principal{Kind: KindModule, Node: "one", Module: "pacman", PasswordHash: "x",
		Reads: []string{"mesh-controller.declared-packages"}})
	if err != nil {
		t.Fatal(err)
	}
	stream := "KV_" + DeclaredPackagesBucket
	has(t, perms.Publish, "$JS.API.STREAM.INFO."+stream)
	has(t, perms.Publish, "$JS.API.DIRECT.GET."+stream+".>")
	has(t, perms.Publish, "$JS.API.CONSUMER.CREATE."+stream+".>")
	for _, p := range perms.Publish {
		if SubjectsOverlap(p, "$KV."+DeclaredPackagesBucket+".one") {
			t.Errorf("the reading module may write %s through %q", DeclaredPackagesBucket, p)
		}
	}
	controller, err := PermissionsFor(Principal{Kind: KindController, PasswordHash: "x"})
	if err != nil {
		t.Fatal(err)
	}
	has(t, controller.Publish, "$KV."+DeclaredPackagesBucket+".>")
}