package catalogue

import (
	"strings"
	"testing"
)

// A provision's credential may be issued by its provider's software (novox/hq ADR 0305, issue 526): the offer
// names the tool that answers it and no own secret, and every other shape is refused at parse.
func TestAnOfferMaySayItsSoftwareIssuesTheCredential(t *testing.T) {
	m, err := ParseManifest([]byte(`{"module":"media","version":"1",
		"provides":[{"name":"media-api","scope":"mesh","credential":{"issued-by":"software","tool":"media_issued_credential"}}],
		"serves":{"media-api":{"port":32400}}}`))
	if err != nil {
		t.Fatal(err)
	}
	if tool, issued := m.IssuedCredentialOf("media-api"); !issued || tool != "media_issued_credential" {
		t.Fatalf("the offer's issued credential was not read: %q %v", tool, issued)
	}
	if _, shared := m.SharedCredentialOf("media-api"); shared {
		t.Fatal("an issued credential was read as an own secret shared")
	}
	if _, issued := m.IssuedCredentialOf("other"); issued {
		t.Fatal("a provision the module does not offer reads as issued")
	}

	for want, raw := range map[string]string{
		"the one issuer an offer may name": `{"module":"d","version":"1",
			"provides":[{"name":"d-api","credential":{"issued-by":"vendor","tool":"d_token"}}]}`,
		"names no tool that answers it": `{"module":"d","version":"1",
			"provides":[{"name":"d-api","credential":{"issued-by":"software"}}]}`,
		"names its own secret": `{"module":"d","version":"1","own-secrets":{"token":{"path":"/p","taken":"at-start"}},
			"provides":[{"name":"d-api","credential":{"issued-by":"software","tool":"d_token","own":"token"}}]}`,
		"the one issuer an offer may name ": `{"module":"d","version":"1",
			"provides":[{"name":"d-api","credential":{"tool":"d_token"}}]}`,
	} {
		want = strings.TrimSpace(want)
		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), want) {
			t.Errorf("expected a refusal saying %q, got %v", want, err)
		}
	}
}