package broker

import (
	"slices"
	"testing"
)

// Every machine's node-engine may ask its own node tools PING; the one running the controller may read
// the lease's key, and nothing else of the bucket (novox/hq ADR 0236).
func TestTheWitnessIsGrantedWhatItReadsAndNoMore(t *testing.T) {
	users, err := Users(Records{Nodes: []string{"control", "edge"},
		Assigned: map[string][]Declared{"control": {{Module: "mesh-controller"}}}})
	if err != nil {
		t.Fatal(err)
	}
	lease := "$JS.API.DIRECT.GET.KV_mesh-controller_lease.$KV.mesh-controller_lease.holder"
	for _, u := range users {
		if u.Kind != KindNode {
			continue
		}
		perms, err := PermissionsFor(u)
		if err != nil {
			t.Fatal(err)
		}
		if !slices.Contains(perms.Publish, "$SRV.PING.node-tools."+u.Node) {
			t.Errorf("%s may not ask its node tools: %v", u.Node, perms.Publish)
		}
		if got := slices.Contains(perms.Publish, lease); got != (u.Node == "control") {
			t.Errorf("%s may read the lease: %v", u.Node, got)
		}
		for _, p := range perms.Publish {
			if p == "$KV.mesh-controller_lease.>" || p == "$KV.mesh-controller_lease.holder" {
				t.Errorf("%s may write the lease", u.Node)
			}
		}
	}
}

// A module's health that asks one of its own tools is asked by the machine's node-engine, of the instance
// on its own machine and nowhere else (novox/hq ADR 0240, to-be 48 §3).
func TestTheEngineIsGrantedTheToolsItsModulesHealthAsks(t *testing.T) {
	users, err := Users(Records{Nodes: []string{"control", "edge"},
		Assigned: map[string][]Declared{"edge": {{Module: "keycloak", Checks: []string{"keycloak.keycloak_admin_health"}}}}})
	if err != nil {
		t.Fatal(err)
	}
	for _, u := range users {
		if u.Kind != KindNode {
			continue
		}
		perms, err := PermissionsFor(u)
		if err != nil {
			t.Fatal(err)
		}
		mine := "mesh.mod.keycloak.tool.keycloak_admin_health.edge"
		if got := slices.Contains(perms.Publish, mine); got != (u.Node == "edge") {
			t.Errorf("%s may ask keycloak's health tool on edge: %v", u.Node, got)
		}
		for _, p := range perms.Publish {
			if p == "mesh.mod.keycloak.tool.keycloak_admin_health" || p == "mesh.mod.keycloak.tool.>" {
				t.Errorf("%s may ask the tool of any machine: %s", u.Node, p)
			}
		}
	}
}