package broker

import (
	"slices"
	"strings"
	"testing"
)

// **The controller may write every bucket it writes** (novox/hq to-be 45 §1, issue 269). Writing a
// key is a publish to the bucket's own subject, which the management interface's grant does not
// cover: the cancelled sets' writes timed out for want of this, and the controller's own buckets
// would have.
func TestTheControllerMayWriteEveryBucketItWrites(t *testing.T) {
	p, err := PermissionsFor(Principal{Kind: KindController, PasswordHash: "x"})
	if err != nil {
		t.Fatal(err)
	}
	want := []string{"$KV." + CallsBucket + ".>", "$KV." + HandActsBucket + ".>"}
	for _, seat := range seatsTheControllerAsks {
		if hasCancelledSet(seat) {
			want = append(want, "$KV."+CancelledSetName(seat)+".>")
		}
	}
	for _, subject := range want {
		if !slices.Contains(p.Publish, subject) {
			t.Errorf("the controller may not publish %s, so it cannot write that bucket", subject)
		}
	}
	if slices.Contains(p.Publish, "$KV.>") {
		t.Error("the controller may write any bucket, a module's state included")
	}
}

// **A machine's node tools may say they are there, as that machine and no other** (novox/hq to-be 45
// S11), and the controller may hear the bus's advisories and ask who answers — read-only, named.
func TestTheWatchedSignalsMayBeSaidAndHeard(t *testing.T) {
	tools, err := PermissionsFor(Principal{Kind: KindNodeTools, Node: "anchor", Module: RuntimeModule, PasswordHash: "x"})
	if err != nil {
		t.Fatal(err)
	}
	if !slices.Contains(tools.Publish, "mesh.control.anchor.tools-alive") {
		t.Error("the node tools may not say they are there")
	}
	for _, s := range tools.Publish {
		if strings.Contains(s, "tools-alive") && s != "mesh.control.anchor.tools-alive" {
			t.Errorf("the node tools may say %s", s)
		}
	}
	controller, err := PermissionsFor(Principal{Kind: KindController, PasswordHash: "x"})
	if err != nil {
		t.Fatal(err)
	}
	for _, s := range BusAdvisories {
		if !slices.Contains(controller.Subscribe, s) {
			t.Errorf("the controller may not hear %s", s)
		}
	}
	if !slices.Contains(controller.Publish, "$SRV.INFO") || slices.Contains(controller.Subscribe, "$JS.EVENT.>") {
		t.Error("the controller may not ask who answers, or hears every API call")
	}
}