package main

import (
	"testing"

	"github.com/novox/mesh-controller/internal/inventory"
)

// One consuming module's credential, and not its neighbours' on the same machine (novox/hq issue
// 268): a module that leaked its database password is no reason to restart every other consumer.
func TestARotationNarrowedToAModuleTouchesOnlyThatModulesCredential(t *testing.T) {
	holders := []inventory.Holder{
		{Provision: "postgres-database", Consumer: "ace", ConsumerModule: "letta", Provider: "ace"},
		{Provision: "postgres-database", Consumer: "ace", ConsumerModule: "n8n", Provider: "ace"},
		{Provision: "postgres-database", Consumer: "ace", ConsumerModule: "letta", Local: "reader", Provider: "ace"},
	}
	got := ofModule(holders, "letta")
	if len(got) != 2 || got[0].ConsumerModule != "letta" || got[1].Local != "reader" {
		t.Fatalf("narrowed to letta: %+v", got)
	}
	if len(ofModule(holders, "")) != 3 {
		t.Fatal("no module named narrowed anyway")
	}
	if len(ofModule(holders, "absent")) != 0 {
		t.Fatal("a module holding nothing matched")
	}
}