package inventory

import (
	"strings"
	"testing"

	"github.com/novox/mesh-controller/internal/catalogue"
)

// A member of a secret family is given by its full name, at the desk too, and a name outside the family is refused
// (novox/hq ADR 0283).
func TestAMemberIsGivableAtTheDeskAndANameOutsideTheFamilyIsNot(t *testing.T) {
	m := catalogue.Manifest{Module: "mounts", OwnSecrets: catalogue.OwnSecrets{
		"smb-password-*": {Path: "/s/smb-password-*.secret", IssuedBy: catalogue.IssuedOutside},
	}}
	if err := GivableAtDesk(m, "smb-password-games"); err != nil {
		t.Fatalf("a member was refused: %v", err)
	}
	for _, name := range []string{"smb-password-*", "smb-password-", "smb-password-a/b", "smb-password-A", "smb-credentials"} {
		err := GivableAtDesk(m, name)
		if err == nil {
			t.Errorf("%q was givable", name)
		} else if !strings.Contains(err.Error(), "smb-password-<name>") {
			t.Errorf("%q: the refusal does not say the family's form: %v", name, err)
		}
	}
}

// A member given is read back as given, sealed to the machine's key; the mesh makes none, so nothing else is.