package broker

import (
	"slices"
	"testing"

	"git.novox.be/novox/mesh-sdk/go/delivery"
)

// Issue 1394/C9a (ADR 0528 clause 2): the grants bucket is mesh-sdk's, one of the controller's own buckets asserted at its
// start, written by the controller alone; the assigner, naming mesh-controller.grants in `reads`, reads it and writes
// nothing of it.
func TestTheAssignerReadsTheGrantsAndWritesNone(t *testing.T) {
	if GrantsBucket != delivery.ControllerGrantsBucket {
		t.Fatalf("the grants bucket is %s, mesh-sdk names %s", GrantsBucket, delivery.ControllerGrantsBucket)
	}
	if !slices.Contains(controllerReadableStates(), ControllerGrants) {
		t.Fatalf("a module cannot name %s in `reads`: %v", GrantsBucket, controllerReadableStates())
	}
	if _, other := MirrorsWrittenByAnother[ControllerGrants]; other {
		t.Error("the controller writes the grants itself")
	}
	if !IsControllerBucket(GrantsBucket) || !slices.Contains(ControllerBuckets(), GrantsBucket) {
		t.Errorf("%s is not among the controller's buckets", GrantsBucket)
	}
	perms, err := PermissionsFor(Principal{Kind: KindModule, Node: "novox", Module: "mesh-delivery-assigner", PasswordHash: "x",
		Reads: []string{"mesh-controller.grants"}})
	if err != nil {
		t.Fatal(err)
	}
	stream := "KV_" + GrantsBucket
	has(t, perms.Publish, "$JS.API.STREAM.INFO."+stream)
	has(t, perms.Publish, "$JS.API.CONSUMER.CREATE."+stream+".>")
	for _, p := range perms.Publish {
		if SubjectsOverlap(p, "$KV."+GrantsBucket+".mesh-x") {
			t.Errorf("the assigner may write %s through %q", GrantsBucket, p)
		}
	}
	controller, err := PermissionsFor(Principal{Kind: KindController, PasswordHash: "x"})
	if err != nil {
		t.Fatal(err)
	}
	has(t, controller.Publish, "$KV."+GrantsBucket+".>")
}