package broker

import (
	"slices"
	"testing"
)

// Issue 1687 (ADR 0483 clause 2): a module whose manifest reads mesh-controller.plans-building may name it in `reads`, and
// reads the bucket and writes none; the controller writes it, so it is no mirror written by another.
func TestAModuleReadingPlansBuildingReadsAndWritesNone(t *testing.T) {
	if !slices.Contains(ControllerMirrors(), "plans-building") || BucketName(ControllerSeat, PlansBuilding) != PlansBuildingBucket {
		t.Fatalf("a module cannot name %s in `reads`: %v", PlansBuildingBucket, ControllerMirrors())
	}
	if _, other := MirrorsWrittenByAnother[PlansBuilding]; other {
		t.Error("the controller writes the plans building itself")
	}
	perms, err := PermissionsFor(Principal{Kind: KindModule, Node: "one", Module: "mesh-delivery-checker", PasswordHash: "x",
		Reads: []string{"mesh-controller.plans-building"}})
	if err != nil {
		t.Fatal(err)
	}
	stream := "KV_" + PlansBuildingBucket
	has(t, perms.Publish, "$JS.API.STREAM.INFO."+stream)
	has(t, perms.Publish, "$JS.API.DIRECT.GET."+stream+".>")
	for _, p := range perms.Publish {
		if SubjectsOverlap(p, "$KV."+PlansBuildingBucket+".plan-1") {
			t.Errorf("the reading module may write %s through %q", PlansBuildingBucket, p)
		}
	}
}