package catalogue

import (
	"strings"
	"testing"
)

// A provision's credential may be one only a person outside the mesh can give (novox/hq ADR 0337 §1, issue 164):
// the offer says `issued-by: outside` and names neither an own secret nor a tool, and the parser refuses it beside
// either. An offer that says `software` keeps ADR 0305's shape.
func TestAnOfferMaySayAPersonOutsideTheMeshIssuesItsCredential(t *testing.T) {
	m, err := ParseManifest([]byte(`{"module":"tv","version":"1",
		"provides":[{"name":"tv-api","scope":"mesh","credential":{"issued-by":"outside"}}],
		"serves":{"tv-api":{"port":8989}}}`))
	if err != nil {
		t.Fatal(err)
	}
	if !m.IssuedOutsideOf("tv-api") {
		t.Fatal("the offer's credential issued outside was not read")
	}
	if m.IssuedOutsideOf("other") {
		t.Fatal("a provision the module does not offer reads as issued outside")
	}
	if _, issued := m.IssuedCredentialOf("tv-api"); issued {
		t.Fatal("a credential issued outside was read as issued by the software")
	}
	if _, shared := m.SharedCredentialOf("tv-api"); shared {
		t.Fatal("a credential issued outside was read as an own secret shared")
	}
	if who, offered := OffersIssuedOutside(map[string]Manifest{"tv": m}, "tv-api"); !offered || who != "tv" {
		t.Fatalf("the catalogue does not say tv offers tv-api issued outside: %q %v", who, offered)
	}

	for want, raw := range map[string]string{
		"names its own secret": `{"module":"d","version":"1","own-secrets":{"key":{"path":"/p","taken":"at-start"}},
			"provides":[{"name":"d-api","credential":{"issued-by":"outside","own":"key"}}]}`,
		"names the tool": `{"module":"d","version":"1",
			"provides":[{"name":"d-api","credential":{"issued-by":"outside","tool":"d_key"}}]}`,
		"the issuers an offer may name": `{"module":"d","version":"1",
			"provides":[{"name":"d-api","credential":{"issued-by":"a-person"}}]}`,
	} {
		if _, err := ParseManifest([]byte(raw)); err == nil || !strings.Contains(err.Error(), want) {
			t.Errorf("expected a refusal saying %q, got %v", want, err)
		}
	}
}