package declaration

import (
	"strings"
	"testing"
)

// Defends novox/hq ADR 0349 §4 (issue 668): the declaration names the account the provisioner's client runs as,
// the only one whose write of a filled file the node-engine accepts. Read here before any controller sends it.

func TestTheDeclarationNamesTheProvisionersAccount(t *testing.T) {
	d, err := Parse([]byte(`{"declaration":1,"provisioner_account":"mesh-node-provisioner","filled_files":["/etc/a"],
	  "resources":[{"id":"a","type":"file","path":"/etc/a","content":"a","owner-at-runtime":"owned"}]}`))
	if err != nil {
		t.Fatal(err)
	}
	if d.Provisioner != "mesh-node-provisioner" {
		t.Errorf("the provisioner's account read as %q", d.Provisioner)
	}
	d, err = Parse([]byte(`{"declaration":1,"resources":[{"id":"a","type":"file","path":"/etc/a","content":"a"}]}`))
	if err != nil {
		t.Fatal(err)
	}
	if d.Provisioner != "" {
		t.Errorf("a declaration naming no account names %q", d.Provisioner)
	}
}

func TestAProvisionersAccountThatIsNoAccountIsRefused(t *testing.T) {
	for name, account := range map[string]string{"root": "root", "not a name": "a b", "a path": "../x"} {
		_, err := Parse([]byte(`{"declaration":1,"provisioner_account":"` + account + `",
		  "resources":[{"id":"a","type":"file","path":"/etc/a","content":"a"}]}`))
		if err == nil || !strings.Contains(err.Error(), "provisioner_account") {
			t.Errorf("%s: want a refusal naming provisioner_account, got %v", name, err)
		}
	}
}