package identity

import (
	"context"
	"testing"
	"time"
)

func newTestService(t *testing.T) (*Service, *MemoryStore) {
	t.Helper()
	store := NewMemoryStore()
	service, err := NewService(store, Config{SigningKey: []byte("0123456789abcdef0123456789abcdef"), BootstrapToken: "one-time-token", SessionTTL: time.Hour})
	if err != nil {
		t.Fatal(err)
	}
	return service, store
}

func TestBootstrapLoginRolesAndRevocation(t *testing.T) {
	service, _ := newTestService(t)
	ctx := context.Background()
	admin, err := service.Bootstrap(ctx, "one-time-token", "admin", "管理员", "StrongPass2026")
	if err != nil {
		t.Fatalf("Bootstrap() error = %v", err)
	}
	if _, err := service.Bootstrap(ctx, "one-time-token", "another", "", "SecondStrong2026"); err != ErrBootstrapDone {
		t.Fatalf("second Bootstrap() error = %v", err)
	}
	principal, raw, err := service.Login(ctx, "admin", "StrongPass2026")
	if err != nil {
		t.Fatalf("Login() error = %v", err)
	}
	if principal.Role != RoleAdministrator || !HasPermission(principal.Role, PermissionUsersWrite) {
		t.Fatalf("unexpected principal: %#v", principal)
	}
	authenticated, err := service.Authenticate(ctx, raw)
	if err != nil || authenticated.UserID != admin.ID {
		t.Fatalf("Authenticate() = %#v, %v", authenticated, err)
	}
	if err := service.Logout(ctx, authenticated); err != nil {
		t.Fatal(err)
	}
	if _, err := service.Authenticate(ctx, raw); err == nil {
		t.Fatal("revoked token remained valid")
	}
}

func TestInvalidLoginIsUniformAndAudited(t *testing.T) {
	service, _ := newTestService(t)
	ctx := context.Background()
	if _, _, err := service.Login(ctx, "missing", "WrongPass2026"); err == nil {
		t.Fatal("missing user login succeeded")
	}
	entries, err := service.ListAudit(ctx)
	if err != nil || len(entries) != 1 || entries[0].Outcome != "failure" {
		t.Fatalf("audit entries = %#v, %v", entries, err)
	}
}

func TestBellTokenIsRejected(t *testing.T) {
	service, _ := newTestService(t)
	if _, err := service.Authenticate(context.Background(), "not-a-sense-token"); err == nil {
		t.Fatal("foreign token accepted")
	}
}

func TestRoleMatrix(t *testing.T) {
	if HasPermission(RoleViewer, PermissionDeviceWrite) {
		t.Fatal("viewer received write permission")
	}
	if !HasPermission(RoleOperator, PermissionMediaWrite) {
		t.Fatal("operator missing media write permission")
	}
	if HasPermission(RoleSiteAdmin, PermissionUsersWrite) {
		t.Fatal("site admin received user write permission")
	}
}