package auth

import (
	"context"
	"crypto/sha256"
	"encoding/hex"
	"os"
	"path/filepath"
	"strings"
	"testing"
)

func TestStaticSHA256AuthenticatesScopedPrincipal(t *testing.T) {
	token := "0123456789abcdef0123456789abcdef"
	digest := sha256.Sum256([]byte(token))
	path := filepath.Join(t.TempDir(), "auth.json")
	document := `{"version":1,"principals":[{` +
		`"token_sha256":"` + hex.EncodeToString(digest[:]) + `",` +
		`"subject_id":"operator-1","actor_type":"user","tenant_id":"tenant-a",` +
		`"site_ids":["site-a"],"permissions":["sense.devices.read"]}]}`
	if err := os.WriteFile(path, []byte(document), 0o600); err != nil {
		t.Fatal(err)
	}
	authenticator, err := LoadStaticSHA256(path)
	if err != nil {
		t.Fatal(err)
	}
	principal, err := authenticator.Authenticate(context.Background(), token)
	if err != nil {
		t.Fatal(err)
	}
	if principal.TenantID != "tenant-a" || !principal.AllowsSite("site-a") ||
		principal.AllowsSite("site-b") || !principal.Has(PermissionDevicesRead) {
		t.Fatalf("unexpected principal: %+v", principal)
	}
	if _, err := authenticator.Authenticate(context.Background(), strings.Repeat("x", 32)); err == nil {
		t.Fatal("unknown token authenticated")
	}
}

func TestStaticSHA256RejectsUnsafeRegistry(t *testing.T) {
	tests := []string{
		`{"version":1,"principals":[]}`,
		`{"version":1,"principals":[{"token_sha256":"ABC","subject_id":"x","actor_type":"service","tenant_id":"tenant","site_ids":["*"],"permissions":["sense.devices.read"]}]}`,
		`{"version":1,"principals":[{"token_sha256":"` + strings.Repeat("0", 64) + `","subject_id":"x","actor_type":"system","tenant_id":"tenant","site_ids":["*"],"permissions":["sense.devices.read"]}]}`,
		`{"version":1,"principals":[{"token_sha256":"` + strings.Repeat("0", 64) + `","subject_id":"x","actor_type":"service","tenant_id":"tenant","site_ids":["*"],"permissions":["admin"]}]}`,
	}
	for index, document := range tests {
		path := filepath.Join(t.TempDir(), "auth.json")
		if err := os.WriteFile(path, []byte(document), 0o600); err != nil {
			t.Fatal(err)
		}
		if _, err := LoadStaticSHA256(path); err == nil {
			t.Fatalf("unsafe registry %d was accepted", index)
		}
	}
}