package auth

import (
	"net/http"
	"net/http/httptest"
	"testing"
)

func TestPermit(t *testing.T) {
	m := New("X-Forwarded-Groups", []string{"akP-repospawner-user", "akR-platform"})

	cases := []struct {
		name   string
		values []string
		want   bool
	}{
		{name: "no header", want: false},
		{name: "unrelated group", values: []string{"akP-mediamark-user"}, want: false},
		{name: "exact group", values: []string{"akP-repospawner-user"}, want: true},
		{name: "comma list", values: []string{"a,akR-platform,b"}, want: true},
		{name: "repeated header", values: []string{"nope", "akR-platform"}, want: true},
		{name: "empty value", values: []string{""}, want: false},
		{name: "prefix only", values: []string{"akP-repospawner"}, want: false},
	}
	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			r := httptest.NewRequest(http.MethodGet, "/api/requests", nil)
			for _, v := range tc.values {
				r.Header.Add("X-Forwarded-Groups", v)
			}
			if got := m.Permit(r); got != tc.want {
				t.Errorf("Permit = %v, want %v", got, tc.want)
			}
		})
	}
}

func TestEmptyAllowListDeniesEverything(t *testing.T) {
	m := New("X-Forwarded-Groups", nil)
	r := httptest.NewRequest(http.MethodGet, "/", nil)
	r.Header.Set("X-Forwarded-Groups", "anything")
	if m.Permit(r) {
		t.Error("an empty allow-list must deny")
	}
}

func TestWrap(t *testing.T) {
	m := New("X-Forwarded-Groups", []string{"ok"})
	var reached bool
	h := m.Wrap(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
		reached = true
		w.WriteHeader(http.StatusNoContent)
	}))

	denied := httptest.NewRecorder()
	h.ServeHTTP(denied, httptest.NewRequest(http.MethodGet, "/", nil))
	if denied.Code != http.StatusForbidden {
		t.Errorf("status = %d, want 403", denied.Code)
	}
	if reached {
		t.Error("the wrapped handler ran for a denied request")
	}

	req := httptest.NewRequest(http.MethodGet, "/", nil)
	req.Header.Set("X-Forwarded-Groups", "ok")
	allowed := httptest.NewRecorder()
	h.ServeHTTP(allowed, req)
	if allowed.Code != http.StatusNoContent || !reached {
		t.Errorf("status = %d reached = %v", allowed.Code, reached)
	}
}