package runtimeapi

import (
	"context"
	"testing"

	approvalnotificationsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/approvalnotificationflowv1"
)

func TestApprovalNotificationFlowReadAdmissionBindsExactDelegatedWorkload(t *testing.T) {
	admission, err := NewApprovalNotificationFlowReadAdmission(
		ApprovalNotificationFlowReadSelection{
			OrgID: testOrgID, AppInstallationID: testInstallationID, WorkloadID: testWorkloadID,
		},
	)
	if err != nil {
		t.Fatal(err)
	}
	ctx := approvalNotificationFlowReadTestContext(t)
	if _, err := admission.bind(ctx); err != nil {
		t.Fatal(err)
	}
	trusted, _ := trustedCallFromContext(ctx)
	trusted.callerWorkloadID = "another-workload"
	wrong := context.WithValue(ctx, trustedCallContextKey{}, trusted)
	if _, err := admission.bind(wrong); err == nil {
		t.Fatal("admission accepted a different workload")
	}
	if _, err := admission.bind(context.Background()); err == nil {
		t.Fatal("admission accepted a missing delegated identity")
	}
}

func TestApprovalNotificationFlowReadAdmissionRequiresCompleteSelection(t *testing.T) {
	if admission, err := NewApprovalNotificationFlowReadAdmission(ApprovalNotificationFlowReadSelection{}); err == nil || admission != nil {
		t.Fatalf("empty selection = %#v, %v", admission, err)
	}
	var admission *ApprovalNotificationFlowReadAdmission
	ctx := approvalNotificationFlowReadTestContext(t)
	if _, err := admission.bind(ctx); err == nil {
		t.Fatal("nil admission accepted request")
	}
	trusted, _ := trustedCallFromContext(ctx)
	if len(trusted.capabilities) != 1 || trusted.capabilities[0] != approvalnotificationsemantic.CapabilityName {
		t.Fatalf("delegated capabilities = %#v", trusted.capabilities)
	}
}