package runtimeapi

import (
	"context"
	"errors"
	"testing"
	"time"

	"github.com/nexuscrm/kernel/pkg/ports"
	"github.com/nexuscrm/metadata"
	"github.com/nexuscrm/metadata/catalogsnapshot"
	"github.com/nexuscrm/permissions"
	"github.com/nexuscrm/shared/pkg/constants"
	"github.com/nexuscrm/shared/pkg/contract"
	"github.com/nexuscrm/shared/pkg/models"
	"github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/delegationv1"
	permissionsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/effectivepermissionsv1"
	"github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/permissionstatev1"
	recordsemantic "github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/recordsv1"
	"github.com/pingcap-inc/nexuscrm-contract/wire-go/mapping"
	"google.golang.org/grpc/codes"
	"google.golang.org/grpc/status"
)

type effectivePermissionEngineFunc func(
	context.Context,
	*models.UserSession,
	string,
	permissionstatev1.Version,
) (*contract.EffectivePermissionsResult, error)

type effectivePermissionDecisionRepo struct {
	ports.PermissionRepository
	superUser          bool
	bulkObjectSQLCalls int
}

func (*effectivePermissionDecisionRepo) GetAllRoles(context.Context) ([]*models.UserRole, error) {
	return nil, nil
}

func (repo *effectivePermissionDecisionRepo) GetEffectiveSystemPermissions(context.Context, string, string) (map[string]bool, error) {
	if repo.superUser {
		return map[string]bool{string(constants.SuperUserCapability): true}, nil
	}
	return map[string]bool{}, nil
}

func (repo *effectivePermissionDecisionRepo) ListEffectiveObjectPermissionsForUser(context.Context, string, string) ([]models.ObjectPermissions, error) {
	repo.bulkObjectSQLCalls++
	return []models.ObjectPermissions{{
		SobjectType: "Workspace", PermissionsRead: true, PermissionsCreate: true,
		PermissionsEdit: true, PermissionsDelete: true,
		PermissionsViewAllRecords: true, PermissionsModifyAllRecords: true,
	}}, nil
}

func (*effectivePermissionDecisionRepo) LoadEffectiveObjectPermission(_ context.Context, _ *models.UserSession, object string) (*models.ObjectPermissions, error) {
	if object != "Workspace" {
		return nil, nil
	}
	return &models.ObjectPermissions{
		SobjectType: "Workspace", PermissionsRead: true, PermissionsCreate: true,
		PermissionsEdit: true, PermissionsDelete: true,
		PermissionsViewAllRecords: true, PermissionsModifyAllRecords: true,
	}, nil
}

func (f effectivePermissionEngineFunc) EffectivePermissions(
	ctx context.Context,
	viewer *models.UserSession,
	target string,
	floor permissionstatev1.Version,
) (*contract.EffectivePermissionsResult, error) {
	return f(ctx, viewer, target, floor)
}

func (f effectivePermissionEngineFunc) EffectivePermissionsSelected(
	ctx context.Context,
	viewer *models.UserSession,
	target string,
	_ permissionsemantic.Selection,
	floor permissionstatev1.Version,
) (*contract.EffectivePermissionsResult, error) {
	return f(ctx, viewer, target, floor)
}

type cachingEffectivePermissionEngine struct {
	reads       int
	validations int
}

type selectedEffectivePermissionEngine struct {
	completeReads int
	selectedReads int
	selection     permissionsemantic.Selection
}

func (engine *selectedEffectivePermissionEngine) EffectivePermissions(
	context.Context,
	*models.UserSession,
	string,
	permissionstatev1.Version,
) (*contract.EffectivePermissionsResult, error) {
	engine.completeReads++
	return nil, errors.New("complete permission projection must not run")
}

func (engine *selectedEffectivePermissionEngine) EffectivePermissionsSelected(
	_ context.Context,
	_ *models.UserSession,
	_ string,
	selection permissionsemantic.Selection,
	_ permissionstatev1.Version,
) (*contract.EffectivePermissionsResult, error) {
	engine.selectedReads++
	engine.selection = selection
	return &contract.EffectivePermissionsResult{
		SystemPermissions: map[string]bool{"ApiEnabled": true},
		ObjectPermissions: []contract.ObjectAccessProjection{
			{ResourceType: "OtherAppObject", CanRead: true},
			{ResourceType: "Workspace", CanRead: true},
		},
		FieldPermissions: []contract.FieldAccessProjection{
			{ResourceType: "OtherAppObject", FieldName: "Secret", CanRead: true},
			{ResourceType: "Workspace", FieldName: "Name", CanRead: true},
		},
		ApplicationPermissions: []contract.ApplicationAccessProjection{{
			ApplicationID: "Sales", CanView: true,
		}},
	}, nil
}

func (engine *cachingEffectivePermissionEngine) EffectivePermissions(
	context.Context,
	*models.UserSession,
	string,
	permissionstatev1.Version,
) (*contract.EffectivePermissionsResult, error) {
	engine.reads++
	return &contract.EffectivePermissionsResult{
		SystemPermissions: map[string]bool{"ApiEnabled": true},
	}, nil
}

func (engine *cachingEffectivePermissionEngine) ValidatePermissionFloor(
	context.Context,
	permissionstatev1.Version,
) error {
	engine.validations++
	return nil
}

func TestEffectivePermissionServerReusesOneRevisionBoundProjection(t *testing.T) {
	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
	defer cancel()
	engine := &cachingEffectivePermissionEngine{}
	server, err := NewEffectivePermissionServer(engine)
	if err != nil {
		t.Fatal(err)
	}
	wireRequest, err := mapping.ToWireReadEffectivePermissionsRequest(
		ctx,
		permissionsemantic.Request{TargetPrincipalID: "user-1"},
	)
	if err != nil {
		t.Fatal(err)
	}
	first, err := server.ReadEffectivePermissions(
		effectivePermissionTestContext(t, ctx), wireRequest,
	)
	if err != nil {
		t.Fatal(err)
	}
	first.SystemPermissions[0].Granted = false
	second, err := server.ReadEffectivePermissions(
		effectivePermissionTestContext(t, ctx), wireRequest,
	)
	if err != nil {
		t.Fatal(err)
	}
	if engine.reads != 1 || engine.validations != 0 {
		t.Fatalf(
			"revision-bound reads/duplicate validations = %d/%d, want 1/0",
			engine.reads, engine.validations,
		)
	}
	if server.metrics.hits.Load() != 1 || server.metrics.misses.Load() != 1 ||
		server.metrics.responseBytes.Load() == 0 || server.cache.len() != 1 {
		t.Fatalf(
			"cache metrics hits/misses/bytes/entries = %d/%d/%d/%d, want 1/1/>0/1",
			server.metrics.hits.Load(), server.metrics.misses.Load(),
			server.metrics.responseBytes.Load(), server.cache.len(),
		)
	}
	if len(second.SystemPermissions) != 1 || !second.SystemPermissions[0].Granted {
		t.Fatalf("cached response was not defensively detached: %+v", second)
	}

	_, err = server.ReadEffectivePermissions(
		effectivePermissionTestContextAtFloor(t, ctx, 8), wireRequest,
	)
	if err != nil {
		t.Fatal(err)
	}
	if engine.reads != 2 || engine.validations != 0 {
		t.Fatalf(
			"new admitted floor reads/duplicate validations = %d/%d, want 2/0",
			engine.reads, engine.validations,
		)
	}
	if server.metrics.hits.Load() != 1 || server.metrics.misses.Load() != 2 ||
		server.cache.len() != 2 {
		t.Fatalf(
			"floor-keyed cache metrics hits/misses/entries = %d/%d/%d, want 1/2/2",
			server.metrics.hits.Load(), server.metrics.misses.Load(), server.cache.len(),
		)
	}
}

func TestEffectivePermissionServerDoesNotReuseAuthorityAcrossSessions(t *testing.T) {
	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
	defer cancel()
	engine := &sessionScopedEffectivePermissionEngine{}
	server, err := NewEffectivePermissionServer(engine)
	if err != nil {
		t.Fatal(err)
	}
	wireRequest, err := mapping.ToWireReadEffectivePermissionsRequest(
		ctx,
		permissionsemantic.Request{TargetPrincipalID: "user-1"},
	)
	if err != nil {
		t.Fatal(err)
	}

	first, err := server.ReadEffectivePermissions(
		effectivePermissionTestContextForSession(
			t, ctx, "session-stale", "profile-current", 7,
		),
		wireRequest,
	)
	if err != nil {
		t.Fatal(err)
	}
	second, err := server.ReadEffectivePermissions(
		effectivePermissionTestContextForSession(
			t, ctx, "session-current", "profile-current", 7,
		),
		wireRequest,
	)
	if err != nil {
		t.Fatal(err)
	}
	if engine.reads != 2 {
		t.Fatalf("cross-session projection reads = %d, want 2", engine.reads)
	}
	if len(first.SystemPermissions) != 1 || first.SystemPermissions[0].PermissionId != "profile-current" ||
		len(second.SystemPermissions) != 1 || second.SystemPermissions[0].PermissionId != "profile-current" {
		t.Fatalf("cross-session responses = first:%+v second:%+v", first, second)
	}
}

type sessionScopedEffectivePermissionEngine struct {
	reads int
}

func (engine *sessionScopedEffectivePermissionEngine) EffectivePermissions(
	_ context.Context,
	viewer *models.UserSession,
	_ string,
	_ permissionstatev1.Version,
) (*contract.EffectivePermissionsResult, error) {
	engine.reads++
	return &contract.EffectivePermissionsResult{
		SystemPermissions: map[string]bool{viewer.ProfileID: true},
	}, nil
}

func (engine *sessionScopedEffectivePermissionEngine) ValidatePermissionFloor(
	context.Context,
	permissionstatev1.Version,
) error {
	return nil
}

func TestEffectivePermissionServerProjectsOneAuthorizedRevision(t *testing.T) {
	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
	defer cancel()
	revision := uint64(17)
	server, err := NewEffectivePermissionServer(
		effectivePermissionEngineFunc(func(
			_ context.Context,
			viewer *models.UserSession,
			target string,
			floor permissionstatev1.Version,
		) (*contract.EffectivePermissionsResult, error) {
			if viewer.ID != "user-1" || target != "user-2" ||
				floor.Revision() != 7 {
				t.Fatalf(
					"authority = %s/%s/%d",
					viewer.ID, target, floor.Revision(),
				)
			}
			return &contract.EffectivePermissionsResult{
				SystemPermissions: map[string]bool{
					"ViewSetup":  true,
					"ApiEnabled": false,
				},
				CustomPermissions: map[string]bool{"CanExport": false},
				ObjectPermissions: []contract.ObjectAccessProjection{
					{ResourceType: "OtherAppObject", CanRead: true},
					{ResourceType: "WorkItem", CanRead: true},
					{ResourceType: "Workspace", CanCreate: true},
				},
				FieldPermissions: []contract.FieldAccessProjection{
					{
						ResourceType: "OtherAppObject",
						FieldName:    "Secret",
						CanRead:      true,
					},
					{
						ResourceType: "Workspace",
						FieldName:    "Name",
						CanRead:      true,
					},
				},
				ApplicationPermissions: []contract.ApplicationAccessProjection{
					{ApplicationID: "Service", CanView: false},
					{ApplicationID: "Sales", CanView: true, IsDefault: true},
				},
				NavigationPermissions: []contract.NavigationAccessProjection{
					{NavigationKey: "Contact", CanView: false},
					{NavigationKey: "Account", CanView: true},
				},
				RecordTypePermissions: map[string]bool{
					"rt-visible": true,
					"rt-hidden":  false,
					"rt-other":   true,
				},
			}, nil
		}),
	)
	if err != nil {
		t.Fatal(err)
	}
	request := permissionsemantic.Request{
		TargetPrincipalID: "user-2", MinCatalogRevision: &revision,
	}
	wireRequest, err := mapping.ToWireReadEffectivePermissionsRequest(ctx, request)
	if err != nil {
		t.Fatal(err)
	}
	wireResponse, err := server.ReadEffectivePermissions(
		effectivePermissionTestContext(t, ctx), wireRequest,
	)
	if err != nil {
		t.Fatal(err)
	}
	response, err := mapping.FromWireReadEffectivePermissionsResponse(wireResponse)
	if err != nil {
		t.Fatal(err)
	}
	if len(response.SystemPermissions) != 2 ||
		response.SystemPermissions[0].PermissionID != "ApiEnabled" ||
		response.SystemPermissions[0].Granted ||
		response.SystemPermissions[1].PermissionID != "ViewSetup" ||
		!response.SystemPermissions[1].Granted ||
		len(response.ObjectPermissions) != 2 ||
		response.ObjectPermissions[0].ResourceType != "WorkItem" ||
		len(response.FieldPermissions) != 1 ||
		response.FieldPermissions[0].ResourceType != "Workspace" ||
		len(response.ApplicationPermissions) != 2 ||
		response.ApplicationPermissions[0].ApplicationID != "Sales" ||
		!response.ApplicationPermissions[0].CanView ||
		!response.ApplicationPermissions[0].IsDefault ||
		len(response.NavigationPermissions) != 2 ||
		response.NavigationPermissions[0].NavigationKey != "Account" ||
		!response.NavigationPermissions[0].CanView ||
		!effectivePermissionRecordTypeOutcome(
			response.RecordTypePermissions,
			"WorkItem", "rt-visible", true, true,
		) ||
		!effectivePermissionRecordTypeOutcome(
			response.RecordTypePermissions,
			"WorkItem", "rt-hidden", false, false,
		) ||
		effectivePermissionHasRecordType(
			response.RecordTypePermissions,
			"Workspace", constants.SyntheticMasterRecordTypeID,
		) ||
		effectivePermissionHasRecordType(response.RecordTypePermissions, "OtherAppObject", "rt-other") ||
		effectivePermissionHasRecordType(response.RecordTypePermissions, "WorkItem", "rt-inactive") ||
		response.Receipts.CatalogRevision != revision ||
		response.Receipts.SecurityEpoch != 3 {
		t.Fatalf("effective permission response = %#v", response)
	}
}

func TestEffectivePermissionServerSelectsBeforeCompleteProjection(t *testing.T) {
	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
	defer cancel()
	engine := &selectedEffectivePermissionEngine{}
	server, err := NewEffectivePermissionServer(engine)
	if err != nil {
		t.Fatal(err)
	}
	request := permissionsemantic.Request{Selection: &permissionsemantic.Selection{
		Sections: []permissionsemantic.Section{
			permissionsemantic.SectionObjectPermissions,
			permissionsemantic.SectionFieldPermissions,
			permissionsemantic.SectionRecordTypePermissions,
		},
		ResourceTypes: []string{"Workspace"},
	}}
	wireRequest, err := mapping.ToWireReadEffectivePermissionsRequest(ctx, request)
	if err != nil {
		t.Fatal(err)
	}
	wireResponse, err := server.ReadEffectivePermissions(
		effectivePermissionTestContext(t, ctx), wireRequest,
	)
	if err != nil {
		t.Fatal(err)
	}
	response, err := mapping.FromWireReadEffectivePermissionsResponse(wireResponse)
	if err != nil {
		t.Fatal(err)
	}
	if err := permissionsemantic.ValidateResponseForRequest(request, response); err != nil {
		t.Fatal(err)
	}
	if engine.completeReads != 0 || engine.selectedReads != 1 ||
		len(engine.selection.ResourceTypes) != 1 ||
		engine.selection.ResourceTypes[0] != "Workspace" {
		t.Fatalf(
			"engine complete/selected/scope = %d/%d/%#v",
			engine.completeReads, engine.selectedReads, engine.selection,
		)
	}
	if len(response.SystemPermissions) != 0 ||
		len(response.ApplicationPermissions) != 0 ||
		len(response.NavigationPermissions) != 0 ||
		len(response.ObjectPermissions) != 1 ||
		response.ObjectPermissions[0].ResourceType != "Workspace" ||
		len(response.FieldPermissions) != 1 ||
		response.FieldPermissions[0].ResourceType != "Workspace" {
		t.Fatalf("selected response = %#v", response)
	}
}

func TestEffectivePermissionProjectionDoesNotFallbackToAnotherCatalogProfile(t *testing.T) {
	_, err := semanticEffectivePermissions(
		&contract.EffectivePermissionsResult{},
		queryResponseTestView(t),
		recordsemantic.Receipts{},
	)
	var failure *recordsemantic.Failure
	if !errors.As(err, &failure) || failure.Category != recordsemantic.FailureInternal {
		t.Fatalf("wrong-profile projection error = %v", err)
	}
}

func TestEffectivePermissionRuntimeViewDrivesSuperUserAndParentControlledProjection(t *testing.T) {
	ctx := effectivePermissionTestContext(t, t.Context())
	metadataService, err := metadata.NewRuntimeMetadataService(RuntimeMetadataViewFromContext)
	if err != nil {
		t.Fatal(err)
	}
	for _, test := range []struct {
		name              string
		superUser         bool
		wantBulkObjectSQL int
	}{
		{name: "superuser projects from catalog", superUser: true, wantBulkObjectSQL: 0},
		{name: "parent-controlled child inherits stored parent", wantBulkObjectSQL: 1},
	} {
		t.Run(test.name, func(t *testing.T) {
			repo := &effectivePermissionDecisionRepo{superUser: test.superUser}
			service := permissions.NewPermissionService(repo, metadataService, nil)
			rows, err := service.ListEffectiveObjectPermissionsForUser(ctx, "user-1", "profile-1")
			if err != nil {
				t.Fatal(err)
			}
			byObject := make(map[string]models.ObjectPermissions, len(rows))
			for _, row := range rows {
				byObject[row.SobjectType] = row
			}
			child, childOK := byObject["WorkItem"]
			parent, parentOK := byObject["Workspace"]
			if !childOK || !parentOK || !child.PermissionsRead || !child.PermissionsCreate ||
				!child.PermissionsEdit || !child.PermissionsDelete || !parent.PermissionsRead {
				t.Fatalf("effective object rows = %#v", rows)
			}
			if repo.bulkObjectSQLCalls != test.wantBulkObjectSQL {
				t.Fatalf("bulk object SQL calls = %d, want %d", repo.bulkObjectSQLCalls, test.wantBulkObjectSQL)
			}
		})
	}
}

func TestEffectivePermissionServerFailsClosedOnDisclosureAndCancellation(t *testing.T) {
	tests := []struct {
		name string
		run  effectivePermissionEngineFunc
		code codes.Code
	}{
		{
			name: "forbidden target",
			run: func(
				context.Context,
				*models.UserSession,
				string,
				permissionstatev1.Version,
			) (*contract.EffectivePermissionsResult, error) {
				return nil, &contract.PermissionAdminError{
					Kind: contract.PermissionAdminErrorForbidden,
				}
			},
			code: codes.PermissionDenied,
		},
		{
			name: "missing target",
			run: func(
				context.Context,
				*models.UserSession,
				string,
				permissionstatev1.Version,
			) (*contract.EffectivePermissionsResult, error) {
				return nil, &contract.PermissionAdminError{
					Kind: contract.PermissionAdminErrorNotFound,
				}
			},
			code: codes.NotFound,
		},
		{
			name: "owner cancellation",
			run: func(
				context.Context,
				*models.UserSession,
				string,
				permissionstatev1.Version,
			) (*contract.EffectivePermissionsResult, error) {
				return nil, context.Canceled
			},
			code: codes.Unavailable,
		},
		{
			name: "stale permission authority",
			run: func(
				context.Context,
				*models.UserSession,
				string,
				permissionstatev1.Version,
			) (*contract.EffectivePermissionsResult, error) {
				return nil, &permissionsemantic.Failure{
					Category: permissionsemantic.FailureUnavailable,
				}
			},
			code: codes.Unavailable,
		},
	}
	for _, test := range tests {
		t.Run(test.name, func(t *testing.T) {
			base, cancel := context.WithTimeout(context.Background(), time.Second)
			defer cancel()
			server, err := NewEffectivePermissionServer(test.run)
			if err != nil {
				t.Fatal(err)
			}
			request, err := mapping.ToWireReadEffectivePermissionsRequest(
				base, permissionsemantic.Request{},
			)
			if err != nil {
				t.Fatal(err)
			}
			_, err = server.ReadEffectivePermissions(
				effectivePermissionTestContext(t, base), request,
			)
			if status.Code(err) != test.code {
				t.Fatalf("status = %v, want %v", err, test.code)
			}
		})
	}
}

func TestEffectivePermissionServerAttributesCallerCancellation(t *testing.T) {
	base, cancelBase := context.WithCancel(context.Background())
	server, err := NewEffectivePermissionServer(
		effectivePermissionEngineFunc(func(
			context.Context,
			*models.UserSession,
			string,
			permissionstatev1.Version,
		) (*contract.EffectivePermissionsResult, error) {
			cancelBase()
			return nil, errors.New("owner wrapper")
		}),
	)
	if err != nil {
		t.Fatal(err)
	}
	requestCtx, cancelDeadline := context.WithTimeout(base, time.Second)
	defer cancelDeadline()
	request, err := mapping.ToWireReadEffectivePermissionsRequest(
		requestCtx, permissionsemantic.Request{},
	)
	if err != nil {
		t.Fatal(err)
	}
	_, err = server.ReadEffectivePermissions(
		effectivePermissionTestContext(t, requestCtx), request,
	)
	if status.Code(err) != codes.Canceled {
		t.Fatalf("status = %v, want Canceled", err)
	}
}

func TestEffectivePermissionServerRejectsUnservedCatalogRevisionBeforeEngine(t *testing.T) {
	base, cancel := context.WithTimeout(context.Background(), time.Second)
	defer cancel()
	engineCalled := false
	server, err := NewEffectivePermissionServer(
		effectivePermissionEngineFunc(func(
			context.Context,
			*models.UserSession,
			string,
			permissionstatev1.Version,
		) (*contract.EffectivePermissionsResult, error) {
			engineCalled = true
			return &contract.EffectivePermissionsResult{}, nil
		}),
	)
	if err != nil {
		t.Fatal(err)
	}
	required := uint64(18)
	request, err := mapping.ToWireReadEffectivePermissionsRequest(
		base,
		permissionsemantic.Request{MinCatalogRevision: &required},
	)
	if err != nil {
		t.Fatal(err)
	}
	_, err = server.ReadEffectivePermissions(
		effectivePermissionTestContext(t, base),
		request,
	)
	if status.Code(err) != codes.FailedPrecondition || engineCalled {
		t.Fatalf(
			"unserved Catalog revision = %v, engine called = %v",
			err,
			engineCalled,
		)
	}
}

func effectivePermissionTestContext(
	t *testing.T,
	base context.Context,
) context.Context {
	return effectivePermissionTestContextAtFloor(t, base, 7)
}

func effectivePermissionTestContextAtFloor(
	t *testing.T,
	base context.Context,
	revision uint64,
) context.Context {
	return effectivePermissionTestContextForSession(
		t, base, "session-1", "profile-1", revision,
	)
}

func effectivePermissionTestContextForSession(
	t *testing.T,
	base context.Context,
	sessionID string,
	profileID string,
	revision uint64,
) context.Context {
	t.Helper()
	trusted := newTrustedCall(
		delegationv1.Claims{
			DelegationID:      "delegation-1",
			OrgID:             testOrgID,
			PrincipalID:       "user-1",
			SessionID:         sessionID,
			CallerWorkloadID:  testWorkloadID,
			AppInstallationID: testInstallationID,
			RuntimeAudience:   "runtime-test",
			Capabilities:      []string{permissionsemantic.CapabilityName},
			AuthEpoch:         2,
			SecurityEpoch:     3,
		},
		models.UserSession{ID: "user-1", ProfileID: profileID},
	)
	trusted.permissionFloor = effectivePermissionVersion(t, revision)
	ctx := context.WithValue(base, trustedCallContextKey{}, trusted)
	return context.WithValue(ctx, runtimeExecutionScopeContextKey{}, RuntimeExecutionScope{
		view:              effectivePermissionTestView(t),
		orgID:             testOrgID,
		appInstallationID: testInstallationID,
		workloadID:        testWorkloadID,
		capability:        permissionsemantic.CapabilityName,
		receipts: recordsemantic.Receipts{
			ProtocolVersion:   "1.0",
			CapabilityVersion: permissionsemantic.CapabilityName,
			CatalogRevision:   17,
			SchemaGeneration:  8,
			EngineGeneration:  9,
			SecurityEpoch:     3,
		},
	})
}

func effectivePermissionTestView(t *testing.T) *catalogsnapshot.RuntimeMetadataView {
	t.Helper()
	const revision catalogsnapshot.CatalogRevision = 17
	objects := []*models.ObjectMetadata{
		{
			ID: "object-work-item", APIName: "WorkItem", Label: "Work Item", PluralLabel: "Work Items",
			SharingModel: constants.SharingModelControlledByParent,
			Fields: []models.FieldMetadata{
				{
					ID: "work-item-id", APIName: constants.FieldID, Label: "ID",
					Type: constants.FieldTypeString, PhysicalName: "id", IsSystem: true,
				},
				{
					ID: "work-item-workspace", APIName: "WorkspaceId", Label: "Workspace",
					Type: constants.FieldTypeMasterDetail, PhysicalName: "workspace_id",
					Required: true, IsMasterDetail: true, ReferenceTo: []string{"Workspace"},
				},
			},
		},
		{
			ID: "object-workspace", APIName: "Workspace", Label: "Workspace", PluralLabel: "Workspaces",
			SharingModel: constants.SharingModelPublicReadWrite,
			Fields: []models.FieldMetadata{{
				ID: "workspace-name", APIName: constants.FieldName, Label: "Name",
				Type: constants.FieldTypeString, PhysicalName: "name",
			}},
		},
		{
			ID: "object-other", APIName: "OtherAppObject", Label: "Other", PluralLabel: "Other",
			SharingModel: constants.SharingModelPublicReadWrite,
			Fields: []models.FieldMetadata{{
				ID: "other-secret", APIName: "Secret", Label: "Secret",
				Type: constants.FieldTypeString, PhysicalName: "secret",
			}},
		},
	}
	input := catalogsnapshot.CompileInput{
		OrgID: testOrgID,
		Lineage: catalogsnapshot.Lineage{
			CatalogRevision: revision, SchemaGeneration: 8, EngineGeneration: 9,
		},
		Projections: []catalogsnapshot.RuntimeProjectionInput{{
			CatalogRevision: revision, AppInstallationID: testInstallationID,
			CapabilityID:   permissionsemantic.CapabilityName,
			Profile:        catalogsnapshot.ProjectionEffectivePermissionsV1,
			ObjectAPINames: []string{"WorkItem", "Workspace"},
		}},
		MutationDefinitions: []catalogsnapshot.MutationDefinitionInput{
			{CatalogRevision: revision, RecordType: &models.RecordType{ID: "rt-visible", ObjectAPIName: "WorkItem", DeveloperName: "Visible", Name: "Visible", IsActive: true}},
			{CatalogRevision: revision, RecordType: &models.RecordType{ID: "rt-hidden", ObjectAPIName: "WorkItem", DeveloperName: "Hidden", Name: "Hidden", IsActive: true}},
			{CatalogRevision: revision, RecordType: &models.RecordType{ID: "rt-inactive", ObjectAPIName: "WorkItem", DeveloperName: "Inactive", Name: "Inactive", IsActive: false}},
			{CatalogRevision: revision, RecordType: &models.RecordType{ID: "rt-other", ObjectAPIName: "OtherAppObject", DeveloperName: "Other", Name: "Other", IsActive: true}},
		},
	}
	for _, object := range objects {
		input.Objects = append(input.Objects, catalogsnapshot.ObjectInput{
			CatalogRevision: revision, Metadata: object,
		})
	}
	input.Relationships = []catalogsnapshot.RelationshipInput{{
		CatalogRevision: revision,
		Metadata: &models.Relationship{
			ID: "relationship-work-item-workspace", ChildObjectAPIName: "WorkItem",
			ParentObjectAPIName: "Workspace", FieldAPIName: "WorkspaceId",
			RelationshipType: "masterdetail", IsSharingParent: true,
		},
	}}
	snapshotArtifact, err := catalogsnapshot.CompileCatalogSnapshot(input)
	if err != nil {
		t.Fatal(err)
	}
	snapshot, err := catalogsnapshot.OpenCatalogSnapshot(snapshotArtifact)
	if err != nil {
		t.Fatal(err)
	}
	viewArtifact, err := catalogsnapshot.ProjectRuntimeMetadataView(
		snapshot,
		catalogsnapshot.ProjectionKey{
			AppInstallationID: testInstallationID,
			CapabilityID:      permissionsemantic.CapabilityName,
		},
	)
	if err != nil {
		t.Fatal(err)
	}
	view, err := catalogsnapshot.OpenRuntimeMetadataView(viewArtifact)
	if err != nil {
		t.Fatal(err)
	}
	return view
}

func effectivePermissionRecordTypeOutcome(
	permissions []permissionsemantic.RecordTypePermission,
	resourceType string,
	recordTypeID string,
	available bool,
	isDefault bool,
) bool {
	for _, permission := range permissions {
		if permission.ResourceType == resourceType && permission.RecordTypeID == recordTypeID {
			return permission.Available == available && permission.IsDefault == isDefault
		}
	}
	return false
}

func effectivePermissionHasRecordType(
	permissions []permissionsemantic.RecordTypePermission,
	resourceType string,
	recordTypeID string,
) bool {
	for _, permission := range permissions {
		if permission.ResourceType == resourceType && permission.RecordTypeID == recordTypeID {
			return true
		}
	}
	return false
}

func effectivePermissionVersion(
	t *testing.T,
	revision uint64,
) permissionstatev1.Version {
	t.Helper()
	lineage, err := permissionstatev1.LineageFromBytes(
		[]byte{1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16},
	)
	if err != nil {
		t.Fatal(err)
	}
	version, err := permissionstatev1.NewVersion(lineage, revision)
	if err != nil {
		t.Fatal(err)
	}
	return version
}