package runtimeapi

import (
	"context"
	"testing"

	"google.golang.org/grpc/codes"
	"google.golang.org/grpc/status"
)

func TestMetadataAdminReadAdmissionBindsExactDelegatedWorkload(t *testing.T) {
	admission, err := NewMetadataAdminReadAdmission(MetadataAdminReadSelection{
		OrgID: testOrgID, AppInstallationID: testInstallationID,
		WorkloadID: testWorkloadID,
	})
	if err != nil {
		t.Fatal(err)
	}
	ctx := metadataAdminReadTestContext(t)
	if _, err = admission.bind(ctx); err != nil {
		t.Fatalf("exact admission = %v", err)
	}

	trusted, _ := trustedCallFromContext(ctx)
	trusted.callerWorkloadID = "integration-service"
	wrong := context.WithValue(ctx, trustedCallContextKey{}, trusted)
	_, err = admission.bind(wrong)
	if status.Code(metadataAdminReadStatus(err)) != codes.PermissionDenied {
		t.Fatalf("wrong workload admission error = %v", err)
	}
}

func TestMetadataAdminReadAdmissionRequiresCompleteSelection(t *testing.T) {
	if admission, err := NewMetadataAdminReadAdmission(MetadataAdminReadSelection{}); err == nil || admission != nil {
		t.Fatalf("empty selection = %#v, error %v", admission, err)
	}
}