package runtimeidentity

import (
	"context"
	"testing"
	"time"

	featureauth "github.com/nexuscrm/auth"
	"github.com/nexuscrm/persistence"
)

func TestSessionAuthorityRejectsMissingAuthService(t *testing.T) {
	if authority := SessionAuthority(nil); authority != nil {
		t.Fatalf("SessionAuthority(nil) = %#v, want nil", authority)
	}
}

func TestRuntimeAuthoritiesRejectLegacySessionComposition(t *testing.T) {
	service := featureauth.NewAuthService(nil, nil, nil)
	if authority := PublicSessionAuthorityFrom(service); authority != nil {
		t.Fatalf("public authority = %#v, want strong capability rejection", authority)
	}
	if authority := SessionAuthority(service); authority != nil {
		t.Fatalf("durable authority = %#v, want strong capability rejection", authority)
	}
}

func TestRenewingSecurityStateUsesAuthorityRemainingLifetimeOnLocalClock(t *testing.T) {
	localNow := time.Date(2026, 7, 12, 8, 0, 0, 0, time.UTC)
	authorityNow := time.Date(2026, 7, 12, 10, 0, 0, 0, time.UTC)
	expires := authorityNow.Add(SecurityLeaseDuration)
	state, err := newRenewingSecurityState(context.Background(), func(_ context.Context, orgID, replicaID string, duration time.Duration) (persistence.RuntimeReplicaSecurityContext, bool, error) {
		if orgID != "org-1" || replicaID != "replica-1" || duration != SecurityLeaseDuration {
			t.Fatalf("renew selectors = %q, %q, %s", orgID, replicaID, duration)
		}
		return persistence.RuntimeReplicaSecurityContext{
			OrgID: "org-1", RuntimeAudience: "runtime", SecurityEpoch: 7, LeaseSecurityEpoch: 7,
			LeaseExpiresAt: expires, AuthorityNow: authorityNow,
		}, true, nil
	}, func(context.Context, string, string, string, string, string, time.Time) (persistence.RuntimeSecurityAdmissionState, error) {
		return persistence.RuntimeSecurityAdmissionState{}, nil
	}, "org-1", "replica-1", func() time.Time { return localNow })
	if err != nil {
		t.Fatal(err)
	}
	replica, ready := state.Replica()
	if !ready || !replica.LeaseExpiresAt.Equal(localNow.Add(SecurityLeaseDuration)) {
		t.Fatalf("replica = %#v ready=%v; authority clock offset leaked into local readiness", replica, ready)
	}
}