package permissions

import (
	"testing"

	"github.com/nexuscrm/shared/pkg/constants"
	"github.com/nexuscrm/shared/pkg/models"
)

// businessSchema is a non-system (business) object: IsSystemTable is false for
// any name without the _System_ prefix.
func businessSchema() *models.ObjectMetadata {
	return &models.ObjectMetadata{APIName: "Account"}
}

// TestResolvePermRule_SourceLimited locks in the fix for the 1/0/0/0/0/0 ->
// 1/1/1/0/0/0 over-grant: only the built-in profiles the platform declares
// defaults for receive a default rule. An unknown (SF-imported / admin-created)
// profile receives an empty rule and is therefore not seeded — it owns its
// access through import or explicit admin authoring.
func TestResolvePermRule_SourceLimited(t *testing.T) {
	t.Run("unknown profile gets no default rule", func(t *testing.T) {
		rule := resolvePermRule("00eIMPORTEDsalesprofile", businessSchema())
		if rule != (PermRule{}) {
			t.Fatalf("unknown profile must get empty PermRule (no StandardUser fallback), got %+v", rule)
		}
	})

	t.Run("StandardUser still gets business default", func(t *testing.T) {
		rule := resolvePermRule(constants.ProfileStandardUser, businessSchema())
		want := PermRule{Read: true, Create: true, Edit: true}
		if rule != want {
			t.Fatalf("StandardUser business default = %+v, want %+v", rule, want)
		}
	})

	t.Run("SystemAdmin still gets full default", func(t *testing.T) {
		rule := resolvePermRule(constants.ProfileSystemAdmin, businessSchema())
		want := PermRule{Read: true, Create: true, Edit: true, Delete: true, ViewAll: true, ModifyAll: true}
		if rule != want {
			t.Fatalf("SystemAdmin default = %+v, want all-true", rule)
		}
	})
}

// TestProfilePermRulesMatchPlatformDefaultProfiles binds the two sources of
// truth for "which profiles the platform owns default permissions for":
// profilePermRules (what the seeder seeds) and constants.PlatformDefaultProfileIDs
// (what coverage reconcile + verify gate on). If they drift, an imported profile
// could be seeded but not verified, or verified but not seeded. #1374.
func TestProfilePermRulesMatchPlatformDefaultProfiles(t *testing.T) {
	for id := range profilePermRules {
		if !constants.IsPlatformDefaultProfile(id) {
			t.Errorf("profilePermRules seeds %q but constants.IsPlatformDefaultProfile(%q) is false — verify/reconcile will not gate it", id, id)
		}
	}
	for id := range constants.PlatformDefaultProfileIDs {
		if _, ok := profilePermRules[id]; !ok {
			t.Errorf("constants.PlatformDefaultProfileIDs lists %q but profilePermRules does not seed it", id)
		}
	}
}

// TestBuildPermissions_UnknownProfileSeedsNothing confirms the downstream
// effect: with no default rule, an unknown profile produces no ObjectPermissions
// and no FieldPermissions rows, so a seed pass cannot manufacture access for it.
func TestBuildPermissions_UnknownProfileSeedsNothing(t *testing.T) {
	schema := &models.ObjectMetadata{
		APIName: "Account",
		Fields:  []models.FieldMetadata{{APIName: "Name"}},
	}
	objPerms, fieldPerms := BuildPermissionsForProfileAndSchema("00eIMPORTEDprofile", "ps_x", schema, false)
	if len(objPerms) != 0 {
		t.Fatalf("unknown profile must produce no ObjectPermissions, got %d", len(objPerms))
	}
	if len(fieldPerms) != 0 {
		t.Fatalf("unknown profile must produce no FieldPermissions, got %d", len(fieldPerms))
	}
}