package permissions

import (
	"context"
	"testing"

	"github.com/nexuscrm/shared/pkg/constants"
	"github.com/nexuscrm/shared/pkg/models"
)

func TestSuperUserCapabilityDoesNotDependOnProfileName(t *testing.T) {
	ctx := context.Background()
	user := &models.UserSession{ID: "jira-admin-user", ProfileID: "jira_admin"}
	repo := &grantDenyTestRepo{
		effectivePerms: map[string]bool{
			string(constants.SuperUserCapability): true,
		},
	}
	ps := NewPermissionService(repo, nil, nil)

	if !ps.HasSuperUserCapability(ctx, user) {
		t.Fatal("HasSuperUserCapability = false for non-system_admin profile with ModifyAllData")
	}
	if ps.CheckSystemPermission(ctx, user, string(constants.PermManageUsers)) {
		t.Fatal("CheckSystemPermission(ManageUsers) = true; ModifyAllData must not grant setup/admin permissions")
	}
	if !ps.CheckObjectPermissionWithUser(ctx, "Issue", constants.PermDelete, user) {
		t.Fatal("CheckObjectPermissionWithUser(Delete Issue) = false; super-user capability should bypass object CRUD")
	}
	if !mustCheckFieldVisibilityWithUser(t, ps, ctx, "Issue", "Summary", user) {
		t.Fatal("CheckFieldVisibilityWithUser(Issue.Summary) = false; super-user capability should bypass FLS")
	}
}

func TestSuperUserCapabilityDoesNotSatisfySetupObjectSystemGates(t *testing.T) {
	ctx := context.Background()
	user := &models.UserSession{ID: "jira-admin-user", ProfileID: "jira_admin"}
	meta := &pcMetadataStub{schemas: map[string]*models.ObjectMetadata{
		constants.TableUser: {
			APIName:                 constants.TableUser,
			TableType:               constants.TableTypeSystemCore,
			RequiredWritePermission: string(constants.PermManageUsers),
		},
		"_System_SetupOnly": {
			APIName:                "_System_SetupOnly",
			TableType:              constants.TableTypeSystemCore,
			RequiredReadPermission: string(constants.PermViewSetup),
		},
	}}

	mdaOnly := NewPermissionService(&grantDenyTestRepo{
		effectivePerms: map[string]bool{
			string(constants.SuperUserCapability): true,
		},
	}, meta, nil)
	if mdaOnly.CheckObjectPermissionWithUser(ctx, constants.TableUser, constants.PermEdit, user) {
		t.Fatal("CheckObjectPermissionWithUser(Edit User) = true for ModifyAllData-only user; RequiredWritePermission must require ManageUsers")
	}
	if mdaOnly.CheckObjectPermissionWithUser(ctx, "_System_SetupOnly", constants.PermRead, user) {
		t.Fatal("CheckObjectPermissionWithUser(Read setup table) = true for ModifyAllData-only user; RequiredReadPermission must require ViewSetup")
	}

	withRequiredWritePerm := NewPermissionService(&grantDenyTestRepo{
		effectivePerms: map[string]bool{
			string(constants.SuperUserCapability): true,
			string(constants.PermManageUsers):     true,
		},
	}, meta, nil)
	if !withRequiredWritePerm.CheckObjectPermissionWithUser(ctx, constants.TableUser, constants.PermEdit, user) {
		t.Fatal("CheckObjectPermissionWithUser(Edit User) = false with explicit ManageUsers plus data capability")
	}

	withRequiredReadPerm := NewPermissionService(&grantDenyTestRepo{
		effectivePerms: map[string]bool{
			string(constants.PermViewSetup): true,
		},
	}, meta, nil)
	if !withRequiredReadPerm.CheckObjectPermissionWithUser(ctx, "_System_SetupOnly", constants.PermRead, user) {
		t.Fatal("CheckObjectPermissionWithUser(Read setup table) = false with explicit ViewSetup")
	}
}