package persistence

import (
	"context"
	"testing"

	"github.com/nexuscrm/kernel/pkg/ports"
)

func TestAuthorizationGrantOperationsFailClosedWithoutClientLockAndPessimisticTransaction(t *testing.T) {
	repo := NewOAuthRepository(nil)
	_, err := repo.EnsureAuthorizationGrant(context.Background(), ports.AuthorizationGrantRequest{
		SubjectID: "subject-1", ClientID: "client-1", PolicyVersion: 1,
	})
	if err == nil {
		t.Fatal("EnsureAuthorizationGrant without lock/transaction succeeded")
	}
	if _, err := repo.RevokeAuthorizationGrantsForClient(context.Background(), "client-1", "test"); err == nil {
		t.Fatal("RevokeAuthorizationGrantsForClient without lock/transaction succeeded")
	}
	if _, err := repo.ConsumeUnboundOAuthCodesForSubject(context.Background(), "subject-1", "client-1"); err == nil {
		t.Fatal("ConsumeUnboundOAuthCodesForSubject without lock/transaction succeeded")
	}
}