package persistence

import (
	"database/sql/driver"
	"strings"
	"testing"

	"github.com/pingcap-inc/nexuscrm-contract/pkg/runtime/permissionstatev1"
)

func TestEffectivePermissionSnapshotSQLClosesCurrentSemanticFamilies(t *testing.T) {
	for _, fragment := range []string{
		"subject_user.ProfileId = ?",
		"SELECT COUNT(*)\n\t\t\tFROM _System_PermissionStateVersion",
		"permission_definition.IsActive = 1",
		"direct_assignment.IsDeleted = 0",
		"permission_group.IsActive = 1",
		"permission_group.IsDeleted = 0",
		"muted.PermissionApiName = grants.PermissionApiName",
		"profile_grant.ProfileId = ?",
		"custom_permission.IsActive = 1",
		"custom_permission.IsDeleted = 0",
		"LEFT JOIN effective_permissions ON 1 = 1",
	} {
		if !strings.Contains(loadCurrentEffectivePermissionSnapshotSQL, fragment) {
			t.Fatalf("aggregate SQL is missing %q", fragment)
		}
	}
}

func TestEffectivePermissionSnapshotSQLCollapsesDuplicateGrantPaths(t *testing.T) {
	if strings.Contains(loadCurrentEffectivePermissionSnapshotSQL, "UNION ALL") {
		t.Fatal("aggregate SQL preserves duplicate grant paths instead of returning an effective set")
	}
	if got := strings.Count(loadCurrentEffectivePermissionSnapshotSQL, "\n\tUNION\n"); got != 2 {
		t.Fatalf("aggregate SQL has %d set unions, want 2", got)
	}
}

func permissionStateSnapshotSubject(t *testing.T) permissionstatev1.Subject {
	t.Helper()
	subject, err := permissionstatev1.NewSubject("user-1", "profile-1")
	if err != nil {
		t.Fatal(err)
	}
	return subject
}

func permissionStateSnapshotArgs(subject permissionstatev1.Subject) []driver.Value {
	return []driver.Value{
		subject.UserID(),
		subject.ProfileID(),
		subject.ProfileID(),
		subject.UserID(),
		subject.UserID(),
		subject.ProfileID(),
		subject.UserID(),
		subject.UserID(),
	}
}