package packs

import (
	"strings"
	"testing"
)

func TestConnectedAppOwnerlessLegacyAdoptionRejectsAdminApproved(t *testing.T) {
	key := ownerlessPublicConnectedAppOwnershipKey()
	key.PermittedUsers = "AdminApproved"

	if key.OwnerlessLegacyAdoptionEligible() {
		t.Fatal("OwnerlessLegacyAdoptionEligible = true, want false for AdminApproved")
	}
	if got := key.OwnerlessLegacyAdoptionMismatch(ownerlessPublicConnectedAppOwnershipKey()); !strings.Contains(got, "PermittedUsers is not AllUsers") {
		t.Fatalf("OwnerlessLegacyAdoptionMismatch = %q, want PermittedUsers rejection", got)
	}
}

func TestConnectedAppOwnerlessLegacyAdoptionRejectsScopeDrift(t *testing.T) {
	expected := ownerlessPublicConnectedAppOwnershipKey()
	live := ownerlessPublicConnectedAppOwnershipKey()
	live.Scopes = []string{"api"}

	if got := expected.OwnerlessLegacyAdoptionMismatch(live); !strings.Contains(got, "Scopes") {
		t.Fatalf("OwnerlessLegacyAdoptionMismatch = %q, want Scopes rejection", got)
	}
}

func ownerlessPublicConnectedAppOwnershipKey() ConnectedAppOwnershipKey {
	return ConnectedAppOwnershipKey{
		ID:                      "public-client",
		Name:                    "Public Client",
		ConsumerKey:             "public-key",
		CallbackURL:             "http://127.0.0.1:1717/callback",
		RedirectURIs:            []string{"http://127.0.0.1:1717/callback"},
		Scopes:                  []string{"external.records.read"},
		IsActive:                true,
		ClientType:              "public",
		RequirePKCE:             true,
		TokenEndpointAuthMethod: "none",
		AllowedGrantTypes:       []string{"authorization_code"},
		ConsentPolicy:           "trusted",
		ConsentVersion:          1,
		IssueRefreshTokens:      false,
		PermittedUsers:          "AllUsers",
	}
}