package middleware

import "testing"

func TestScopeSubsetOfUserAndAgentAllowed(t *testing.T) {
	tests := []struct {
		name      string
		reqPerms  []string
		userPerms []string
		want      bool
	}{
		{
			"user has requested view perm",
			[]string{"caasm:view_assets"},
			[]string{"caasm:view_assets"},
			true,
		},
		{
			"user has requested write perm",
			[]string{"vuln:view_findings", "vuln:close_findings"},
			[]string{"vuln:view_findings", "vuln:close_findings"},
			true,
		},
		{
			"cannot grant perm user lacks",
			[]string{"vuln:view_findings"},
			[]string{"caasm:view_assets"},
			false,
		},
		{
			"allowed write scope rejected when user lacks it",
			[]string{"vuln:close_findings"},
			[]string{"vuln:view_findings"},
			false,
		},
		{
			"submit_findings allowed when user has it",
			[]string{"vuln:view_findings", "vuln:submit_findings"},
			[]string{"vuln:view_findings", "vuln:submit_findings"},
			true,
		},
		{
			"submit_findings rejected when user lacks it",
			[]string{"vuln:submit_findings"},
			[]string{"vuln:view_findings"},
			false,
		},
		{
			"unlisted write perm rejected even if user has it",
			[]string{"caasm:manage_assets"},
			[]string{"caasm:manage_assets"},
			false,
		},
		{
			"denylist view perm rejected even if user has it",
			[]string{"vuln:view_sensitive_details"},
			[]string{"vuln:view_sensitive_details"},
			false,
		},
		{
			"denylist write perm rejected even if user has it",
			[]string{"vuln:manage_findings"},
			[]string{"vuln:manage_findings"},
			false,
		},
		{
			"denylist edit_sensitive_details rejected even if user has it",
			[]string{"vuln:edit_sensitive_details"},
			[]string{"vuln:edit_sensitive_details"},
			false,
		},
		{
			"denylist authorize_viewers rejected even if user has it",
			[]string{"vuln:authorize_viewers"},
			[]string{"vuln:authorize_viewers"},
			false,
		},
		{
			"denylist assign_owner rejected even if user has it",
			[]string{"vuln:assign_owner"},
			[]string{"vuln:assign_owner"},
			false,
		},
		{
			"empty request denied",
			[]string{},
			[]string{"caasm:view_assets"},
			false,
		},
		{
			"one over-privilege rejects all",
			[]string{"caasm:view_assets", "vuln:view_findings"},
			[]string{"caasm:view_assets"},
			false,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			if got := ScopeSubsetOfUserAndAgentAllowed(tt.reqPerms, tt.userPerms); got != tt.want {
				t.Errorf("ScopeSubsetOfUserAndAgentAllowed(%v, %v) = %v, want %v", tt.reqPerms, tt.userPerms, got, tt.want)
			}
		})
	}
}