package middleware

import "testing"

func TestScopeAllowedForAgent(t *testing.T) {
	tests := []struct {
		name  string
		perms []string
		want  bool
	}{
		{"single caasm view", []string{"caasm:view_assets"}, true},
		{"single vuln view", []string{"vuln:view_findings"}, true},
		{"both allowed", []string{"caasm:view_assets", "vuln:view_findings"}, true},
		{"write scope edit_details allowed", []string{"vuln:edit_details"}, true},
		{"write scope request_retest allowed", []string{"vuln:request_retest"}, true},
		{"write scope close_findings allowed", []string{"vuln:close_findings"}, true},
		{"write scope submit_findings allowed", []string{"vuln:submit_findings"}, true},
		{"view and write scopes combined", []string{"vuln:view_findings", "vuln:edit_details", "vuln:request_retest", "vuln:close_findings", "vuln:submit_findings"}, true},
		{"denylist view_sensitive_details overrides view_ prefix", []string{"vuln:view_sensitive_details"}, false},
		{"denylist edit_sensitive_details", []string{"vuln:edit_sensitive_details"}, false},
		{"denylist manage_findings", []string{"vuln:manage_findings"}, false},
		{"denylist authorize_viewers", []string{"vuln:authorize_viewers"}, false},
		{"denylist assign_owner", []string{"vuln:assign_owner"}, false},
		{"unlisted write permission denied", []string{"caasm:manage_assets"}, false},
		{"unrelated scope denied", []string{"auth:manage_users"}, false},
		{"one bad rejects all", []string{"caasm:view_assets", "vuln:manage_findings"}, false},
		{"allowed write plus denylist rejects all", []string{"vuln:edit_details", "vuln:assign_owner"}, false},
		{"empty set denied", []string{}, false},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			if got := scopeAllowedForAgent(tt.perms); got != tt.want {
				t.Errorf("scopeAllowedForAgent(%v) = %v, want %v", tt.perms, got, tt.want)
			}
		})
	}
}