package agsbridge

import (
	"encoding/base64"
	"encoding/json"
	"net/http/httptest"
	"strings"
	"testing"

	"github.com/stretchr/testify/require"
)

func TestAuthorizationHeaderUsesSharedMeshXWorkloadIdentity(t *testing.T) {
	request := httptest.NewRequest("GET", "/api/v3/user", nil)
	request.Header.Set(DefaultAuthHeader, AuthorizationHeader())

	parts := strings.Split(strings.TrimPrefix(request.Header.Get(DefaultAuthHeader), "Bearer "), ".")
	require.Len(t, parts, 3)
	payload, err := base64.RawURLEncoding.DecodeString(parts[1])
	require.NoError(t, err)
	var identity struct {
		Subject           string `json:"sub"`
		PreferredUsername string `json:"preferred_username"`
		Name              string `json:"name"`
	}
	require.NoError(t, json.Unmarshal(payload, &identity))
	require.Equal(t, WorkloadSubject, identity.Subject)
	require.Equal(t, WorkloadSubject, identity.PreferredUsername)
	require.Equal(t, WorkloadSubject, identity.Name)
}