package serviceaccount

import (
	"testing"

	"github.com/stretchr/testify/require"

	"github.com/tidbcloud/AgentTeam/internal/core/domain"
	serviceaccountstore "github.com/tidbcloud/AgentTeam/internal/store/serviceaccount"
)

func TestProjectAccountAccessKeepsAuthorityViewerSpecific(t *testing.T) {
	workspaceAccount := serviceaccountstore.Account{
		ManagementKind:           serviceaccountstore.ManagementKindWorkspace,
		CreatedByMemberID:        "mem_creator",
		AudienceState:            serviceaccountstore.AudienceStateReady,
		AudiencePolicyVersion:    2,
		EffectiveAudienceVersion: 2,
	}

	reader := projectAccountAccess(workspaceAccount, string(domain.WorkspaceRoleMember), false, false)
	require.False(t, reader.CanManage)
	require.False(t, reader.CanPublish)
	require.False(t, reader.CanModerate)
	require.False(t, reader.CanManagePlatform)

	workspaceAdmin := projectAccountAccess(workspaceAccount, string(domain.WorkspaceRoleAdmin), false, false)
	require.True(t, workspaceAdmin.CanManage)
	require.True(t, workspaceAdmin.CanPublish)
	require.True(t, workspaceAdmin.CanModerate)

	manager := projectAccountAccess(workspaceAccount, string(domain.WorkspaceRoleMember), true, false)
	require.True(t, manager.CanManage)
	require.True(t, manager.CanPublish)
	require.True(t, manager.CanModerate)

	creatorWithoutManager := projectAccountAccess(workspaceAccount, string(domain.WorkspaceRoleMember), false, false)
	require.False(t, creatorWithoutManager.CanManage)

	reconciling := workspaceAccount
	reconciling.AudienceState = serviceaccountstore.AudienceStateReconciling
	manager = projectAccountAccess(reconciling, string(domain.WorkspaceRoleMember), true, false)
	require.True(t, manager.CanManage)
	require.False(t, manager.CanPublish)
	require.True(t, manager.CanModerate)
	workspaceAdmin = projectAccountAccess(reconciling, string(domain.WorkspaceRoleOwner), false, false)
	require.True(t, workspaceAdmin.CanManage)
	require.False(t, workspaceAdmin.CanPublish)
	require.True(t, workspaceAdmin.CanModerate)

	platformAccount := serviceaccountstore.Account{ManagementKind: serviceaccountstore.ManagementKindPlatform}
	platformReader := projectAccountAccess(platformAccount, string(domain.WorkspaceRoleMember), false, false)
	require.False(t, platformReader.CanModerate)
	require.False(t, platformReader.CanManagePlatform)

	platformOperator := projectAccountAccess(platformAccount, string(domain.WorkspaceRoleMember), false, true)
	require.False(t, platformOperator.CanManage)
	require.False(t, platformOperator.CanPublish)
	require.True(t, platformOperator.CanModerate)
	require.True(t, platformOperator.CanManagePlatform)
}