package app

import (
	"context"
	"strings"
	"testing"

	"github.com/stretchr/testify/require"

	"github.com/tidbcloud/AgentTeam/internal/coredb"
)

func TestResolveAppRuntimeWorkspaceByBearerTokenIsReadOnlyAndFailClosed(t *testing.T) {
	t.Parallel()
	queryCount := 0
	db := &stubRuntimeDB{queryRows: func(_ context.Context, query string, args ...any) coredb.Row {
		queryCount++
		require.Contains(t, query, "service_runtime_credentials")
		require.Contains(t, query, "service_event_delivery_attempts")
		require.Contains(t, query, "COUNT(DISTINCT workspace_id)")
		require.Len(t, args, 10)
		return stubScanRow{values: []any{"wsp_app", 1}}
	}}
	store := New(db, Options{})

	workspaceID, resolved, err := store.ResolveAppRuntimeWorkspaceByBearerToken(context.Background(), " app-token ")
	require.NoError(t, err)
	require.True(t, resolved)
	require.Equal(t, "wsp_app", workspaceID)
	require.Equal(t, 1, queryCount)

	db.queryRows = func(_ context.Context, _ string, _ ...any) coredb.Row {
		return stubScanRow{values: []any{"wsp_a", 2}}
	}
	workspaceID, resolved, err = store.ResolveAppRuntimeWorkspaceByBearerToken(context.Background(), "collision-token")
	require.NoError(t, err)
	require.False(t, resolved)
	require.Empty(t, workspaceID)

	workspaceID, resolved, err = store.ResolveAppRuntimeWorkspaceByBearerToken(context.Background(), strings.Repeat(" ", 2))
	require.NoError(t, err)
	require.False(t, resolved)
	require.Empty(t, workspaceID)
}