package oauth2_test

import (
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
	"github.com/stretchr/testify/suite"
	"github.com/tidbcloud/auth-server/commons/crypto"
	"github.com/tidbcloud/auth-server/internal/entity"
)

type RbacSDKSuite struct {
	Oauth2Suite
}

func TestRbacSDKSuite(t *testing.T) {
	suite.Run(t, new(RbacSDKSuite))
}

func (s *RbacSDKSuite) TestGetAccessTokenIdentity() {
	tokenResp := s.createAccessTokenByDeviceGrant()

	// success case
	akObj, err := s.oauth2Service.GetAccessTokenIdentity(s.ctx, tokenResp.AccessToken)
	assert.Nil(s.T(), err)
	assert.NotNil(s.T(), akObj)

	encrptedAccessToken := crypto.NewPbdkf2Sha512Encryptor().Encrypt(
		tokenResp.AccessToken, "", 20000,
	)
	var akObj2 entity.Oauth2AccessToken
	dbErr := entity.NewOauth2AccessTokenQuerySet(s.db).AccessTokenEq(encrptedAccessToken).One(&akObj2)
	require.Nil(s.T(), dbErr)
	assert.Equal(s.T(), akObj2.ID, akObj.ID)

	// failed case
	akObj3, err := s.oauth2Service.GetAccessTokenIdentity(s.ctx, "invalid_token")
	assert.Nil(s.T(), akObj3)
	assert.NotNil(s.T(), err)
}