package auth

import (
	"context"

	. "github.com/onsi/ginkgo/v2"
	. "github.com/onsi/gomega"
)

var _ = Describe("[IPValidator]", func() {
	Describe("ValidateIP", func() {
		It("matches exact IPv4 address", func() {
			validator := NewIPValidator()

			allow, reason := validator.ValidateIP(context.Background(), "10.0.0.1", []string{"10.0.0.1/32"})
			Expect(allow).To(BeTrue())
			Expect(reason).To(BeEmpty())
		})

		It("matches IPv4 by CIDR", func() {
			validator := NewIPValidator()

			allow, reason := validator.ValidateIP(context.Background(), "10.0.1.8", []string{"10.0.0.0/16"})
			Expect(allow).To(BeTrue())
			Expect(reason).To(BeEmpty())
		})

		It("matches IPv6 by CIDR", func() {
			validator := NewIPValidator()

			allow, reason := validator.ValidateIP(context.Background(), "2001:db8::1", []string{"2001:db8::/64"})
			Expect(allow).To(BeTrue())
			Expect(reason).To(BeEmpty())
		})

		It("returns false when no rule matches", func() {
			validator := NewIPValidator()

			allow, reason := validator.ValidateIP(context.Background(), "10.0.0.1", []string{"192.168.0.0/16"})
			Expect(allow).To(BeFalse())
			Expect(reason).To(Equal("ip 10.0.0.1 not allowed"))
		})

		It("keeps success behavior on repeated validation", func() {
			validator := NewIPValidator()

			allow, reason := validator.ValidateIP(context.Background(), "10.0.9.9", []string{"10.0.0.0/16"})
			Expect(allow).To(BeTrue())
			Expect(reason).To(BeEmpty())

			allow, reason = validator.ValidateIP(context.Background(), "10.0.9.9", []string{"10.0.0.0/16"})
			Expect(allow).To(BeTrue())
			Expect(reason).To(BeEmpty())
		})
	})
})