package server

import (
	"testing"
	"time"

	"github.com/mem9-ai/drive9/pkg/tenant"
)

func TestTiDBCloudRBACCacheStoresOnlyCredentialIdentity(t *testing.T) {
	cache := newTiDBCloudRBACCache(time.Hour)
	cred := tenant.CredentialProvisionRequest{PublicKey: "public-1", PrivateKey: "private-1"}
	want := tenant.TiDBCloudAPIKeyIdentity{OrganizationID: "org-1", Role: tenant.TiDBCloudRoleOrgOwner}

	if got, ok := cache.getIdentity(cred); ok {
		t.Fatalf("initial identity cache hit = %+v", got)
	}
	cache.rememberIdentity(cred, want)
	got, ok := cache.getIdentity(cred)
	if !ok || got != want {
		t.Fatalf("identity cache = %+v, ok=%v, want %+v", got, ok, want)
	}
}

func TestNewWithConfigUsesTiDBCloudIAMCacheTTL(t *testing.T) {
	s := NewWithConfig(Config{TiDBCloudIAMCacheTTL: 15 * time.Minute})
	t.Cleanup(s.Close)

	if got := s.tidbCloudRBACCache.ttl; got != 15*time.Minute {
		t.Fatalf("IAM cache TTL = %v, want 15m", got)
	}
}

func TestNewWithConfigUsesDefaultTiDBCloudIAMCacheTTL(t *testing.T) {
	s := NewWithConfig(Config{})
	t.Cleanup(s.Close)

	if got := s.tidbCloudRBACCache.ttl; got != 30*time.Minute {
		t.Fatalf("default IAM cache TTL = %v, want 30m", got)
	}
}