package oidc

import (
	"reflect"
	"testing"

	"git.ryuvia.com/niklas/terdut-server/internal/config"
)

func testCfg() config.OIDC {
	return config.OIDC{
		AllowedGroups: []string{"terdut-users"},
		AdminGroup:    "terdut-admins",
		GroupMappings: []config.GroupMapping{
			{Group: "sre", Team: "SRE", Role: "member"},
			{Group: "sre-leads", Team: "SRE", Role: "owner"},
			{Group: "platform", Team: "Platform", Role: "member"},
		},
	}
}

func TestComputeGrants(t *testing.T) {
	tests := []struct {
		name   string
		groups []string
		want   Grants
	}{
		{
			name:   "not in an allowed group is refused",
			groups: []string{"sre", "terdut-admins"},
			want:   Grants{Admitted: false, Teams: map[string]string{}},
		},
		{
			name:   "allowed but no grants",
			groups: []string{"terdut-users"},
			want:   Grants{Admitted: true, Teams: map[string]string{}},
		},
		{
			name:   "admin group grants admin",
			groups: []string{"terdut-users", "terdut-admins"},
			want:   Grants{Admitted: true, Admin: true, Teams: map[string]string{}},
		},
		{
			name:   "team roles from several groups",
			groups: []string{"terdut-users", "sre", "platform"},
			want:   Grants{Admitted: true, Teams: map[string]string{"SRE": "member", "Platform": "member"}},
		},
		{
			name:   "highest role wins whatever the order",
			groups: []string{"sre-leads", "terdut-users", "sre"},
			want:   Grants{Admitted: true, Teams: map[string]string{"SRE": "owner"}},
		},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got := ComputeGrants(testCfg(), tt.groups)
			if !reflect.DeepEqual(got, tt.want) {
				t.Errorf("got %+v, want %+v", got, tt.want)
			}
		})
	}
}

func TestComputeGrants_NoAllowedGroupsAdmitsEveryone(t *testing.T) {
	cfg := testCfg()
	cfg.AllowedGroups = nil
	if g := ComputeGrants(cfg, nil); !g.Admitted {
		t.Error("with no allowed groups configured, everybody the provider authenticates is admitted")
	}
}

func TestStringList(t *testing.T) {
	if got := stringList([]any{"a", "", 3, "b"}); !reflect.DeepEqual(got, []string{"a", "b"}) {
		t.Errorf("list: %v", got)
	}
	if got := stringList("solo"); !reflect.DeepEqual(got, []string{"solo"}) {
		t.Errorf("single string: %v", got)
	}
	if got := stringList(nil); got != nil {
		t.Errorf("nil: %v", got)
	}
}