package controllers

import (
	"testing"

	"apiserver/models"
	"apiserver/store"
)

// TestGetRequireResourcePermission_ReturnsPermThenError verifies the Go-standard
// (T, error) return order: permission first, error second.
func TestGetRequireResourcePermission_GoConvention(t *testing.T) {
	store.InitStores()
	// unknown user — should return error
	perm, err := GetRequireResourcePermission("nobody", "job:view")
	if err == nil {
		t.Error("expected error for user with no roles")
	}
	if perm.Permission != "" {
		t.Errorf("expected empty permission on error, got %+v", perm)
	}
}

func TestGetRequireResourcePermission_FoundPermission(t *testing.T) {
	store.InitStores()
	store.AddRoleForUser("alice", "myrole")
	store.AddPermissionsForRole("myrole", []store.RolePermission{
		{Action: "job:view", DomainType: "all"},
	})

	perm, err := GetRequireResourcePermission("alice", "job:view")
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}
	if perm.Permission != "job:view" {
		t.Errorf("expected job:view, got %q", perm.Permission)
	}
	if perm.DomainType != "all" {
		t.Errorf("expected all, got %q", perm.DomainType)
	}
}

// TestDomainTypeConstants ensures domain type constants match expected string values.
// This guards against accidental constant value changes.
func TestDomainTypeConstants(t *testing.T) {
	cases := map[string]string{
		"DomainTypeAll":    models.DomainTypeAll,
		"DomainTypeSelf":   models.DomainTypeSelf,
		"DomainTypeSelfUG": models.DomainTypeSelfUG,
		"DomainTypeQueue":  models.DomainTypeQueue,
	}
	expected := map[string]string{
		"DomainTypeAll":    "all",
		"DomainTypeSelf":   "self",
		"DomainTypeSelfUG": "self_ug",
		"DomainTypeQueue":  "queue",
	}
	for name, got := range cases {
		if got != expected[name] {
			t.Errorf("%s = %q, want %q", name, got, expected[name])
		}
	}
}

// TestGetAccessQueues_AllDomain returns all queue names for "all" domain
func TestGetAccessQueues_AllDomain(t *testing.T) {
	store.InitStores()
	store.Queues.Put("q1", models.QueueInfo{QueueName: "q1"})
	store.Queues.Put("q2", models.QueueInfo{QueueName: "q2"})
	store.AddRoleForUser("alice", "r1")
	store.AddPermissionsForRole("r1", []store.RolePermission{
		{Action: "queue:view", DomainType: "all"},
	})
	queues, err := getAccessQueues("alice", "queue:view")
	if err != nil {
		t.Fatal(err)
	}
	if len(queues) != 2 {
		t.Errorf("expected 2 queues, got %d", len(queues))
	}
}

// TestGetAccessQueues_QueueDomain returns only permitted queues
func TestGetAccessQueues_QueueDomain(t *testing.T) {
	store.InitStores()
	store.Queues.Put("normal", models.QueueInfo{QueueName: "normal"})
	store.Queues.Put("priority", models.QueueInfo{QueueName: "priority"})
	store.AddRoleForUser("bob", "r2")
	store.AddPermissionsForRole("r2", []store.RolePermission{
		{Action: "queue:view", DomainType: "queue", DomainValues: []string{"normal"}},
	})
	queues, err := getAccessQueues("bob", "queue:view")
	if err != nil {
		t.Fatal(err)
	}
	if len(queues) != 1 || queues[0] != "normal" {
		t.Errorf("expected [normal], got %v", queues)
	}
}

// TestGetAccessQueues_NoPermission returns error
func TestGetAccessQueues_NoPermission(t *testing.T) {
	store.InitStores()
	_, err := getAccessQueues("nobody", "queue:view")
	if err == nil {
		t.Error("expected error for user with no permission")
	}
}