package auth

import (
	"testing"

	"github.com/golang-jwt/jwt/v5"
)

func TestCheckPermissions(t *testing.T) {
	validator := NewValidator(
		"https://authentik.riotpiao.com/application/o/sqs/",
		"sqs",
		"https://authentik.riotpiao.com/application/o/sqs/jwks/",
	)

	// Test 1: Finds sqs:read
	claims1 := jwt.MapClaims{
		"permissions": []interface{}{"sqs:read", "memory:write"},
	}
	if !validator.CheckPermissions(claims1, "sqs:read", "sqs:write") {
		t.Fatal("expected to find sqs:read permission")
	}

	// Test 2: Finds wildcard
	claims2 := jwt.MapClaims{
		"permissions": []interface{}{"*"},
	}
	if !validator.CheckPermissions(claims2, "sqs:read") {
		t.Fatal("expected to find wildcard permission")
	}

	// Test 3: Rejects when missing
	claims3 := jwt.MapClaims{
		"permissions": []interface{}{"memory:read"},
	}
	if validator.CheckPermissions(claims3, "sqs:read") {
		t.Fatal("expected to reject missing permission")
	}

	// Test 4: Handles missing permissions claim
	claims4 := jwt.MapClaims{}
	if validator.CheckPermissions(claims4, "sqs:read") {
		t.Fatal("expected to reject missing permissions claim")
	}

	t.Log("✅ All permission checks passed")
}

func TestValidateBearerToken(t *testing.T) {
	validator := NewValidator(
		"https://authentik.riotpiao.com/application/o/sqs/",
		"sqs",
		"https://authentik.riotpiao.com/application/o/sqs/jwks/",
	)

	// Test 1: Empty token
	_, err := validator.ValidateBearerToken("")
	if err == nil {
		t.Fatal("expected error for empty token")
	}
	t.Logf("✅ Correctly rejected empty token: %v", err)

	// Test 2: Invalid format
	_, err = validator.ValidateBearerToken("not-a-bearer-token")
	if err == nil {
		t.Fatal("expected error for invalid format")
	}
	t.Logf("✅ Correctly rejected invalid format: %v", err)

	// Test 3: Invalid token payload
	_, err = validator.ValidateBearerToken("Bearer invalid.token.format")
	if err == nil {
		t.Fatal("expected error for invalid token")
	}
	t.Logf("✅ Correctly rejected invalid token: %v", err)
}