poimen-memory/tests/it_jwt_auth.rs

use mem_cli::jwt_validator::{JwtValidator, JwtClaims};

#[test]
fn test_extract_bearer_token() {
    let header = "Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9";
    let result = JwtValidator::extract_bearer_token(header);
    assert!(result.is_ok());
    assert_eq!(
        result.unwrap(),
        "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9"
    );
}

#[test]
fn test_extract_bearer_token_missing_bearer() {
    let header = "Basic dXNlcjpwYXNz";
    let result = JwtValidator::extract_bearer_token(header);
    assert!(result.is_err());
}

#[test]
fn test_jwt_validator_creation() {
    let validator = JwtValidator::new(
        "https://authentik.example.com/application/o/memory/".to_string(),
        "memory-service".to_string(),
        3600,
    );
    // Just verify creation doesn't panic
    assert_eq!(validator.issuer, "https://authentik.example.com/application/o/memory/");
}

#[tokio::test]
async fn test_jwt_claims_structure() {
    // Test that JwtClaims can be created and serialized
    let claims = JwtClaims {
        sub: "user123".to_string(),
        iss: "https://authentik.example.com/application/o/memory/".to_string(),
        aud: "memory-service".to_string(),
        exp: 9999999999,
        iat: 1000000000,
        nbf: Some(1000000000),
        permissions: Some(vec!["memory:read".to_string(), "memory:write".to_string()]),
        groups: Some(vec!["homelab-admins".to_string()]),
    };

    assert_eq!(claims.sub, "user123");
    assert!(claims.permissions.is_some());
    assert_eq!(
        claims.permissions.as_ref().unwrap().len(),
        2
    );
}

#[test]
fn test_jwt_permissions_claim() {
    let claims = JwtClaims {
        sub: "user123".to_string(),
        iss: "https://authentik.example.com/application/o/memory/".to_string(),
        aud: "memory-service".to_string(),
        exp: 9999999999,
        iat: 1000000000,
        nbf: None,
        permissions: Some(vec!["memory:read".to_string()]),
        groups: None,
    };

    // Check if permissions exist
    assert!(claims.permissions.is_some());
    let perms = claims.permissions.unwrap();
    assert!(perms.contains(&"memory:read".to_string()));
    assert!(!perms.contains(&"memory:write".to_string()));
}

#[test]
fn test_jwt_wildcard_permission() {
    let claims = JwtClaims {
        sub: "admin".to_string(),
        iss: "https://authentik.example.com/application/o/memory/".to_string(),
        aud: "memory-service".to_string(),
        exp: 9999999999,
        iat: 1000000000,
        nbf: None,
        permissions: Some(vec!["*".to_string()]),
        groups: None,
    };

    // Wildcard should grant all permissions
    let perms = claims.permissions.unwrap();
    assert!(perms.contains(&"*".to_string()));
}

#[test]
fn test_jwt_no_permissions() {
    let claims = JwtClaims {
        sub: "user123".to_string(),
        iss: "https://authentik.example.com/application/o/memory/".to_string(),
        aud: "memory-service".to_string(),
        exp: 9999999999,
        iat: 1000000000,
        nbf: None,
        permissions: None,
        groups: Some(vec!["users".to_string()]),
    };

    // No permissions claim should mean no access
    assert!(claims.permissions.is_none());
}