package authorization

import "testing"

func TestAllowsHonorsExplicitPermissionsAndLegacyEmptySet(t *testing.T) {
	t.Parallel()
	tests := []struct {
		name        string
		permissions []string
		required    string
		want        bool
	}{
		{name: "legacy empty set", required: AdminWrite, want: true},
		{name: "matching permission", permissions: []string{AdminRead}, required: AdminRead, want: true},
		{name: "different permission", permissions: []string{AdminRead}, required: AdminWrite, want: false},
		{name: "global permission", permissions: []string{All}, required: DistributionExtract, want: true},
	}
	for _, test := range tests {
		test := test
		t.Run(test.name, func(t *testing.T) {
			t.Parallel()
			if got := Allows(test.permissions, test.required); got != test.want {
				t.Fatalf("Allows(%v, %q) = %t, want %t", test.permissions, test.required, got, test.want)
			}
		})
	}
}

func TestValidateRejectsUnknownDuplicateAndMixedGlobalPermissions(t *testing.T) {
	t.Parallel()
	for _, permissions := range [][]string{
		{"unknown"},
		{AdminRead, AdminRead},
		{All, AdminRead},
		{" " + AdminRead},
	} {
		if err := Validate(permissions); err == nil {
			t.Fatalf("Validate(%v) error = nil", permissions)
		}
	}
	if err := Validate([]string{AdminRead, AdminWrite}); err != nil {
		t.Fatalf("Validate(valid) error = %v", err)
	}
}