package store

import "testing"

func TestSeesAllOwned(t *testing.T) {
	if !SeesAllOwned("apikey", false) {
		t.Fatal("api keys must see all rows")
	}
	if !SeesAllOwned("jwt", true) {
		t.Fatal("admin jwt must see all rows")
	}
	if SeesAllOwned("jwt", false) {
		t.Fatal("non-admin jwt must not see all rows")
	}
}

func TestCanAccessOwned(t *testing.T) {
	if !CanAccessOwned("apikey", false, "", "someone") {
		t.Fatal("api key must access any owner")
	}
	if !CanAccessOwned("jwt", true, "admin", "user-1") {
		t.Fatal("admin jwt must access any owner")
	}
	if !CanAccessOwned("jwt", false, "user-1", "user-1") {
		t.Fatal("owner must access their resource")
	}
	if CanAccessOwned("jwt", false, "user-1", "user-2") {
		t.Fatal("non-owner must not access foreign resource")
	}
	if CanAccessOwned("jwt", false, "user-1", "") {
		t.Fatal("non-admin jwt must not see legacy rows without owner")
	}
}

type ownRow struct {
	id    string
	owner string
}

func TestFilterOwned(t *testing.T) {
	rows := []ownRow{
		{"a", "user-1"},
		{"b", "user-2"},
		{"c", ""},
	}
	get := func(r ownRow) string { return r.owner }

	got := FilterOwned(rows, get, "apikey", false, "")
	if len(got) != 3 {
		t.Fatalf("apikey filter: got=%d want 3", len(got))
	}

	got = FilterOwned(rows, get, "jwt", true, "any")
	if len(got) != 3 {
		t.Fatalf("admin jwt filter: got=%d want 3", len(got))
	}

	got = FilterOwned(rows, get, "jwt", false, "user-1")
	if len(got) != 1 || got[0].id != "a" {
		t.Fatalf("user-1 filter: got=%+v want [a]", got)
	}

	got = FilterOwned(rows, get, "jwt", false, "user-3")
	if len(got) != 0 {
		t.Fatalf("unknown user filter: got=%+v want []", got)
	}
}