package cabana

import "testing"

// TestRoleCeiling (D-07) pins grantsCovered: plain codes go through granted,
// a wildcard a role grants is covered only by the same or a broader holder
// wildcard.
func TestRoleCeiling(t *testing.T) {
	set := func(codes ...string) map[string]bool {
		out := map[string]bool{}
		for _, code := range codes {
			out[code] = true
		}
		return out
	}
	for _, tc := range []struct {
		name   string
		holder map[string]bool
		wanted map[string]bool
		want   bool
	}{
		{"exact codes held", set("acme.blog.posts", "acme.blog.tags"), set("acme.blog.posts"), true},
		{"exact code missing", set("acme.blog.posts"), set("acme.blog.posts", "acme.blog.tags"), false},
		{"holder wildcard covers exact codes", set("acme.blog.*"), set("acme.blog.posts", "acme.blog.tags"), true},
		{"broader holder wildcard covers exact codes", set("acme.*"), set("acme.blog.posts"), true},
		{"holder wildcard of another prefix", set("acme.shop.*"), set("acme.blog.posts"), false},
		{"role wildcard covered by the same wildcard", set("acme.blog.*"), set("acme.blog.*"), true},
		{"role wildcard covered by a broader wildcard", set("acme.*"), set("acme.blog.*"), true},
		{"role wildcard not covered by a narrower wildcard", set("acme.blog.posts.*"), set("acme.blog.*"), false},
		{"role wildcard not covered by exact codes", set("acme.blog.posts", "acme.blog.tags"), set("acme.blog.*"), false},
		{"suffix wildcard covered only by itself", set("*.manage"), set("*.manage"), true},
		{"suffix wildcard not covered by exact codes", set("acme.manage", "shop.manage"), set("*.manage"), false},
		{"suffix wildcard not covered by a prefix wildcard", set("acme.*"), set("*.manage"), false},
		{"false role entries are ignored", set(), map[string]bool{"acme.blog.posts": false}, true},
		{"empty role", set("acme.blog.posts"), set(), true},
		{"nil role", nil, nil, true},
		{"nil holder and an empty role", nil, set(), true},
		{"nil holder and a granting role", nil, set("acme.blog.posts"), false},
		{"nil holder and a wildcard role", nil, set("acme.*"), false},
	} {
		t.Run(tc.name, func(t *testing.T) {
			if got := grantsCovered(tc.holder, tc.wanted); got != tc.want {
				t.Fatalf("grantsCovered(%v, %v) = %v, want %v", tc.holder, tc.wanted, got, tc.want)
			}
		})
	}
}