package store

import (
	"path/filepath"
	"testing"
)

func TestRevocations(t *testing.T) {
	s, err := Open(filepath.Join(t.TempDir(), "gitfed.db"))
	if err != nil {
		t.Fatal(err)
	}
	defer s.Close()

	const principal = "alice@example.com"
	const fp = "SHA256:abcdef"

	// Nothing revoked initially.
	if r, _ := s.IsPrincipalRevoked(principal); r {
		t.Fatal("principal should not be revoked initially")
	}
	if r, _ := s.IsKeyRevoked(fp); r {
		t.Fatal("key should not be revoked initially")
	}

	// Revoke and confirm.
	if err := s.RevokePrincipal(principal); err != nil {
		t.Fatal(err)
	}
	if err := s.RevokeKey(fp); err != nil {
		t.Fatal(err)
	}
	if r, _ := s.IsPrincipalRevoked(principal); !r {
		t.Fatal("principal should be revoked")
	}
	if r, _ := s.IsKeyRevoked(fp); !r {
		t.Fatal("key should be revoked")
	}

	// The prefixes must not collide: revoking a principal must not revoke a
	// key of the same textual value, and vice versa.
	if r, _ := s.IsKeyRevoked(principal); r {
		t.Fatal("principal revocation leaked into the key namespace")
	}

	// Un-revoke restores access (e.g. user re-created / key re-added).
	if err := s.UnrevokePrincipal(principal); err != nil {
		t.Fatal(err)
	}
	if err := s.UnrevokeKey(fp); err != nil {
		t.Fatal(err)
	}
	if r, _ := s.IsPrincipalRevoked(principal); r {
		t.Fatal("principal should be un-revoked")
	}
	if r, _ := s.IsKeyRevoked(fp); r {
		t.Fatal("key should be un-revoked")
	}
}