package acl

import (
	"path/filepath"
	"testing"

	"git.neuromancer.ovh/bastien-mrq/gitfed/internal/store"
)

func newTestStore(t *testing.T) *store.Store {
	t.Helper()
	s, err := store.Open(filepath.Join(t.TempDir(), "gitfed.db"))
	if err != nil {
		t.Fatalf("open store: %v", err)
	}
	t.Cleanup(func() { s.Close() })
	return s
}

func TestCheckPublicRepoGrantsReadOnly(t *testing.T) {
	s := newTestStore(t)
	if err := s.CreateRepo(store.Repo{Name: "alice/demo", Owner: "alice@local", Path: "/tmp/x", Public: true}); err != nil {
		t.Fatalf("create repo: %v", err)
	}

	role, ok, err := Check(s, "alice/demo", "stranger@elsewhere", store.RoleRead)
	if err != nil {
		t.Fatalf("check read: %v", err)
	}
	if !ok || role != store.RoleRead {
		t.Fatalf("public repo read: got role=%v ok=%v, want RoleRead/true", role, ok)
	}

	_, ok, err = Check(s, "alice/demo", "stranger@elsewhere", store.RoleWrite)
	if err != nil {
		t.Fatalf("check write: %v", err)
	}
	if ok {
		t.Fatal("public repo must not grant write to a non-collaborator")
	}
}

func TestCheckPrivateRepoDeniesNonCollaborator(t *testing.T) {
	s := newTestStore(t)
	if err := s.CreateRepo(store.Repo{Name: "alice/demo", Owner: "alice@local", Path: "/tmp/x", Public: false}); err != nil {
		t.Fatalf("create repo: %v", err)
	}

	_, ok, err := Check(s, "alice/demo", "stranger@elsewhere", store.RoleRead)
	if err != nil {
		t.Fatalf("check read: %v", err)
	}
	if ok {
		t.Fatal("private repo must deny read to a non-collaborator stranger")
	}
}

func TestCheckExplicitCollaboratorOverridesPublicDefault(t *testing.T) {
	s := newTestStore(t)
	if err := s.CreateRepo(store.Repo{Name: "alice/demo", Owner: "alice@local", Path: "/tmp/x", Public: true}); err != nil {
		t.Fatalf("create repo: %v", err)
	}
	if err := Grant(s, "alice/demo", "bob@elsewhere", store.RoleWrite); err != nil {
		t.Fatalf("grant: %v", err)
	}

	role, ok, err := Check(s, "alice/demo", "bob@elsewhere", store.RoleWrite)
	if err != nil {
		t.Fatalf("check write: %v", err)
	}
	if !ok || role != store.RoleWrite {
		t.Fatalf("explicit collaborator: got role=%v ok=%v, want RoleWrite/true", role, ok)
	}
}