package caps

import (
	"errors"
	"os"
	"testing"
)

func TestPlan14CapabilityMutationAuthorization(t *testing.T) {
	for _, operation := range []string{"converge", "restore", "restart"} {
		t.Run(operation, func(t *testing.T) {
			o, sys, _, users := testOps(t)
			p := keymailPlan(t, Grants{Ports: map[int]bool{25: true}})
			if _, err := Converge(o, p); err != nil {
				t.Fatal(err)
			}
			service, socket := DropInPaths(o.EtcDir, p.Host)
			beforeService, beforeSocket := string(readFile(t, service)), string(readFile(t, socket))
			sys.reset()
			*users = nil
			calls := 0
			o.Authorize = func() error { calls++; return os.ErrPermission }
			var err error
			switch operation {
			case "converge":
				p.Grants = Grants{}
				_, err = Converge(o, p)
			case "restore":
				err = Restore(o, Snapshot{Host: p.Host})
			case "restart":
				err = Restart(o, p)
			}
			if !errors.Is(err, os.ErrPermission) || calls != 1 || len(sys.calls) != 0 || len(*users) != 0 {
				t.Fatal("unauthorized operation", err, calls, sys.calls, *users)
			}
			if string(readFile(t, service)) != beforeService || string(readFile(t, socket)) != beforeSocket {
				t.Fatal("refusal changed files")
			}
		})
	}
}