package hostfence

import "testing"

func TestActivationCredentialsScope(t *testing.T) {
	raw := []byte(`{"role":"arn:aws:iam::123456789012:role/fence","region":"eu-west-1","bucket":"bucket","access_key":"test","secret_key":"test"}`)
	if err := ValidateActivationCredentials(raw, "bucket", "eu-west-1", "arn:aws:iam::123456789012:role/fence"); err != nil {
		t.Fatal(err)
	}
	for _, scope := range [][3]string{{"other", "eu-west-1", "arn:aws:iam::123456789012:role/fence"}, {"bucket", "eu-west-2", "arn:aws:iam::123456789012:role/fence"}, {"bucket", "eu-west-1", "arn:aws:iam::123456789012:role/other"}} {
		if err := ValidateActivationCredentials(raw, scope[0], scope[1], scope[2]); err == nil {
			t.Fatal("scope mismatch accepted")
		}
	}
}

func TestActivationReceiptBindsExactCredentialBytes(t *testing.T) {
	raw := []byte(`{"role":"arn:aws:iam::123456789012:role/fence","region":"eu-west-1","bucket":"bucket","access_key":"test","secret_key":"test"}`)
	receipt := ActivationCredentialReceipt(raw)
	if !VerifyActivationCredentialReceipt(raw, receipt) {
		t.Fatal("receipt rejected")
	}
	if VerifyActivationCredentialReceipt(append(raw, ' '), receipt) || VerifyActivationCredentialReceipt(raw, nil) {
		t.Fatal("uninstalled credentials accepted")
	}
}