package hostfence

import (
	"strings"
	"testing"
)

func TestPlan9FenceNeverFallsBackToSharedCredentials(t *testing.T) {
	w, store := terminationFixture(t)
	w.Fences = nil
	if _, err := w.binding(t.Context(), "dead"); err == nil {
		t.Fatal("missing dedicated writer accepted")
	}
	keys, err := store.List(t.Context(), "control/box-fences/")
	if err != nil {
		t.Fatal(err)
	}
	if len(keys) != 0 {
		t.Fatalf("shared store used: %v", keys)
	}
}

func TestPlan9FenceCredentialScope(t *testing.T) {
	for _, raw := range []string{
		`{"role":"arn:aws:iam::123456789012:role/writer","region":"eu-west-1","bucket":"dep","access_key":"a","secret_key":"s"}`,
		`{"role":"arn:aws:iam::123456789012:role/*","region":"eu-west-1","bucket":"dep","access_key":"a","secret_key":"s"}`,
		`{"role":"arn:aws:iam::123456789012:role/writer","region":"eu-west-1","bucket":"other","access_key":"a","secret_key":"s"}`,
	} {
		_, err := decodeFenceCredentials(strings.NewReader(raw), "dep")
		want := strings.Contains(raw, `role/writer`) && !strings.Contains(raw, `"other"`)
		if (err == nil) != want {
			t.Fatalf("scope accepted=%v, want %v", err == nil, want)
		}
	}
}