package operator

import (
	"context"
	"testing"
	"time"

	"github.com/go-json-experiment/json"
)

func inspectChallenge(f *directoryFixture) InspectChallenge {
	p := f.engine.verifier.pins
	return InspectChallenge{1, "operator-inspect", p.Role, p.Origin, p.Installation, p.Registry, p.Device, token(85), f.now.Unix(), f.now.Unix() + 300}
}
func TestInspectDoesNotInitializeOrReserveAuthority(t *testing.T) {
	f := newDirectoryFixture(t)
	challenge := inspectChallenge(f)
	raw, err := SignInspect(f.key, challenge)
	if err != nil {
		t.Fatal(err)
	}
	read := func(wantGen *string, wantID int64) {
		t.Helper()
		out, err := f.directory.Inspect(context.Background(), raw)
		if err != nil {
			t.Fatal(err)
		}
		var got Inspection
		if err = json.Unmarshal(out, &got); err != nil {
			t.Fatal(err)
		}
		if got.Challenge != challenge.Challenge || got.TeamID != wantID || got.Observed != f.now.Unix() || (got.Generation == nil) != (wantGen == nil) || (wantGen != nil && *got.Generation != *wantGen) {
			t.Fatal("wrong inspection")
		}
	}
	read(nil, 1)
	read(nil, 1)
	if countRows(t, f.db, "directory_operator_state") != 0 || countRows(t, f.db, "directory_operator_results") != 0 || countRows(t, f.db, "teams") != 0 {
		t.Fatal("inspection minted authority")
	}
	f.initialize(t)
	gen := token(10)
	read(&gen, 1)
	if _, err = f.seed(t, 1, "alpha"); err != nil {
		t.Fatal(err)
	}
	read(&gen, 2)
	if countRows(t, f.db, "directory_operator_results") != 2 {
		t.Fatal("inspection advanced accepted stream")
	}
	if _, err = f.directory.Execute(context.Background(), raw); err != ErrRefused {
		t.Fatal("inspection became mutation", err)
	}
	*f.now = f.now.Add(300 * time.Second)
	if _, err = f.directory.Inspect(context.Background(), raw); err != ErrRefused {
		t.Fatal("expired inspection replayed", err)
	}
}
func TestInspectWrongBindingsAndMutableInputRefuse(t *testing.T) {
	f := newDirectoryFixture(t)
	for _, change := range []func(*InspectChallenge){func(c *InspectChallenge) { c.Origin = "https://other.oficina.works" }, func(c *InspectChallenge) { c.Device = token(86) }, func(c *InspectChallenge) { c.Registry = token(86) }, func(c *InspectChallenge) { c.Installation = token(86) }, func(c *InspectChallenge) { c.Role = "credential" }, func(c *InspectChallenge) { c.Issued++; c.Expires++ }} {
		c := inspectChallenge(f)
		change(&c)
		raw, err := SignInspect(f.key, c)
		if err != nil {
			t.Fatal(err)
		}
		if _, err = f.directory.Inspect(context.Background(), raw); err != ErrRefused {
			t.Fatal("wrong inspection accepted", err)
		}
	}
	raw, err := SignInspect(f.key, inspectChallenge(f))
	if err != nil {
		t.Fatal(err)
	}
	if _, err = f.directory.Inspect(context.Background(), append(raw, ' ')); err != ErrRefused {
		t.Fatal("noncanonical challenge", err)
	}
}