use remora_credentials::{
    CredentialCaller, SourceCredential, SourceCredentialKind, SourceCredentialStatus, may_manage,
    require_manage,
};
use remora_domain::OpaqueId;
use time::OffsetDateTime;

fn principal(label: &str) -> OpaqueId {
    OpaqueId::parse(format!("principal-{label}-aaaa")).unwrap()
}

fn credential(owner: OpaqueId) -> SourceCredential {
    SourceCredential {
        id: OpaqueId::parse("credid01-aaaaaaaa").unwrap(),
        owner,
        label: "probe".into(),
        kind: SourceCredentialKind::BearerToken,
        status: SourceCredentialStatus::Active,
        active_version: None,
        created_at: OffsetDateTime::now_utc(),
        updated_at: OffsetDateTime::now_utc(),
    }
}

#[test]
fn owner_and_admin_may_manage_peers_may_not() {
    let owner = principal("owner");
    let peer = principal("peer0");
    let admin = CredentialCaller {
        principal_id: principal("admin"),
        administrator: true,
    };
    let owner_caller = CredentialCaller {
        principal_id: owner.clone(),
        administrator: false,
    };
    let peer_caller = CredentialCaller {
        principal_id: peer,
        administrator: false,
    };

    assert!(may_manage(&owner_caller, &owner));
    assert!(may_manage(&admin, &owner));
    assert!(!may_manage(&peer_caller, &owner));
}

#[test]
fn missing_and_unauthorized_are_indistinguishable() {
    let owner = principal("owner");
    let peer = CredentialCaller {
        principal_id: principal("peer1"),
        administrator: false,
    };
    let record = credential(owner);

    let missing = require_manage(&peer, None);
    let unauthorized = require_manage(&peer, Some(&record));
    assert!(matches!(
        missing,
        Err(remora_credentials::CredentialError::NotFound)
    ));
    assert!(matches!(
        unauthorized,
        Err(remora_credentials::CredentialError::NotFound)
    ));
}

#[test]
fn split_vault_path_parses_fixture_shape() {
    let (mount, prefix) =
        remora_credentials::split_vault_path("secret/remora/lane-0").expect("path");
    assert_eq!(mount, "secret");
    assert_eq!(prefix, "remora/lane-0");
}