package adminapi

import (
	"context"
	"slices"
	"testing"

	"gitea.mynodes.xyz/ilker/llmgw/internal/guard"
)

type memGuard struct{ att []guard.Attachment }

func (m *memGuard) GuardAttachments(context.Context) ([]guard.Attachment, error) { return m.att, nil }
func (m *memGuard) AttachGuard(_ context.Context, a guard.Attachment, _ string) error {
	if !slices.Contains(m.att, a) {
		m.att = append(m.att, a)
	}
	return nil
}
func (m *memGuard) DetachGuard(_ context.Context, a guard.Attachment) (bool, error) {
	n := len(m.att)
	m.att = slices.DeleteFunc(m.att, func(x guard.Attachment) bool { return x == a })
	return len(m.att) < n, nil
}

func TestGuardPoliciesAreAttachedByTarget(t *testing.T) {
	a, _ := setup(t, testModels())
	if code := call(t, a, "GET", "/api/v1/guard", "", nil); code != 501 {
		t.Errorf("without policies: %d", code)
	}
	st := &memGuard{}
	invalidated := 0
	a.SetGuard(&GuardAdmin{
		Library: guard.Config{Default: []string{"base"}, Policies: map[string]guard.Policy{"base": {}, "finance": {}}},
		Store:   st, Invalidate: func() { invalidated++ },
	})
	if code := call(t, a, "POST", "/api/v1/guard/attachments", `{"target":"key:k1","policy":"finance"}`, nil); code != 200 {
		t.Fatalf("attach: %d", code)
	}
	if invalidated != 1 || len(st.att) != 1 || st.att[0] != (guard.Attachment{Scope: "key", ScopeID: "k1", Policy: "finance"}) {
		t.Errorf("stored %v, invalidated %d", st.att, invalidated)
	}
	for _, bad := range []string{`{"target":"key:k1","policy":"nope"}`, `{"target":"galaxy:x","policy":"finance"}`, `{"target":"key:","policy":"finance"}`} {
		if code := call(t, a, "POST", "/api/v1/guard/attachments", bad, nil); code != 400 {
			t.Errorf("%s: %d", bad, code)
		}
	}
	var v GuardView
	if code := call(t, a, "GET", "/api/v1/guard", "", &v); code != 200 || len(v.Attachments) != 1 ||
		!slices.Equal(v.Policies, []string{"base", "finance"}) || !slices.Equal(v.Default, []string{"base"}) {
		t.Errorf("%d %+v", code, v)
	}
	if code := call(t, a, "DELETE", "/api/v1/guard/attachments", `{"target":"key:k1","policy":"finance"}`, nil); code != 200 || len(st.att) != 0 {
		t.Errorf("detach: %d %v", code, st.att)
	}
	if code := call(t, a, "DELETE", "/api/v1/guard/attachments", `{"target":"key:k1","policy":"finance"}`, nil); code != 404 {
		t.Errorf("detach again: %d", code)
	}
}