package policy_test

import (
	"context"
	"encoding/json"
	"github.com/netkingdom/access-engine/internal/policy"
	"github.com/netkingdom/access-engine/pkg/api"
	"github.com/open-policy-agent/opa/rego"
	"os/exec"
	"path/filepath"
	"testing"
)

func TestServiceTaskExecutionSourcePredicateAndHardRefusal(t *testing.T) {
	p, e := policy.LoadAndValidateFile(context.Background(), filepath.Join("..", "..", "examples", "secrets-engine-service-task-execution", "policy_package.md"))
	if e != nil || !p.Valid {
		t.Fatalf("package %v %+v", e, p.Validation)
	}
	out, e := exec.Command("/home/worsch/secrets-engine/.venv/bin/python", "../../tools/service_task_execution_fixture.py").Output()
	if e != nil {
		t.Fatal("actual Secrets descriptor generator", e)
	}
	var f struct {
		Request api.CheckRequest `json:"request"`
	}
	if json.Unmarshal(out, &f) != nil {
		t.Fatal("fixture")
	}
	candidate := func(r api.CheckRequest) bool {
		b, _ := json.Marshal(r)
		var input map[string]any
		json.Unmarshal(b, &input)
		result, e := rego.New(rego.Query("data.flexauth.secrets_engine.service_task_execution.candidate_matches"), rego.Module("candidate.rego", p.RegoModule), rego.Input(input)).Eval(context.Background())
		if e != nil {
			t.Fatal(e)
		}
		return len(result) > 0
	}
	if !candidate(f.Request) {
		t.Fatal("supported synthetic service contract failed predicate")
	}
	d, e := p.Evaluate(context.Background(), f.Request)
	if e != nil || d.Effect != api.DecisionEffectDeny || d.Reason != "service_execution_integration_unadmitted" {
		t.Fatal("unintegrated source package opened")
	}
	cases := map[string]func(*api.CheckRequest){"human": func(r *api.CheckRequest) { r.Subject.Type = "human" }, "foreigntenant": func(r *api.CheckRequest) { r.Tenant = "tenant:coulomb" }, "apply": func(r *api.CheckRequest) { r.Action = "apply" }, "servicecaller": func(r *api.CheckRequest) {
		r.Context["service_actor_binding"].(map[string]any)["transport_principal"] = "another"
	}, "missing human control": func(r *api.CheckRequest) {
		r.Context["approval"].(map[string]any)["binding"].(map[string]any)["human_control"] = false
	}, "consumed": func(r *api.CheckRequest) { r.Context["approval"].(map[string]any)["consumed"] = true }, "PDP digest": func(r *api.CheckRequest) {
		r.Context["approval"].(map[string]any)["binding"].(map[string]any)["pdp_digest"] = ""
	}, "expired observation": func(r *api.CheckRequest) {
		r.Context["approval"].(map[string]any)["freshness"].(map[string]any)["not_after"] = "2000-01-01T00:00:00Z"
	}, "wrong operation": func(r *api.CheckRequest) {
		r.Context["execution_contract"].(map[string]any)["operation"] = "generic-apply"
	}}
	for name, mutate := range cases {
		t.Run(name, func(t *testing.T) {
			var f struct {
				Request api.CheckRequest `json:"request"`
			}
			json.Unmarshal(out, &f)
			mutate(&f.Request)
			if candidate(f.Request) {
				t.Fatal("unsupported source contract matched")
			}
		})
	}
}