package callerauth

import (
	"context"
	"errors"
	"fmt"
	"strings"
	"testing"
)

type fakeReviewer struct {
	identity Identity
	err      error
}

func (f fakeReviewer) Review(context.Context, string) (Identity, error) {
	return f.identity, f.err
}

func TestAuthenticatorEnforcesAudienceAndSystemBinding(t *testing.T) {
	authenticator, err := New(ModeEnforce, fakeReviewer{identity: Identity{
		Username:  "system:serviceaccount:tenant-engine:tenant-engine",
		Audiences: []string{"flex-auth"},
	}}, "flex-auth", map[string]string{
		"tenant-engine": "system:serviceaccount:tenant-engine:tenant-engine",
	}, nil)
	if err != nil {
		t.Fatal(err)
	}
	if err := authenticator.Authorize(context.Background(), "Bearer caller-token", []string{"tenant-engine"}); err != nil {
		t.Fatalf("Authorize: %v", err)
	}
	if err := authenticator.Authorize(context.Background(), "Bearer caller-token", []string{"user-engine"}); !errors.Is(err, ErrForbidden) {
		t.Fatalf("system mismatch error = %v; want forbidden", err)
	}

	wrongAudience, _ := New(ModeEnforce, fakeReviewer{identity: Identity{
		Username:  "system:serviceaccount:tenant-engine:tenant-engine",
		Audiences: []string{"kubernetes"},
	}}, "flex-auth", map[string]string{"tenant-engine": "system:serviceaccount:tenant-engine:tenant-engine"}, nil)
	if err := wrongAudience.Authorize(context.Background(), "Bearer caller-token", []string{"tenant-engine"}); !errors.Is(err, ErrUnauthenticated) {
		t.Fatalf("audience error = %v; want unauthenticated", err)
	}
}

func TestAuthenticatorRejectsMissingTokenAndReviewerFailure(t *testing.T) {
	bindings := map[string]string{"tenant-engine": "principal"}
	authenticator, _ := New(ModeEnforce, fakeReviewer{identity: Identity{Username: "principal", Audiences: []string{"flex-auth"}}}, "flex-auth", bindings, nil)
	if err := authenticator.Authorize(context.Background(), "", []string{"tenant-engine"}); !errors.Is(err, ErrUnauthenticated) {
		t.Fatalf("missing token error = %v; want unauthenticated", err)
	}

	unavailable, _ := New(ModeEnforce, fakeReviewer{err: errors.New("apiserver down")}, "flex-auth", bindings, nil)
	if err := unavailable.Authorize(context.Background(), "Bearer token", []string{"tenant-engine"}); !errors.Is(err, ErrUnavailable) {
		t.Fatalf("reviewer error = %v; want unavailable", err)
	}

	rejected, _ := New(ModeEnforce, fakeReviewer{err: fmt.Errorf("%w: invalid bearer token", ErrUnauthenticated)}, "flex-auth", bindings, nil)
	if err := rejected.Authorize(context.Background(), "Bearer malformed", []string{"tenant-engine"}); !errors.Is(err, ErrUnauthenticated) {
		t.Fatalf("rejected token error = %v; want unauthenticated", err)
	}
}

func TestAuthenticatorWarnModePermitsButRecordsFailure(t *testing.T) {
	var warning string
	authenticator, err := New(ModeWarn, fakeReviewer{}, "flex-auth", map[string]string{"tenant-engine": "principal"}, func(format string, _ ...any) {
		warning = format
	})
	if err != nil {
		t.Fatal(err)
	}
	if err := authenticator.Authorize(context.Background(), "", []string{"tenant-engine"}); err != nil {
		t.Fatalf("warn mode returned error: %v", err)
	}
	if !strings.Contains(warning, "warning") {
		t.Fatalf("warning = %q", warning)
	}
}