package main

import (
	"keycape/internal/config"
	"testing"
	"time"
)

func TestServiceRegistrationAudienceAndScopeIsolation(t *testing.T) {
	cfg, err := config.Load("../../../config/service-clients.example.yaml")
	if err != nil {
		t.Fatal(err)
	}
	for _, c := range cfg.Clients {
		t.Setenv(c.SecretRef[4:], "test-only-secret")
	}
	registry, err := buildClientRegistry(cfg.Clients)
	if err != nil {
		t.Fatal(err)
	}
	for _, id := range []string{"secrets-engine-approval", "approval-engine-operator"} {
		c := registry[id]
		if c == nil || c.Audience != "approval-engine" || c.TokenLifetime != 15*time.Minute {
			t.Fatalf("invalid registration for %s", id)
		}
		for _, scope := range c.AllowedScopes {
			if id == "approval-engine-operator" && scope == "approval:consume" {
				t.Fatal("operator may not consume")
			}
			if id == "secrets-engine-approval" && scope != "approval:read" && scope != "approval:consume" {
				t.Fatal("excess PEP scope")
			}
		}
	}
	if registry["secrets-engine-openbao"].Audience != "" {
		t.Fatal("OpenBao audience default changed")
	}
}