package db

import (
	"context"
	"errors"
	"testing"

	"sourcecraft.dev/bigbes/sr-ht-dolt/core"
)

func TestEffectiveAccessAndACL(t *testing.T) {
	s, db, cleanup := newTestStore(t)
	defer cleanup()
	ctx := context.Background()

	owner := insertUser(t, db, 1, "alice", core.UserTypeUser)
	grantee := insertUser(t, db, 2, "bob", core.UserTypeUser)
	repo := mkRepo(t, s, ctx, owner, "alice", "widgets", core.VisibilityPrivate)

	// No grant yet: nil, nil.
	mode, err := s.EffectiveAccess(ctx, grantee, repo.ID)
	if err != nil {
		t.Fatalf("effective access: %v", err)
	}
	if mode != nil {
		t.Fatalf("expected nil access, got %v", *mode)
	}

	// Grant RO, then verify.
	if err := s.UpsertACL(ctx, repo.ID, grantee, core.AccessRO); err != nil {
		t.Fatalf("upsert RO: %v", err)
	}
	mode, err = s.EffectiveAccess(ctx, grantee, repo.ID)
	if err != nil {
		t.Fatalf("effective access after grant: %v", err)
	}
	if mode == nil || *mode != core.AccessRO {
		t.Fatalf("expected RO, got %v", mode)
	}

	// Upsert to RW updates in place.
	if err := s.UpsertACL(ctx, repo.ID, grantee, core.AccessRW); err != nil {
		t.Fatalf("upsert RW: %v", err)
	}
	mode, err = s.EffectiveAccess(ctx, grantee, repo.ID)
	if err != nil {
		t.Fatalf("effective access after update: %v", err)
	}
	if mode == nil || *mode != core.AccessRW {
		t.Fatalf("expected RW, got %v", mode)
	}

	// ListACL resolves the username.
	entries, err := s.ListACL(ctx, repo.ID)
	if err != nil {
		t.Fatalf("list acl: %v", err)
	}
	if len(entries) != 1 || entries[0].Username != "bob" || entries[0].Mode != core.AccessRW {
		t.Fatalf("unexpected acl entries: %+v", entries)
	}

	// DeleteACL revokes; effective access returns to nil.
	if err := s.DeleteACL(ctx, repo.ID, grantee); err != nil {
		t.Fatalf("delete acl: %v", err)
	}
	mode, err = s.EffectiveAccess(ctx, grantee, repo.ID)
	if err != nil {
		t.Fatalf("effective access after delete: %v", err)
	}
	if mode != nil {
		t.Fatalf("expected nil after delete, got %v", *mode)
	}

	// Deleting again is ErrNotFound.
	if err := s.DeleteACL(ctx, repo.ID, grantee); !errors.Is(err, ErrNotFound) {
		t.Fatalf("expected ErrNotFound, got %v", err)
	}
}