package access

import "testing"

func TestCanSee(t *testing.T) {
	cases := []struct {
		name       string
		user       string
		owner      string
		scope      string
		itemGroups []string
		userGroups []string
		want       bool
	}{
		{"global visible to anyone", "bob", "alice", ScopeGlobal, nil, nil, true},
		{"empty scope = global", "bob", "alice", "", nil, nil, true},
		{"unknown scope = global", "bob", "alice", "weird", nil, nil, true},
		{"private hidden from others", "bob", "alice", ScopePrivate, nil, nil, false},
		{"private visible to owner", "alice", "alice", ScopePrivate, nil, nil, true},
		{"private with empty owner hidden", "bob", "", ScopePrivate, nil, nil, false},
		{"group visible to member", "bob", "alice", ScopeGroup, []string{"ops"}, []string{"ops"}, true},
		{"group hidden from non-member", "bob", "alice", ScopeGroup, []string{"ops"}, []string{"eng"}, false},
		{"group visible to owner even if not a member", "alice", "alice", ScopeGroup, []string{"ops"}, nil, true},
		{"group with multiple item groups", "bob", "alice", ScopeGroup, []string{"ops", "eng"}, []string{"eng"}, true},
		{"case-insensitive scope token", "bob", "alice", "PRIVATE", nil, nil, false},
	}
	for _, c := range cases {
		t.Run(c.name, func(t *testing.T) {
			if got := CanSee(c.user, c.owner, c.scope, c.itemGroups, c.userGroups); got != c.want {
				t.Errorf("CanSee(%q,%q,%q,%v,%v) = %v, want %v",
					c.user, c.owner, c.scope, c.itemGroups, c.userGroups, got, c.want)
			}
		})
	}
}

func TestPolicyCanSeeResolvesGroups(t *testing.T) {
	p := New("", []GroupSpec{{Name: "ops", Members: map[string]Role{"bob": RoleOperator}}})
	// bob is a member of ops; a group-scoped item shared with ops is visible.
	if !p.CanSee("bob", "alice", ScopeGroup, []string{"ops"}) {
		t.Errorf("expected bob to see an ops-scoped item")
	}
	// carol is in no group; the same item is hidden.
	if p.CanSee("carol", "alice", ScopeGroup, []string{"ops"}) {
		t.Errorf("expected carol not to see an ops-scoped item")
	}
}