package domain

import (
	"errors"
	"testing"
	"time"
)

func testCredential(binding WorkloadBinding, now time.Time) WorkloadCredential {
	return WorkloadCredential{
		Issuer: binding.Issuer, Audience: binding.Audience, IssuedAt: now.Add(-time.Minute), ExpiresAt: now.Add(time.Minute),
		Namespace: binding.Namespace, ServiceAcct: binding.ServiceAcct, PodUID: binding.PodUID,
		GameServerUID: binding.GameServerUID, AllocationID: binding.AllocationID, MatchID: binding.MatchID,
		ServerID: binding.ServerID, Signature: []byte("attestation"),
	}
}

func TestWorkloadCredentialValidatesOneAllocationIdentity(t *testing.T) {
	now := time.Unix(1000, 0).UTC()
	binding := testBinding()
	policy, err := NewWorkloadCredentialPolicy(binding, func(credential WorkloadCredential) bool {
		return string(credential.Signature) == "attestation"
	})
	if err != nil {
		t.Fatal(err)
	}
	got, err := policy.Validate(testCredential(binding, now), now)
	if err != nil || got != binding {
		t.Fatalf("valid credential = %+v, err=%v", got, err)
	}
}

func TestWorkloadCredentialRejectsEveryBindingAndTimeMutation(t *testing.T) {
	now := time.Unix(1000, 0).UTC()
	binding := testBinding()
	policy, _ := NewWorkloadCredentialPolicy(binding, func(credential WorkloadCredential) bool { return true })
	mutate := []func(*WorkloadCredential){
		func(c *WorkloadCredential) { c.Issuer = "other" },
		func(c *WorkloadCredential) { c.Audience = "other" },
		func(c *WorkloadCredential) { c.Namespace = "other" },
		func(c *WorkloadCredential) { c.ServiceAcct = "other" },
		func(c *WorkloadCredential) { c.PodUID = "other" },
		func(c *WorkloadCredential) { c.GameServerUID = "other" },
		func(c *WorkloadCredential) { c.AllocationID = "other" },
		func(c *WorkloadCredential) { c.MatchID = "other" },
		func(c *WorkloadCredential) { c.ServerID = "other" },
		func(c *WorkloadCredential) { c.ExpiresAt = now },
		func(c *WorkloadCredential) { c.IssuedAt = now.Add(time.Second) },
	}
	for i, change := range mutate {
		credential := testCredential(binding, now)
		change(&credential)
		if _, err := policy.Validate(credential, now); !errors.Is(err, ErrWorkloadCredential) {
			t.Fatalf("mutation %d accepted: %v", i, err)
		}
	}
	badSignature, _ := NewWorkloadCredentialPolicy(binding, func(WorkloadCredential) bool { return false })
	if _, err := badSignature.Validate(testCredential(binding, now), now); !errors.Is(err, ErrWorkloadCredential) {
		t.Fatalf("unverified signature accepted: %v", err)
	}
}

func TestWorkloadCredentialRejectsMissingClaimsAndBoundaryExpiry(t *testing.T) {
	now := time.Unix(1000, 0).UTC()
	binding := testBinding()
	policy, _ := NewWorkloadCredentialPolicy(binding, func(WorkloadCredential) bool { return true })
	credential := testCredential(binding, now)
	credential.Signature = nil
	if _, err := policy.Validate(credential, now); !errors.Is(err, ErrWorkloadCredential) {
		t.Fatalf("missing signature accepted: %v", err)
	}
	credential = testCredential(binding, now)
	if _, err := policy.Validate(credential, credential.ExpiresAt); !errors.Is(err, ErrWorkloadCredential) {
		t.Fatalf("expiry boundary accepted: %v", err)
	}
	credential = testCredential(binding, now)
	if _, err := policy.Validate(credential, credential.IssuedAt.Add(-time.Nanosecond)); !errors.Is(err, ErrWorkloadCredential) {
		t.Fatalf("not-before boundary accepted: %v", err)
	}
}