package broker

import (
	"bytes"
	"encoding/json"
	"strings"
	"testing"
)

const passwd = `behavision-backend:$7$101$c2FsdA==$ZGlnZXN0
health:$7$101$aGVhbHRo$aGFzaA==
acme.store1:$7$101$c2l0ZQ==$c2l0ZWhhc2g=
`

func TestPasswdBecomesTheStoreWithHashesIntact(t *testing.T) {
	st, err := FromPasswd(strings.NewReader(passwd), "behavision-backend", "health")
	if err != nil {
		t.Fatal(err)
	}
	if len(st.Clients) != 3 {
		t.Fatalf("clients: %d", len(st.Clients))
	}
	site := st.Clients[2]
	if site.Password != "c2l0ZWhhc2g=" || site.Salt != "c2l0ZQ==" || site.Iterations != 101 {
		t.Fatalf("hash not carried over intact: %+v", site)
	}
	if site.Roles[0].Rolename != "site.acme.store1" {
		t.Fatalf("site role: %+v", site.Roles)
	}
	var siteRole *Role
	for i := range st.Roles {
		if st.Roles[i].Rolename == "site.acme.store1" {
			siteRole = &st.Roles[i]
		}
	}
	if siteRole == nil {
		t.Fatal("no role for the site")
	}
	topics := map[string]bool{}
	for _, a := range siteRole.ACLs {
		topics[a.ACLType+" "+a.Topic] = true
	}
	for _, want := range []string{
		"publishClientSend bv/acme.store1/visit",
		"publishClientSend bv/acme.store1/heartbeat",
		"publishClientSend bv/acme.store1/status",
		"subscribePattern bv/acme.store1/cmd/#",
	} {
		if !topics[want] {
			t.Errorf("missing %q in %v", want, topics)
		}
	}
	if st.Clients[0].Roles[0].Rolename != "admin" {
		t.Fatalf("backend is not an admin: %+v", st.Clients[0].Roles)
	}
	if st.DefaultACLAccess["publishClientSend"] || st.DefaultACLAccess["subscribe"] {
		t.Fatal("default access must be deny")
	}
	var buf bytes.Buffer
	if err := st.Encode(&buf); err != nil {
		t.Fatal(err)
	}
	if !json.Valid(buf.Bytes()) {
		t.Fatal("encoded store is not valid JSON")
	}
}

func TestANonPBKDF2LineIsRefusedByName(t *testing.T) {
	_, err := FromPasswd(strings.NewReader("old:$6$abc$def\n"), "b", "h")
	if err == nil || !strings.Contains(err.Error(), "old") {
		t.Fatalf("expected a named refusal, got %v", err)
	}
}