package workbench

import (
	"errors"
	"testing"

	"github.com/Tencent/WeKnora/internal/accesspolicy"
	"github.com/Tencent/WeKnora/internal/types"
	"gorm.io/gorm"
)

func TestSharedCanvasCanBeUsedWithoutOwnershipOrMutation(t *testing.T) {
	for _, publication := range []bool{false, true} {
		s := sqliteWorkbench(t)
		flow := seedResource(t, s, 1, "owner", "flows")
		policy := &accesspolicy.Snapshot{Publications: map[string]bool{"flows:" + flow.ID: publication}, Grants: map[string]bool{"flows:" + flow.ID: !publication}}
		ctx := accesspolicy.WithSnapshot(workbenchContext(1, "recipient", types.TenantRoleContributor), policy)
		if _, err := s.get(ctx, "flows", flow.ID); err != nil {
			t.Fatalf("shared canvas not readable: %v", err)
		}
		task := &Resource{TenantID: 1, OwnerID: "recipient", Kind: "content-tasks", Data: asJSON(TaskData{FlowID: flow.ID})}
		if err := lockReferences(ctx, s.db, task); err != nil {
			t.Fatalf("shared canvas not usable: %v", err)
		}
		if _, err := lockResource(ctx, s.db, "flows", flow.ID); !errors.Is(err, gorm.ErrRecordNotFound) {
			t.Fatalf("recipient may edit shared canvas: %v", err)
		}
		if _, err := lockResourceForDeletion(ctx, s.db, "flows", flow.ID); !errors.Is(err, gorm.ErrRecordNotFound) {
			t.Fatalf("recipient may delete shared canvas: %v", err)
		}
		policy.Publications["flows:"+flow.ID] = false
		delete(policy.Grants, "flows:"+flow.ID)
		if err := lockReferences(ctx, s.db, task); !errors.Is(err, gorm.ErrRecordNotFound) {
			t.Fatalf("revoked shared canvas remains usable: %v", err)
		}
	}
}