package accesscontrol

import (
	"strings"
	"testing"
)

func TestValidUserRequestPasswordPolicy(t *testing.T) {
	cases := []struct {
		name     string
		password string
		create   bool
		want     bool
	}{
		{"create three digits", "123", true, true},
		{"create three Unicode characters", "三个字", true, true},
		{"update three letters", "abc", false, true},
		{"too few characters", "两字", true, false},
		{"maximum characters", strings.Repeat("x", 32), true, true},
		{"over maximum characters", strings.Repeat("x", 33), true, false},
		{"bcrypt maximum bytes", strings.Repeat("字", 24), true, true},
		{"over bcrypt bytes", strings.Repeat("字", 24) + "x", true, false},
		{"create requires password", "", true, false},
		{"update leaves existing password", "", false, true},
	}
	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			req := userRequest{Username: "alice", Email: "alice@example.com", Role: "contributor", Status: "active", Password: tc.password}
			if got := validUserRequest(req, tc.create); got != tc.want {
				t.Fatalf("validUserRequest = %v, want %v", got, tc.want)
			}
		})
	}
}