package accesspolicy

import (
	"context"
	"testing"

	"github.com/Tencent/WeKnora/internal/types"
)

func TestExecutionDependenciesDoNotGrantOrdinaryResourceAccess(t *testing.T) {
	ctx := context.WithValue(context.Background(), types.TenantIDContextKey, uint64(1))
	ctx = WithSnapshot(ctx, &Snapshot{Restricted: true, Permissions: map[string]bool{"agents.read": true, "knowledge.read": true}})
	bound := WithExecutionDependency(ctx, 1, "agents", "bound", "owner")
	if !CanExecuteDependency(bound, 1, "agents", "bound", "owner") {
		t.Fatal("bound dependency denied")
	}
	if Readable(bound, "agents", "bound", false, false) || len(SharedIDs(bound, "agents")) != 0 || Allowed(bound, "agents.write") {
		t.Fatal("execution dependency changed normal visibility or write permission")
	}
	for _, check := range []struct {
		tenant          uint64
		kind, id, owner string
	}{
		{2, "agents", "bound", "owner"}, {1, "agents", "other", "owner"},
		{1, "agents", "bound", "other"}, {1, "knowledge", "bound", "owner"},
	} {
		if CanExecuteDependency(bound, check.tenant, check.kind, check.id, check.owner) {
			t.Fatalf("unbound dependency allowed: %+v", check)
		}
	}
	if CanExecuteDependency(ctx, 1, "agents", "bound", "owner") {
		t.Fatal("execution scope leaked into original request")
	}
	denied := WithSnapshot(bound, &Snapshot{Restricted: true, Permissions: map[string]bool{}})
	if CanExecuteDependency(denied, 1, "agents", "bound", "owner") {
		t.Fatal("dependency bypassed module permission")
	}
	hidden := WithSnapshot(bound, &Snapshot{Hidden: map[string]bool{"agents:bound": true}})
	if CanExecuteDependency(hidden, 1, "agents", "bound", "owner") {
		t.Fatal("hidden dependency allowed")
	}
}