package rolepolicy

import (
	"context"
	"testing"

	"github.com/gogf/gf/v2/frame/g"
	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/consts"
	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/library/contexts"
	"git.5iot.com/iotlcm-public/iotlcm-admin-svr/internal/model"
)

func TestUserRoleAssignmentCannotBypassDelegation(t *testing.T) {
	for _, test := range []struct {
		name                string
		requested, existing []int64
		super, denied       bool
	}{
		{name: "可分配的普通角色", requested: []int64{124}},
		{name: "不能通过绑定特殊角色扩权", requested: []int64{123}, denied: true},
		{name: "修改资料允许保留平台已有授权", requested: []int64{123}, existing: []int64{123}},
		{name: "平台可以单独绑定特殊角色", requested: []int64{123}, super: true},
		{name: "本地账号不能授予超级管理员角色", requested: []int64{1}, denied: true},
		{name: "不接受其他机构角色", requested: []int64{120}, denied: true},
		{name: "可以移除已有角色", requested: []int64{}, existing: []int64{123}},
	} {
		t.Run(test.name, func(t *testing.T) {
			setupAssignableTestDB(t)
			actor := &model.Identity{BaseClaims: model.BaseClaims{ID: 162, TenantId: "000000", DeptId: 199}}
			if test.super {
				actor.Roles = []model.Role{{RoleId: consts.SuperAdminRoleId}}
			}
			ctx := contexts.Set(context.Background(), &model.Context{User: actor})
			for _, statement := range []string{
				"INSERT INTO sys_role VALUES(123,'000000',199,199,'0','4',NULL),(124,'000000',199,199,'0','4',NULL)",
				"INSERT INTO sys_role_menu VALUES('000000',123,200,'0'),('000000',124,100,'0')",
			} {
				if _, err := g.DB().Exec(ctx, statement); err != nil {
					t.Fatal(err)
				}
			}
			err := ValidateUserRoleAssignment(ctx, "000000", 199, test.requested, test.existing)
			if (err != nil) != test.denied {
				t.Fatalf("denied=%v, error=%v", test.denied, err)
			}
		})
	}
}