package domain

import (
	"bytes"
	"testing"
	"time"

	"git.cin.su/m/Assistant/contracts/identity"
)

func TestServiceSessionIsDistinctFromHumanCreatorSession(t *testing.T) {
	secret := bytes.Repeat([]byte{7}, 32)
	principal := identity.ServicePrincipal{ActorID: "acceptance-actor", PrincipalID: "acceptance-principal", Kind: identity.PrincipalKindService, Purpose: "AUTHENTICATE_ACCEPTANCE_HARNESS", SyntheticScope: "synthetic-acceptance-scope", Active: true, Revision: 1}
	token, issued, err := IssueServiceSession(secret, principal, time.Unix(100, 0), time.Minute)
	if err != nil {
		t.Fatal(err)
	}
	if issued.PrincipalKind != identity.PrincipalKindService {
		t.Fatalf("kind=%q", issued.PrincipalKind)
	}
	validated, err := ValidateCreatorSession(secret, token, time.Unix(101, 0))
	if err != nil {
		t.Fatal(err)
	}
	if validated.PrincipalKind != identity.PrincipalKindService || validated.PrincipalID != principal.PrincipalID {
		t.Fatalf("validated=%#v", validated)
	}
}

func TestServiceSessionRejectsInactivePrincipal(t *testing.T) {
	secret := bytes.Repeat([]byte{7}, 32)
	_, _, err := IssueServiceSession(secret, identity.ServicePrincipal{ActorID: "a", PrincipalID: "p", Kind: identity.PrincipalKindService, Purpose: "test"}, time.Unix(100, 0), time.Minute)
	if err == nil {
		t.Fatal("inactive service principal was accepted")
	}
}