package services

import (
	"lokistack/models"
	"strings"
	"testing"
)

func TestAuthorizedLogQuery(t *testing.T) {
	src := &models.LogSource{Access: []models.LogSourceAccess{{UserID: 7, Labels: map[string]string{"namespace": "prod", "pod": "loki-0"}}}}
	if _, err := AuthorizedLogQuery(src, 8, false, `{app="api"}`); err == nil {
		t.Fatal("ungranted user queried source")
	}
	q, err := AuthorizedLogQuery(src, 7, false, `{app="api"} |= "error"`)
	if err != nil {
		t.Fatal(err)
	}
	for _, part := range []string{`app="api"`, `namespace="prod"`, `pod="loki-0"`, `|= "error"`} {
		if !strings.Contains(q, part) {
			t.Fatalf("missing %q in %q", part, q)
		}
	}
	if _, err := AuthorizedLogQuery(src, 7, false, `sum(count_over_time({app="api"}[1m]))`); err == nil {
		t.Fatal("metric query bypassed stream restriction")
	}
	if _, err := AuthorizedLogQuery(src, 7, false, `{app="api"} or {app="other"}`); err == nil {
		t.Fatal("second selector bypassed stream restriction")
	}
}

func TestPolicyGroupAccess(t *testing.T) {
	groups := []models.LogPolicyGroup{{SourceID: 2, Labels: map[string]string{"namespace": "log", "app": "api"}, UserIDs: []uint{7, 8}}}
	if got := policyGroupAccess(groups, 2, 8); got == nil || got.Labels["app"] != "api" {
		t.Fatal("group member should inherit exact label scope")
	}
	if got := policyGroupAccess(groups, 3, 8); got != nil {
		t.Fatal("group must not grant access to another source")
	}
	if got := policyGroupAccess(groups, 2, 9); got != nil {
		t.Fatal("nonmember gained access")
	}
}

func TestContextLogSelectorIgnoresDetectedLevel(t *testing.T) {
	selector, err := ContextLogSelector(map[string]string{
		"cluster": "demo-prod", "namespace": "monitor", "app": "consul",
		"pod": "consul-0", "container": "consul", "detected_level": "info",
		"filename": "/var/log/pods/consul/1.log",
	})
	if err != nil {
		t.Fatal(err)
	}
	if selector != `{cluster="demo-prod",namespace="monitor",app="consul",pod="consul-0",container="consul",filename="/var/log/pods/consul/1.log"}` {
		t.Fatalf("unexpected context selector: %s", selector)
	}
}