use super::packages;

const ERROR: &str = "public type Error { error Invalid\nerror Unauthorized\nerror Forbidden }";
const AUTH: &str = "public id() (value: Text) { value = dever.system.authId() }";

#[test]
fn identity_cannot_escape_to_public_commands_domains_or_tasks() {
    for api in ["public get me = app.me", "cmd me = app.me"] {
        let error = packages(&[
            ("dever.api", ERROR),
            ("dever.auth", AUTH),
            (
                "demo.user.app",
                "me() (value: Text) { value = dever.auth.id() }",
            ),
            ("demo.user.api", api),
        ])
        .unwrap_err();
        assert_eq!(error.code, "C014", "{api}: {error:?}");
    }
    for (package, source, code) in [
        (
            "demo.user.domain",
            "me() (value: Text) { value = dever.auth.id() }",
            "C014",
        ),
        (
            "main",
            "main() (value: Text) { task = run(dever.auth.id())\nvalue = wait(task) }",
            "C013",
        ),
        (
            "main",
            "main() (value: Text) { value = dever.system.authId() }",
            "C006",
        ),
    ] {
        assert_eq!(
            packages(&[
                ("dever.api", ERROR),
                ("dever.auth", AUTH),
                (package, source)
            ])
            .unwrap_err()
            .code,
            code
        );
    }
}

#[test]
fn provider_cannot_reenter_request_identity() {
    let error = packages(&[
        ("dever.api", ERROR),
        ("dever.auth", "public type Claims { subject: Text\nsession: Text\ntenant: Text?\nsite: Text }\npublic id() (value: Text) { value = dever.system.authId() }"),
        ("demo.user.model", "global type User { name: Text }"),
        ("demo.user.app", "type Identity { id: Text\nuser_id: model.id?\ntenant_id: model.id? }\nverify(claims: dever.auth.Claims) (value: Identity) { value = Identity { id = dever.auth.id(), user_id = null, tenant_id = null } }\nhealth() (value: Bool) { value = true }"),
        ("demo.user.api", "public get health = app.health"),
    ]).unwrap_err();
    assert_eq!(error.code, "C014");
}