use super::{
    request::{configured, request},
    *,
};
use dever_runtime::auth::{Error, Identity};

#[test]
fn signed_tenant_reference_needs_provider_identity_before_becoming_storage_id() {
    let service = configured(Some("https://unit.test"), "user.account.verify").unwrap();
    let login = request(
        "POST",
        &[("Host", "unit.test"), ("Origin", "https://unit.test")],
    );
    let (mut context, _) = service.prepare("admin", &login, true, 100).unwrap();
    let token = context
        .issue("user", "session-id", Some("external-tenant"), 100)
        .unwrap();
    assert_eq!(
        settings().providers["session"]
            .verify_token(&token, "admin", 100)
            .unwrap()
            .tenant
            .as_deref(),
        Some("external-tenant")
    );
    context
        .issue_cookie("user", "session-id", Some("external-tenant"), 100)
        .unwrap();
    let mut response = dever_runtime::api::response("{}");
    context.publish(&mut response);
    let value = response.headers().get("set-cookie").unwrap().as_bytes();
    let cookie = std::str::from_utf8(value)
        .unwrap()
        .split(';')
        .next()
        .unwrap();
    let incoming = request("GET", &[("Host", "unit.test"), ("Cookie", cookie)]);
    let (mut verified, claims) = service.prepare("admin", &incoming, false, 100).unwrap();
    assert_eq!(claims.unwrap().tenant.as_deref(), Some("external-tenant"));
    assert_eq!(verified.verified_tenant(), None);
    assert_eq!(verified.tenant_id(None).unwrap_err(), Error::Unauthorized);
    for id in [0, -1] {
        assert_eq!(
            verified
                .establish(Identity {
                    id: "verified-user".into(),
                    user_id: Some(7),
                    tenant_id: Some(id)
                })
                .unwrap_err(),
            Error::Unauthorized
        );
        assert_eq!(verified.verified_tenant(), None);
    }
    verified
        .establish(Identity {
            id: "verified-user".into(),
            user_id: Some(7),
            tenant_id: Some(43),
        })
        .unwrap();
    assert_eq!(verified.verified_tenant(), Some(43));
    assert_eq!(verified.tenant_id(Some(17)).unwrap(), Some(43));
    assert_eq!(verified.tenant_id(Some(13)).unwrap_err(), Error::Internal);
}

#[test]
#[cfg(feature = "job")]
fn restored_job_reverifies_tenant_and_persists_the_internal_id_separately() {
    let service = configured(Some("https://unit.test"), "user.account.verify").unwrap();
    let claims = Claims {
        subject: "user".into(),
        session: "session-id".into(),
        tenant: Some("external-tenant".into()),
        site: "admin".into(),
    };
    assert!(service.trusted("other", &claims).is_err());
    let mut context = service.trusted("session", &claims).unwrap();
    assert_eq!(context.verified_tenant(), None);
    assert!(
        context
            .job_execution("news.article.admin.create".into())
            .is_err()
    );
    context
        .establish(Identity {
            id: "verified-user".into(),
            user_id: Some(7),
            tenant_id: Some(43),
        })
        .unwrap();
    let execution = context
        .job_execution("news.article.admin.create".into())
        .unwrap();
    assert!(
        matches!(execution, dever_runtime::job::Execution::User { tenant: Some(reference), tenant_id: Some(43), .. } if reference == "external-tenant")
    );
}