use bucketwarden_auth::{AuthError, AuthStore, OperatorAction, OperatorRole};

#[test]
fn operator_roles_are_assigned_and_enforced_by_scope() {
    let mut store = AuthStore::new();
    store.create_local_user("root");
    store.create_local_user("auditor");
    store.create_local_user("bucket-admin");

    store
        .assign_operator_role("root", OperatorRole::ClusterAdmin, "*")
        .expect("cluster admin");
    store
        .assign_operator_role("auditor", OperatorRole::Auditor, "tenant-a/")
        .expect("auditor");
    store
        .assign_operator_role(
            "bucket-admin",
            OperatorRole::BucketAdmin,
            "tenant-a/archive",
        )
        .expect("bucket admin");

    assert!(store
        .operator_action_allowed("root", OperatorAction::ManageCredentials, "tenant-b")
        .expect("root"));
    assert!(store
        .operator_action_allowed("auditor", OperatorAction::ReadAudit, "tenant-a/archive")
        .expect("auditor"));
    assert!(!store
        .operator_action_allowed("auditor", OperatorAction::ManageCredentials, "tenant-a")
        .expect("auditor"));
    assert!(store
        .operator_action_allowed(
            "bucket-admin",
            OperatorAction::AdministerBucket,
            "tenant-a/archive"
        )
        .expect("bucket admin"));
    assert!(!store
        .operator_action_allowed(
            "bucket-admin",
            OperatorAction::AdministerBucket,
            "tenant-b/archive"
        )
        .expect("bucket admin"));
}

#[test]
fn role_assignment_requires_known_enabled_principal() {
    let mut store = AuthStore::new();

    assert_eq!(
        store.assign_operator_role("missing", OperatorRole::ClusterAdmin, "*"),
        Err(AuthError::UnknownPrincipal("missing".to_string()))
    );
}
