use bucketwarden_auth::{AccessKey, AuthError, AuthStore};

#[test]
fn principals_and_keys_are_scoped_to_tenants() {
    let mut store = AuthStore::new();
    store.create_tenant("tenant-a");
    store.create_tenant("tenant-b");
    store
        .create_local_user_in_tenant("alice", "tenant-a")
        .expect("alice");
    store
        .create_service_account_in_tenant("backup", "tenant-b")
        .expect("backup");

    store
        .put_access_key(AccessKey::active("alice", "AKIAALICE", "alice-secret"))
        .expect("alice key");
    store
        .put_access_key(AccessKey::active("backup", "AKIABACKUP", "backup-secret"))
        .expect("backup key");

    let alice = store.resolve_credential("AKIAALICE", 10).expect("alice");
    let backup = store.resolve_credential("AKIABACKUP", 10).expect("backup");

    assert_eq!(alice.tenant_id, "tenant-a");
    assert_eq!(backup.tenant_id, "tenant-b");
    assert_eq!(store.credential_count_for_tenant("tenant-a"), 1);
    assert_eq!(store.credential_count_for_tenant("tenant-b"), 1);
}

#[test]
fn principal_creation_requires_known_enabled_tenant() {
    let mut store = AuthStore::new();

    assert_eq!(
        store.create_local_user_in_tenant("alice", "missing"),
        Err(AuthError::UnknownTenant("missing".to_string()))
    );
}
