use super::{args, parse_operator_command, OperatorCommand};

#[test]
fn parses_policy_explain_and_simulate_arguments() {
    assert_eq!(
        parse_operator_command(&args(&[
            "bucketwarden",
            "policy",
            "explain",
            "--principal",
            "alice",
            "--action",
            "s3:GetObject",
            "--resource",
            "archive/public/a.txt"
        ]))
        .unwrap(),
        OperatorCommand::PolicyExplain(crate::operator_tooling::PolicyToolArgs {
            principal: "alice".to_string(),
            action: "s3:GetObject".to_string(),
            resource: "archive/public/a.txt".to_string(),
            dry_run: false,
        })
    );
    assert_eq!(
        parse_operator_command(&args(&[
            "bucketwarden",
            "policy",
            "simulate",
            "--principal",
            "alice",
            "--action",
            "s3:GetObject",
            "--resource",
            "archive/private/a.txt",
            "--dry-run"
        ]))
        .unwrap(),
        OperatorCommand::PolicySimulate(crate::operator_tooling::PolicyToolArgs {
            principal: "alice".to_string(),
            action: "s3:GetObject".to_string(),
            resource: "archive/private/a.txt".to_string(),
            dry_run: true,
        })
    );
}

#[test]
fn parses_auth_role_and_key_lifecycle_arguments() {
    assert_eq!(
        parse_operator_command(&args(&[
            "bucketwarden",
            "auth",
            "role",
            "assign",
            "--principal",
            "alice",
            "--role",
            "security-officer",
            "--scope",
            "*"
        ]))
        .unwrap(),
        OperatorCommand::AuthRoleAssign {
            principal: "alice".to_string(),
            role: bucketwarden_auth::OperatorRole::SecurityOfficer,
            scope: "*".to_string()
        }
    );
    assert_eq!(
        parse_operator_command(&args(&[
            "bucketwarden",
            "auth",
            "key",
            "rotate",
            "--principal",
            "alice",
            "--old",
            "AKIAOLD",
            "--new",
            "AKIANEW",
            "--secret",
            "new-secret"
        ]))
        .unwrap(),
        OperatorCommand::AuthKeyRotate {
            principal: "alice".to_string(),
            old_access_key_id: "AKIAOLD".to_string(),
            new_access_key_id: "AKIANEW".to_string(),
            secret_access_key: "new-secret".to_string()
        }
    );
    assert_eq!(
        parse_operator_command(&args(&[
            "bucketwarden",
            "auth",
            "key",
            "revoke",
            "--principal",
            "alice",
            "--key",
            "AKIAREVOKE"
        ]))
        .unwrap(),
        OperatorCommand::AuthKeyRevoke {
            principal: "alice".to_string(),
            access_key_id: "AKIAREVOKE".to_string()
        }
    );
    assert_eq!(
        parse_operator_command(&args(&[
            "bucketwarden",
            "auth",
            "key",
            "report-leaked",
            "--principal",
            "alice",
            "--key",
            "AKIALEAKED"
        ]))
        .unwrap(),
        OperatorCommand::AuthKeyReportLeaked {
            principal: "alice".to_string(),
            access_key_id: "AKIALEAKED".to_string()
        }
    );
}

#[test]
fn rejects_unknown_or_incomplete_policy_and_auth_flags() {
    let error = parse_operator_command(&args(&[
        "bucketwarden",
        "policy",
        "explain",
        "--principal",
        "alice",
        "--action",
        "s3:GetObject",
        "--resource",
        "archive/a.txt",
        "--dry-run",
    ]))
    .unwrap_err();
    assert!(error.contains("unknown policy explain flag `--dry-run`"));

    let error = parse_operator_command(&args(&[
        "bucketwarden",
        "policy",
        "simulate",
        "--principal",
        "alice",
        "--action",
        "s3:GetObject",
        "--resource",
        "--dry-run",
    ]))
    .unwrap_err();
    assert!(error.contains("missing value for `--resource`"));

    let error = parse_operator_command(&args(&[
        "bucketwarden",
        "auth",
        "role",
        "assign",
        "--principal",
        "alice",
        "--role",
        "security-officer",
        "--scope",
        "*",
        "--extra",
        "value",
    ]))
    .unwrap_err();
    assert!(error.contains("unknown auth role assign flag `--extra`"));

    let error = parse_operator_command(&args(&[
        "bucketwarden",
        "auth",
        "key",
        "rotate",
        "--principal",
        "alice",
        "--old",
        "AKIAOLD",
        "--new",
        "AKIANEW",
        "--secret",
    ]))
    .unwrap_err();
    assert!(error.contains("missing value for `--secret`"));
}
