package saas

import (
	"context"
	"data-terminal-cloud/internal/audit"
	"data-terminal-cloud/internal/devicefleet"
	"data-terminal-cloud/internal/identity"
	"github.com/jackc/pgx/v5/pgxpool"
	"os"
	"testing"
)

func TestFleetTenantAndHouseholdAccess(t *testing.T) {
	if os.Getenv("TEST_DATABASE_URL") == "" {
		t.Skip("integration database required")
	}
	ctx := context.Background()
	pool, err := pgxpool.New(ctx, os.Getenv("TEST_DATABASE_URL"))
	if err != nil {
		t.Fatal(err)
	}
	defer pool.Close()
	s := NewService(pool, audit.NewRepository(), nil, nil)
	s.Fleet = &devicefleet.Service{Pool: pool}
	owner := identity.Principal{Issuer: testIssuer, Subject: testOwnerSubject}
	if _, err = s.FleetState(ctx, owner, "10000000-0000-0000-0000-000000000511", ""); err != nil {
		t.Fatal(err)
	}
	if _, err = s.FleetState(ctx, owner, "10000000-0000-0000-0000-000000000512", ""); err == nil {
		t.Fatal("unbound device accessible")
	}
	if _, err = s.FleetTenant(ctx, owner, testTenantPublicID, true); err == nil {
		t.Fatal("customer uploaded firmware")
	}
	if _, err = s.FleetState(ctx, owner, "10000000-0000-0000-0000-000000000511", testTenantPublicID); err == nil {
		t.Fatal("customer spoofed operator tenant")
	}
}