package ai

import (
	"testing"
	"time"

	"git.ipao.vip/rogee/go-sip/contracts"
)

func TestValidateAuthorizationBindsSnapshotTenantAndEgress(t *testing.T) {
	snapshotRaw, err := contracts.Read("examples/agent-version-asr-only.json")
	if err != nil {
		t.Fatal(err)
	}
	snapshot, err := ValidateForMode(snapshotRaw, ModeASROnly)
	if err != nil {
		t.Fatal(err)
	}
	authorizationRaw, err := contracts.Read("examples/ai-authorization.json")
	if err != nil {
		t.Fatal(err)
	}
	authorization, err := ValidateAuthorization(authorizationRaw, snapshot, "tenant-1", "tenant-demo-key", "egress-mock", time.Date(2026, 9, 18, 0, 0, 30, 0, time.UTC))
	if err != nil {
		t.Fatal(err)
	}
	if authorization.AuthorizationID == "" || authorization.Mode != ModeASROnly {
		t.Fatalf("unexpected authorization: %+v", authorization)
	}
}

func TestValidateAuthorizationRejectsMismatchAndExpiry(t *testing.T) {
	snapshotRaw, err := contracts.Read("examples/agent-version-asr-only.json")
	if err != nil {
		t.Fatal(err)
	}
	snapshot, err := ValidateForMode(snapshotRaw, ModeASROnly)
	if err != nil {
		t.Fatal(err)
	}
	invalid, err := contracts.Read("examples/invalid-ai-authorization-revoked.json")
	if err != nil {
		t.Fatal(err)
	}
	if _, err := ValidateAuthorization(invalid, snapshot, "tenant-1", "tenant-demo-key", "egress-mock", time.Date(2026, 9, 18, 0, 0, 30, 0, time.UTC)); err == nil {
		t.Fatal("expected revoked authorization rejection")
	}
	valid, err := contracts.Read("examples/ai-authorization.json")
	if err != nil {
		t.Fatal(err)
	}
	if _, err := ValidateAuthorization(valid, snapshot, "tenant-other", "tenant-demo-key", "egress-mock", time.Date(2026, 9, 18, 0, 0, 30, 0, time.UTC)); err == nil {
		t.Fatal("expected tenant binding rejection")
	}
	if _, err := ValidateAuthorization(valid, snapshot, "tenant-1", "tenant-demo-key", "egress-mock", time.Date(2026, 9, 18, 0, 2, 0, 0, time.UTC)); err == nil {
		t.Fatal("expected expired authorization rejection")
	}
}