package ai

import (
	"bytes"
	"testing"
	"time"

	"git.ipao.vip/rogee/go-sip/contracts"
)

func TestValidateAuthorizationBindsSnapshotAndTenant(t *testing.T) {
	snapshotRaw, err := contracts.Read("examples/agent-version-asr-only.json")
	if err != nil {
		t.Fatal(err)
	}
	snapshot, err := ValidateForMode(snapshotRaw, ModeASROnly)
	if err != nil {
		t.Fatal(err)
	}
	authorizationRaw, err := contracts.Files.ReadFile("local/v0.3/examples/ai-authorization-v0.2.json")
	if err != nil {
		t.Fatal(err)
	}
	if _, err := ValidateAuthorization(authorizationRaw, snapshot, "tenant-1", "tenant-demo-key", time.Date(2026, 9, 18, 0, 0, 30, 0, time.UTC)); err != nil {
		t.Fatal(err)
	}
	if _, err := ValidateAuthorization(authorizationRaw, snapshot, "other", "tenant-demo-key", time.Date(2026, 9, 18, 0, 0, 30, 0, time.UTC)); err == nil {
		t.Fatal("expected tenant mismatch")
	}
	if _, err := ValidateAuthorization(authorizationRaw, snapshot, "tenant-1", "tenant-demo-key", time.Date(2026, 9, 18, 0, 2, 0, 0, time.UTC)); err == nil {
		t.Fatal("expected expired authorization")
	}
	if _, err := ValidateAuthorization(bytes.Replace(authorizationRaw, []byte(`"revoked": false`), []byte(`"revoked": true`), 1), snapshot, "tenant-1", "tenant-demo-key", time.Date(2026, 9, 18, 0, 0, 30, 0, time.UTC)); err == nil {
		t.Fatal("expected revocation rejection")
	}
}

func TestAuthorizationRejectsRemovedEgressPoolField(t *testing.T) {
	snapshotRaw, err := contracts.Read("examples/agent-version-asr-only.json")
	if err != nil {
		t.Fatal(err)
	}
	snapshot, err := ValidateForMode(snapshotRaw, ModeASROnly)
	if err != nil {
		t.Fatal(err)
	}
	old, err := contracts.Files.ReadFile("upstream/v1/examples/ai-authorization.json")
	if err != nil {
		t.Fatal(err)
	}
	if _, err := DecodeBoundAuthorization(old, snapshot, "tenant-1", "tenant-demo-key"); err == nil {
		t.Fatal("legacy egress-pool authorization field unexpectedly accepted")
	}
}