package auth

import (
	"testing"

	"github.com/stretchr/testify/assert"
)

// === PermissionLevel tests ===

func TestPermissionLevel_IsValid(t *testing.T) {
	assert.True(t, PermissionFull.IsValid())
	assert.True(t, PermissionRead.IsValid())
	assert.True(t, PermissionNone.IsValid())
	assert.False(t, PermissionLevel("invalid").IsValid())
	assert.False(t, PermissionLevel("").IsValid())
}

func TestPermissionLevel_CanWrite(t *testing.T) {
	assert.True(t, PermissionFull.CanWrite())
	assert.False(t, PermissionRead.CanWrite())
	assert.False(t, PermissionNone.CanWrite())
}

func TestPermissionLevel_CanRead(t *testing.T) {
	assert.True(t, PermissionFull.CanRead())
	assert.True(t, PermissionRead.CanRead())
	assert.False(t, PermissionNone.CanRead())
}

// === PermissionMatrix tests ===

func TestAgentDefaultPermissions(t *testing.T) {
	assert.Equal(t, PermissionRead, AgentDefaultPermissions[DimensionConversationManage])
	assert.Equal(t, PermissionNone, AgentDefaultPermissions[DimensionConversationDelete])
	assert.Equal(t, PermissionRead, AgentDefaultPermissions[DimensionContactManage])
	assert.Equal(t, PermissionNone, AgentDefaultPermissions[DimensionReportManage])
	assert.Equal(t, PermissionNone, AgentDefaultPermissions[DimensionKnowledgeBaseManage])
	assert.Equal(t, PermissionNone, AgentDefaultPermissions[DimensionAutomationManage])
}

func TestAdministratorPermissions(t *testing.T) {
	for _, dim := range AllDimensions {
		assert.Equal(t, PermissionFull, AdministratorPermissions[dim], "admin should have full on %s", dim)
	}
}

func TestAllDimensions_ContainsAllSix(t *testing.T) {
	assert.Len(t, AllDimensions, 6)
	expected := []PermissionDimension{
		DimensionConversationManage,
		DimensionConversationDelete,
		DimensionContactManage,
		DimensionReportManage,
		DimensionKnowledgeBaseManage,
		DimensionAutomationManage,
	}
	assert.ElementsMatch(t, expected, AllDimensions)
}

func TestPermissionMatrixMap_ToJSON(t *testing.T) {
	data, err := AgentDefaultPermissions.ToJSON()
	assert.NoError(t, err)
	assert.Contains(t, string(data), "conversation_manage")
	assert.Contains(t, string(data), "read")
}

func TestPermissionMatrixFromJSON_Valid(t *testing.T) {
	data, err := AgentDefaultPermissions.ToJSON()
	assert.NoError(t, err)

	matrix, err := PermissionMatrixFromJSON(data)
	assert.NoError(t, err)
	assert.Equal(t, PermissionRead, matrix[DimensionConversationManage])
}

func TestPermissionMatrixFromJSON_InvalidLevel(t *testing.T) {
	invalidJSON := `{"conversation_manage": "superuser"}`
	matrix, err := PermissionMatrixFromJSON([]byte(invalidJSON))
	assert.Error(t, err)
	assert.Nil(t, matrix)
}

func TestPermissionMatrixFromJSON_Empty(t *testing.T) {
	matrix, err := PermissionMatrixFromJSON([]byte(`{}`))
	assert.NoError(t, err)
	assert.Empty(t, matrix)
}

// === PolicyContext tests ===

func TestNewPolicyContext_Administrator(t *testing.T) {
	pc := NewPolicyContext(1, 1, "administrator", 0, nil)
	assert.True(t, pc.IsAdministrator())
	assert.False(t, pc.IsAgent())
	assert.False(t, pc.IsCustomRole())
	assert.Equal(t, AdministratorPermissions, pc.Permissions)
}

func TestNewPolicyContext_Agent(t *testing.T) {
	pc := NewPolicyContext(2, 1, "agent", 0, nil)
	assert.False(t, pc.IsAdministrator())
	assert.True(t, pc.IsAgent())
	assert.False(t, pc.IsCustomRole())
	assert.Equal(t, AgentDefaultPermissions, pc.Permissions)
}

func TestNewPolicyContext_CustomRole(t *testing.T) {
	customPerms := PermissionMatrixMap{
		DimensionConversationManage: PermissionFull,
		DimensionContactManage:      PermissionRead,
	}
	pc := NewPolicyContext(3, 1, "custom_role", 10, customPerms)
	assert.True(t, pc.IsCustomRole())
	assert.Equal(t, customPerms, pc.Permissions)
}

func TestNewPolicyContext_CustomRole_FallbackToAgent(t *testing.T) {
	pc := NewPolicyContext(3, 1, "custom_role", 10, nil)
	assert.True(t, pc.IsCustomRole())
	assert.Equal(t, AgentDefaultPermissions, pc.Permissions) // nil perms → agent defaults
}

// === Can() tests ===

func TestCan_AdministratorAlwaysTrue(t *testing.T) {
	pc := NewPolicyContext(1, 1, "administrator", 0, nil)
	actions := []string{"manage", "read", "create", "update", "delete", "assign", "resolve"}
	resources := []string{"conversation", "contact", "report", "knowledge_base", "automation"}
	for _, action := range actions {
		for _, resource := range resources {
			assert.True(t, pc.Can(action, resource), "admin Can(%s,%s) should be true", action, resource)
		}
	}
}

func TestCan_AgentConversationManage(t *testing.T) {
	pc := NewPolicyContext(2, 1, "agent", 0, nil)
	assert.True(t, pc.Can("read", "conversation"))   // agent has read on conversation_manage
	assert.False(t, pc.Can("manage", "conversation")) // agent has read, not full
	assert.False(t, pc.Can("create", "conversation"))
	assert.False(t, pc.Can("update", "conversation"))
}

func TestCan_AgentConversationDelete(t *testing.T) {
	pc := NewPolicyContext(2, 1, "agent", 0, nil)
	assert.False(t, pc.Can("delete", "conversation")) // agent has none on conversation_delete
}

func TestCan_AgentContactManage(t *testing.T) {
	pc := NewPolicyContext(2, 1, "agent", 0, nil)
	assert.True(t, pc.Can("read", "contact"))
	assert.False(t, pc.Can("manage", "contact"))
}

func TestCan_AgentNoReportAccess(t *testing.T) {
	pc := NewPolicyContext(2, 1, "agent", 0, nil)
	assert.False(t, pc.Can("read", "report"))
	assert.False(t, pc.Can("manage", "report"))
}

func TestCan_AgentNoKnowledgeBaseAccess(t *testing.T) {
	pc := NewPolicyContext(2, 1, "agent", 0, nil)
	assert.False(t, pc.Can("read", "knowledge_base"))
}

func TestCan_AgentNoAutomationAccess(t *testing.T) {
	pc := NewPolicyContext(2, 1, "agent", 0, nil)
	assert.False(t, pc.Can("read", "automation"))
}

func TestCan_CustomRoleFullConversation(t *testing.T) {
	pc := NewPolicyContext(3, 1, "custom_role", 10, PermissionMatrixMap{
		DimensionConversationManage: PermissionFull,
		DimensionConversationDelete: PermissionFull,
	})
	assert.True(t, pc.Can("manage", "conversation"))
	assert.True(t, pc.Can("create", "conversation"))
	assert.True(t, pc.Can("read", "conversation"))
	assert.True(t, pc.Can("delete", "conversation"))
}

func TestCan_CustomRoleMixedPermissions(t *testing.T) {
	pc := NewPolicyContext(3, 1, "custom_role", 10, PermissionMatrixMap{
		DimensionConversationManage: PermissionRead,
		DimensionContactManage:      PermissionFull,
		DimensionReportManage:       PermissionNone,
	})
	assert.True(t, pc.Can("read", "conversation"))
	assert.False(t, pc.Can("manage", "conversation"))
	assert.True(t, pc.Can("manage", "contact"))
	assert.False(t, pc.Can("read", "report"))
}

func TestCan_UnknownResource(t *testing.T) {
	pc := NewPolicyContext(2, 1, "agent", 0, nil)
	assert.False(t, pc.Can("read", "unknown_resource"))
}

// === mapActionToDimension tests ===

func TestMapActionToDimension_Conversation(t *testing.T) {
	assert.Equal(t, DimensionConversationDelete, mapActionToDimension("delete", "conversation"))
	assert.Equal(t, DimensionConversationManage, mapActionToDimension("read", "conversation"))
	assert.Equal(t, DimensionConversationManage, mapActionToDimension("manage", "conversation"))
	assert.Equal(t, DimensionConversationManage, mapActionToDimension("create", "conversation"))
}

func TestMapActionToDimension_OtherResources(t *testing.T) {
	assert.Equal(t, DimensionContactManage, mapActionToDimension("read", "contact"))
	assert.Equal(t, DimensionReportManage, mapActionToDimension("read", "report"))
	assert.Equal(t, DimensionKnowledgeBaseManage, mapActionToDimension("manage", "knowledge_base"))
	assert.Equal(t, DimensionAutomationManage, mapActionToDimension("create", "automation"))
}

func TestMapActionToDimension_UnknownResource(t *testing.T) {
	assert.Equal(t, PermissionDimension(""), mapActionToDimension("read", "widget"))
}

// === matchesAction tests ===

func TestMatchesAction_Read(t *testing.T) {
	assert.True(t, matchesAction(PermissionFull, "read"))
	assert.True(t, matchesAction(PermissionRead, "read"))
	assert.False(t, matchesAction(PermissionNone, "read"))
}

func TestMatchesAction_WriteActions(t *testing.T) {
	writeActions := []string{"manage", "create", "update", "assign", "resolve", "manage_labels", "delete"}
	for _, action := range writeActions {
		assert.True(t, matchesAction(PermissionFull, action), "full should match %s", action)
		assert.False(t, matchesAction(PermissionRead, action), "read should not match %s", action)
		assert.False(t, matchesAction(PermissionNone, action), "none should not match %s", action)
	}
}

func TestMatchesAction_UnknownAction(t *testing.T) {
	assert.False(t, matchesAction(PermissionFull, "teleport"))
}