using SGU.AuthBroker.Options;
using SGU.AuthBroker.Core.Identity;
using Xunit;

namespace SGU.AuthBroker.Tests;

public sealed class BrokerOptionsTests
{
    [Fact]
    public void ValidateAllowsAnEmptyClientAllowListDuringServerBootstrap()
    {
        BrokerOptions options = new();

        options.Validate();
    }

    [Fact]
    public void ValidateRejectsAnInvalidConfiguredClientThumbprint()
    {
        BrokerOptions options = new()
        {
            Tls = new TlsOptions
            {
                AllowedClientThumbprints = ["not-a-thumbprint"]
            }
        };

        InvalidOperationException exception = Assert.Throws<InvalidOperationException>(options.Validate);

        Assert.Contains("thumbprint", exception.Message, StringComparison.OrdinalIgnoreCase);
    }

    [Theory]
    [InlineData(InstitutionalRole.Student, "CN=SGU-Alumnos,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx")]
    [InlineData(InstitutionalRole.Administrative, "CN=SGU-Administrativos,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx")]
    [InlineData(InstitutionalRole.Professor, "CN=SGU-Docentes,OU=Usuarios-SGU,DC=lci,DC=lasalle,DC=mx")]
    public void DefaultRoleGroupMappingsMatchInstitutionalPrefixes(InstitutionalRole role, string expectedGroupDn)
    {
        ActiveDirectoryOptions options = new();

        Assert.Equal(expectedGroupDn, options.GetGroupDn(role));
    }

    [Fact]
    public void ValidateRejectsARoleGroupOutsideTheConfiguredDirectoryBase()
    {
        BrokerOptions options = new()
        {
            Directory = new ActiveDirectoryOptions
            {
                StudentGroupDn = "CN=SGU-Alumnos,DC=example,DC=invalid"
            }
        };

        InvalidOperationException exception = Assert.Throws<InvalidOperationException>(options.Validate);

        Assert.Contains("security-group", exception.Message, StringComparison.OrdinalIgnoreCase);
    }
}