package store_test

import (
	"testing"

	"atlas9.dev/c/core/assert"
	"atlas9.dev/c/core/dbi"
	"atlas9.dev/c/core/iam"
	"atlas9.dev/c/core/tokens"
	"atlas9.dev/c/demo/lib/access"
	"atlas9.dev/c/demo/store"
)

// Pruning is a system-privileged maintenance operation. These tests pin the
// guard so the prune paths can't silently regress to being wide open.

func TestSessionDeleteExpiredRequiresCap(t *testing.T) {

	db := setupTestDB(t)
	tx, err := db.Begin()
	assert.Ok(t, err)
	t.Cleanup(func() { tx.Rollback() })

	s := store.NewSqliteSessionStore(dbi.WrapTx(tx), access.ContextGuard{})

	// No grant in context -> denied.
	_, err = s.DeleteExpired(t.Context())
	assert.Eq(t, err, iam.ErrForbidden)

	// With the system cap -> allowed.
	_, err = s.DeleteExpired(access.PutSystem(t.Context(), iam.CapSessionsPrune))
	assert.Ok(t, err)
}

func TestTokenDeleteExpiredRequiresCap(t *testing.T) {

	db := setupTestDB(t)
	tx, err := db.Begin()
	assert.Ok(t, err)
	t.Cleanup(func() { tx.Rollback() })

	s := store.NewPasswordResetTokenStore(dbi.WrapTx(tx), access.ContextGuard{})

	// No grant in context -> denied.
	_, err = s.DeleteExpired(t.Context())
	assert.Eq(t, err, iam.ErrForbidden)

	// With the system cap -> allowed.
	_, err = s.DeleteExpired(access.PutSystem(t.Context(), tokens.CapTokensPrune))
	assert.Ok(t, err)
}