package model

import (
	"testing"

	"github.com/stretchr/testify/require"
)

func validCustomOAuthProvider() *CustomOAuthProvider {
	return &CustomOAuthProvider{
		Name:                  "Example OAuth",
		Slug:                  "Example-Provider",
		ClientId:              "client-id",
		AuthorizationEndpoint: "https://id.example/authorize",
		TokenEndpoint:         "https://id.example/token",
		UserInfoEndpoint:      "https://id.example/userinfo",
	}
}

func TestValidateCustomOAuthProviderNormalizesSlugAndAppliesDefaults(t *testing.T) {
	provider := validCustomOAuthProvider()

	err := validateCustomOAuthProvider(provider)

	require.NoError(t, err)
	require.Equal(t, "example-provider", provider.Slug)
	require.Equal(t, "sub", provider.UserIdField)
	require.Equal(t, "preferred_username", provider.UsernameField)
	require.Equal(t, "openid profile email", provider.Scopes)
}

func TestValidateCustomOAuthProviderRejectsInvalidSlugAndPolicy(t *testing.T) {
	invalidSlug := validCustomOAuthProvider()
	invalidSlug.Slug = "bad_slug"
	require.ErrorContains(t, validateCustomOAuthProvider(invalidSlug), "slug")

	unsupportedOp := validCustomOAuthProvider()
	unsupportedOp.AccessPolicy = `{"conditions":[{"field":"role","op":"matches","value":"admin"}]}`
	require.ErrorContains(t, validateCustomOAuthProvider(unsupportedOp), "unsupported")

	nonArrayMembership := validCustomOAuthProvider()
	nonArrayMembership.AccessPolicy = `{"conditions":[{"field":"role","op":"in","value":"admin"}]}`
	require.ErrorContains(t, validateCustomOAuthProvider(nonArrayMembership), "must be an array")
}