using Opc.Ua;
using Opc.Ua.Server;
using Shouldly;
using Xunit;
using ZB.MOM.WW.OtOpcUa.OpcUaServer.Security;

namespace ZB.MOM.WW.OtOpcUa.OpcUaServer.Tests;

public sealed class RoleCarryingUserIdentityTests
{
    [Fact]
    public void Mandatory_and_dynamic_SDK_roles_preserve_the_application_identity()
    {
        var namespaces = new NamespaceTable();
        var identity = new RoleCarryingUserIdentity(new UserNameIdentityToken { UserName = "apikey" },
            [OpcUaDataPlaneRoles.WriteOperate, OpcUaDataPlaneRoles.AlarmAck], "machine-a", "key-a");
        var trusted = identity.WithAdditionalRoles([Role.TrustedApplication], namespaces);
        var mapped = trusted.WithAdditionalRoles([Role.AuthenticatedUser], namespaces);
        var actual = mapped.ShouldBeOfType<RoleCarryingUserIdentity>();
        actual.Principal.ShouldBe("machine-a");
        actual.ApiKeyId.ShouldBe("key-a");
        actual.Roles.ShouldBe([OpcUaDataPlaneRoles.WriteOperate, OpcUaDataPlaneRoles.AlarmAck]);
        actual.GrantedRoleIds.Contains(ExpandedNodeId.ToNodeId(Role.TrustedApplication.RoleId, namespaces)).ShouldBeTrue();
        actual.GrantedRoleIds.Contains(ExpandedNodeId.ToNodeId(Role.AuthenticatedUser.RoleId, namespaces)).ShouldBeTrue();
    }

    [Fact]
    public void SDK_restriction_discards_application_authority_and_cannot_restore_it_by_augmentation()
    {
        var namespaces = new NamespaceTable();
        var identity = new RoleCarryingUserIdentity(new UserNameIdentityToken { UserName = "apikey" },
            [OpcUaDataPlaneRoles.WriteOperate], "machine-a", "key-a");
        var restricted = RoleBasedIdentity.CreateRestricted(identity, [Role.Anonymous], namespaces);
        (restricted is RoleCarryingUserIdentity).ShouldBeFalse();
        (restricted.WithAdditionalRoles([Role.TrustedApplication], namespaces) is RoleCarryingUserIdentity).ShouldBeFalse();
        restricted.GrantedRoleIds.Count.ShouldBe(1);
    }
}