package auth

import (
	"testing"
)

func TestRegisterExtensionPermissions(t *testing.T) {
	// Clean state
	extPermsMu.Lock()
	extPerms = make(map[string][]string)
	extPermsMu.Unlock()

	RegisterExtensionPermissions("image-gen", []string{"image-gen.use", "image-gen.admin"})

	all := AllPermissionsWithExtensions()
	found := 0
	for _, p := range all {
		if p == "image-gen.use" || p == "image-gen.admin" {
			found++
		}
	}
	if found != 2 {
		t.Errorf("expected 2 extension permissions, found %d in %v", found, all)
	}

	// Kernel permissions should also be present
	for _, kp := range KernelPermissions {
		foundKernel := false
		for _, p := range all {
			if p == kp {
				foundKernel = true
				break
			}
		}
		if !foundKernel {
			t.Errorf("kernel permission %q missing from AllPermissionsWithExtensions()", kp)
		}
	}
}

func TestUnregisterExtensionPermissions(t *testing.T) {
	extPermsMu.Lock()
	extPerms = make(map[string][]string)
	extPermsMu.Unlock()

	RegisterExtensionPermissions("image-gen", []string{"image-gen.use"})
	UnregisterExtensionPermissions("image-gen")

	all := AllPermissionsWithExtensions()
	for _, p := range all {
		if p == "image-gen.use" {
			t.Error("unregistered permission should not appear")
		}
	}
}

func TestAllPermissionsGrouped(t *testing.T) {
	extPermsMu.Lock()
	extPerms = make(map[string][]string)
	extPermsMu.Unlock()

	RegisterExtensionPermissions("chat", []string{"chat.send", "chat.admin"})
	RegisterExtensionPermissions("notes", []string{"notes.edit"})

	grouped := AllPermissionsGrouped()

	if len(grouped["kernel"]) != len(KernelPermissions) {
		t.Errorf("expected %d kernel permissions, got %d", len(KernelPermissions), len(grouped["kernel"]))
	}
	if len(grouped["chat"]) != 2 {
		t.Errorf("expected 2 chat permissions, got %d", len(grouped["chat"]))
	}
	if len(grouped["notes"]) != 1 {
		t.Errorf("expected 1 notes permission, got %d", len(grouped["notes"]))
	}

	// Clean up
	extPermsMu.Lock()
	extPerms = make(map[string][]string)
	extPermsMu.Unlock()
}