package casbin

import (
	"net/http"
	"testing"

	casbinv2 "github.com/casbin/casbin/v2"
	"github.com/casbin/casbin/v2/model"
)

const testModel = `
[request_definition]
r = sub, obj, act

[policy_definition]
p = sub, obj, act

[role_definition]
g = _, _

[policy_effect]
e = some(where (p.eft == allow))

[matchers]
m = g(r.sub, p.sub) && keyMatch(r.obj, p.obj) && regexMatch(r.act, p.act)
`

func TestEnforcerPermissions(t *testing.T) {
	m, err := model.NewModelFromString(testModel)
	if err != nil {
		t.Fatalf("创建Casbin测试模型失败: %v", err)
	}
	enforcer, err := casbinv2.NewEnforcer(m)
	if err != nil {
		t.Fatalf("创建Casbin测试实例失败: %v", err)
	}

	assertPermission(t, enforcer, "admin", "/", http.MethodGet, false)
	if ok, addErr := enforcer.AddPolicy("admin", "*", ActionAll); addErr != nil || !ok {
		t.Fatalf("添加管理员策略失败: ok=%v err=%v", ok, addErr)
	}
	assertPermission(t, enforcer, "admin", "/", http.MethodGet, true)

	if ok, addErr := enforcer.AddPolicy("user1", "/api/v1/*", ActionAll); addErr != nil || !ok {
		t.Fatalf("添加用户策略失败: ok=%v err=%v", ok, addErr)
	}
	assertPermission(t, enforcer, "user1", "/api/v1/user/list", http.MethodPost, true)
	assertPermission(t, enforcer, "user1", "/api/v1/user/list", http.MethodGet, true)
	assertPermission(t, enforcer, "user1", "/api/v2/user/list", http.MethodGet, false)

	if ok, deleteErr := enforcer.DeletePermissionsForUser("user1"); deleteErr != nil || !ok {
		t.Fatalf("删除用户策略失败: ok=%v err=%v", ok, deleteErr)
	}
	assertPermission(t, enforcer, "user1", "/api/v1/user/list", http.MethodGet, false)
}

func assertPermission(t *testing.T, enforcer *casbinv2.Enforcer, user, path, method string, expected bool) {
	t.Helper()
	actual, err := enforcer.Enforce(user, path, method)
	if err != nil {
		t.Fatalf("检查权限失败: %v", err)
	}
	if actual != expected {
		t.Fatalf("权限结果不符 user=%s path=%s method=%s expected=%v actual=%v", user, path, method, expected, actual)
	}
}