package server

import (
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"
)

// The unauthenticated embedded single-user mode must not expose any account
// administration operation (R1), regardless of request fields.
func TestUnauthenticatedModeBlocksAccountAdministration(t *testing.T) {
	srv, st := newTestServer(t)
	if srv.Auth != nil && srv.Auth.Enabled {
		t.Fatal("expected unauthenticated test server")
	}
	h := srv.Handler()
	routes := []struct{ method, path, body string }{
		{http.MethodGet, "/api/admin/users", ""},
		{http.MethodGet, "/api/admin/users/search?q=a", ""},
		{http.MethodPost, "/api/admin/users", `{"owner":"mallory","isAdmin":true,"role":"admin"}`},
		{http.MethodGet, "/api/admin/users/usr_x", ""},
		{http.MethodPatch, "/api/admin/users/usr_x/profile", `{"expectedProfileVersion":1,"patch":{"name":"x"}}`},
		{http.MethodPut, "/api/admin/users/usr_x/state", `{"enabled":false}`},
		{http.MethodPut, "/api/admin/users/usr_x/admin", `{"expectedStateVersion":1,"isAdmin":true}`},
		{http.MethodPost, "/api/admin/users/root/one-time-password", `{}`},
		{http.MethodGet, "/api/admin/permissions/catalog", ""},
		{http.MethodGet, "/api/admin/roles", ""},
		{http.MethodPost, "/api/admin/roles", `{"name":"x"}`},
		{http.MethodPut, "/api/admin/users/usr_x/role", `{"roleId":"admin"}`},
		{http.MethodGet, "/api/admin/users/usr_x/system-grants", ""},
		{http.MethodPut, "/api/admin/users/usr_x/system-grants", `{"actions":["system.users.create"]}`},
	}
	for _, route := range routes {
		req := httptest.NewRequest(route.method, route.path, strings.NewReader(route.body))
		req.Header.Set("Content-Type", "application/json")
		rec := httptest.NewRecorder()
		h.ServeHTTP(rec, req)
		if rec.Code != http.StatusForbidden {
			t.Errorf("%s %s: status=%d body=%s; want 403", route.method, route.path, rec.Code, rec.Body.String())
		}
	}
	if users, err := st.ListUsersAdmin(); err != nil || len(users) != 0 {
		t.Fatalf("unauthenticated request created accounts: %d err=%v", len(users), err)
	}
}