package server

import (
	"context"
	"errors"
	"testing"

	"chat-agent-system/internal/auth"
	"chat-agent-system/internal/authz"
	"chat-agent-system/internal/docrevision"
)

func TestAuthorizeDocRevision_ReviewerAndNonMemberCannotWrite(t *testing.T) {
	srv := newTestServer(t)
	// 隔离写权门闩：跳过项目成员库检查，只验证 AuthorID。禁止依赖共享库或默认拒绝。
	// FIND-SEC-02 后 NewAuthorizer(nil) 严格拒绝，改用显式内存授权接缝。
	srv.cfg.AllowInMemory = true
	srv.setOverrideAuthorizer(authz.NewInMemoryAuthorizer())
	ctx := context.Background()
	const (
		authorID   int64 = 170
		reviewerID int64 = 171
		strangerID int64 = 99
		docID            = "doc_proj_duty_write"
	)
	if _, err := srv.gov().CreateOrGetDocument(
		ctx, docID, 6145, "intake", "摸底", "V0.1", "",
		authorID, "编制人A", reviewerID, "审核人B", 0, "",
	); err != nil {
		t.Fatal(err)
	}
	ref := &docRevisionRef{
		Kind: "controlled", ProjectID: 6145, LifecycleState: "drafting", AuthorID: authorID,
	}

	author := &auth.UserAccount{ID: authorID, Name: "编制人A"}
	if err := srv.authorizeDocRevision(ctx, author, ref, true); err != nil {
		t.Fatalf("author write must succeed, got %v", err)
	}

	reviewer := &auth.UserAccount{ID: reviewerID, Name: "审核人B"}
	if err := srv.authorizeDocRevision(ctx, reviewer, ref, true); !errors.Is(err, docrevision.ErrForbidden) {
		t.Fatalf("reviewer write want docrevision.ErrForbidden, got %v", err)
	}

	stranger := &auth.UserAccount{ID: strangerID, Name: "局外人C"}
	if err := srv.authorizeDocRevision(ctx, stranger, ref, true); !errors.Is(err, docrevision.ErrForbidden) {
		t.Fatalf("outsider write want docrevision.ErrForbidden, got %v", err)
	}
}