package middleware

import (
	"context"
	"testing"
)

// mockAuthorizer implements Authorizer for testing.
type mockAuthorizer struct {
	isAuthorizedFunc func(ctx context.Context, userID string, roles []string, toolName, connectionName string) (bool, string, string)
}

func (m *mockAuthorizer) IsAuthorized(ctx context.Context, userID string, roles []string, toolName, connectionName string) (authorized bool, persona, reason string) {
	if m.isAuthorizedFunc != nil {
		return m.isAuthorizedFunc(ctx, userID, roles, toolName, connectionName)
	}
	return true, "", ""
}

func TestNoopAuthorizer(t *testing.T) {
	authz := &NoopAuthorizer{}
	authorized, personaName, reason := authz.IsAuthorized(context.Background(), "user", []string{"role"}, "tool", "")
	if !authorized {
		t.Error("expected authorized to be true")
	}
	if personaName != "" {
		t.Errorf("expected empty persona name, got %q", personaName)
	}
	if reason != "" {
		t.Errorf("expected empty reason, got %q", reason)
	}
}

func TestAllowAllAuthorizer(t *testing.T) {
	authz := AllowAllAuthorizer()
	authorized, personaName, reason := authz.IsAuthorized(context.Background(), "anyuser", []string{"anyrole"}, "anytool", "")
	if !authorized {
		t.Error("expected authorized to be true")
	}
	if personaName != "" {
		t.Errorf("expected empty persona name, got %q", personaName)
	}
	if reason != "" {
		t.Errorf("expected empty reason, got %q", reason)
	}
}

// Verify interface compliance.
var (
	_ Authorizer = (*NoopAuthorizer)(nil)
	_ Authorizer = (*mockAuthorizer)(nil)
)
