package authz

import (
	"net/http"
	"net/http/httptest"
	"testing"
)

func TestSurfaceCapabilities(t *testing.T) {
	if Telegram.CanEmit("TaskCreated") || Ntfy.CanEmit("ApprovalRequested") {
		t.Fatal("notify surface emitted an event")
	}
	if !TUI.CanEmit("TaskCreated") {
		t.Fatal("control surface cannot emit")
	}
	if !MCP.CanEmit("ApprovalRequested") || MCP.CanEmit("TaskCreated") {
		t.Fatal("mcp gate is wrong")
	}
}

// TestSystemSurfaceDowngradedByHTTPMiddleware guards half of B8: System
// means "the plane itself, in-process" and is always FullControl with no
// token gate, since no deployment configures a token for a surface no HTTP
// caller is meant to use. HTTP() must never let a request pass through
// treated as System, or a caller declaring X-Orchestra-Surface: system gets
// an unconditional, unauthenticated bypass of the token check below it.
// (Downstream handlers must independently avoid re-deriving System from the
// raw header themselves — see cmd/orchestra/main.go's `surface` closure,
// which this package cannot test directly.)
func TestSystemSurfaceDowngradedByHTTPMiddleware(t *testing.T) {
	tokens := map[Surface]string{System: "should-never-be-checked"}
	h := HTTP(tokens, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		w.WriteHeader(http.StatusOK)
	}))
	req := httptest.NewRequest(http.MethodPost, "/v1/tasks/t1/complete", nil)
	req.Header.Set("X-Orchestra-Surface", "system")
	rec := httptest.NewRecorder()
	h.ServeHTTP(rec, req)
	// System's token check is intentionally skipped by HTTP() (it downgrades
	// to Web before the token comparison), so the request reaching the
	// handler at all is expected here — the guard that matters is that
	// nothing downstream can observe "system" as the resolved surface. This
	// test documents the middleware's half of the fix; main.go's `surface`
	// closure carries the other half.
	if rec.Code != http.StatusOK {
		t.Fatalf("unexpected status %d", rec.Code)
	}
}