package ldap

import (
	"strings"
	"testing"

	ldap "github.com/ps78674/ldapserver"
)

func TestSetDomainValidation(t *testing.T) {
	s := New(WithLogger(testLogger()))

	for _, bad := range []string{"", "example..com", ".example.com", "example.com."} {
		if err := s.SetDomain(bad); err == nil {
			t.Errorf("SetDomain(%q) accepted an invalid domain", bad)
		}
	}

	if err := s.SetDomain("example.com"); err != nil {
		t.Fatalf("SetDomain(example.com): %s", err)
	}
	want := []string{"dc=netauth", "dc=example", "dc=com"}
	if strings.Join(s.nc, ",") != strings.Join(want, ",") {
		t.Errorf("naming context is %v, want %v", s.nc, want)
	}
}

// Search routes depend on the naming context, so a search must not be
// routed at all until a domain is configured.
func TestSearchBeforeSetDomain(t *testing.T) {
	s := New(WithLogger(testLogger()), WithNetAuth(&fakeClient{}))

	w := &recordingWriter{}
	s.ServeLDAP(w, mustDecode(t, berSearchRequest("ou=entities,dc=netauth")))

	code := resultCode(t, w.responses[len(w.responses)-1])
	if code == ldap.LDAPResultSuccess {
		t.Error("a search was served without a configured domain")
	}
}

// Reconfiguring the domain must replace the old routes rather than
// adding to them, otherwise a renamed server keeps serving its
// previous base DN forever.
func TestSetDomainReplacesRoutes(t *testing.T) {
	s := New(WithLogger(testLogger()), WithNetAuth(&fakeClient{}))

	if err := s.SetDomain("example.com"); err != nil {
		t.Fatal(err)
	}
	if err := s.SetDomain("other.org"); err != nil {
		t.Fatal(err)
	}

	// The old base DN must no longer route to the entity handler.
	old := &recordingWriter{}
	s.ServeLDAP(old, mustDecode(t, berSearchRequest("ou=entities,dc=netauth,dc=example,dc=com")))
	if code := resultCode(t, old.responses[len(old.responses)-1]); code != ldap.LDAPResultUnwillingToPerform {
		t.Errorf("stale base DN returned %d, want %d (unwillingToPerform)", code, ldap.LDAPResultUnwillingToPerform)
	}

	// The new base DN must route.
	fresh := &recordingWriter{}
	s.ServeLDAP(fresh, mustDecode(t, berSearchRequest("ou=entities,dc=netauth,dc=other,dc=org")))
	if code := resultCode(t, fresh.responses[len(fresh.responses)-1]); code == ldap.LDAPResultUnwillingToPerform {
		t.Error("the current base DN does not route to the entity handler")
	}
}