package ldap

import (
	"testing"

	ldap "github.com/vjeantet/ldapserver"
)

// The router has a catch-all NotFound handler. Even if a bind somehow
// reaches it (for example if a future routing change lets an
// authentication choice slip past handleBind), it must fail closed
// rather than reporting success.
func TestNotFoundRefusesBind(t *testing.T) {
	s := &server{l: testLogger()}
	s.nc = []string{"dc=netauth", "dc=example", "dc=com"}

	w := &recordingWriter{}
	s.handleNotFound(w, mustDecode(t, berBindRequest("", "")))

	if len(w.responses) != 1 {
		t.Fatalf("got %d responses, want exactly 1", len(w.responses))
	}
	if code := resultCode(t, w.responses[0]); code != ldap.LDAPResultUnwillingToPerform {
		t.Errorf("result code is %d, want %d", code, ldap.LDAPResultUnwillingToPerform)
	}
}