// SPDX-FileCopyrightText: 2026 Echolot contributors
// SPDX-License-Identifier: GPL-3.0-or-later

package runs

import (
	"testing"
	"time"
)

// Account scoping widens what a caller can read, so the test that matters is the one about what
// it must NOT widen: a run id from another account has to be invisible, not merely unlisted.
func TestAccountScopingDoesNotReachOtherAccounts(t *testing.T) {
	s, _ := open(t, DefaultPolicy())

	// Two devices on one account, one device belonging to somebody else.
	mine := []string{"phone-a", "tablet-a"}
	for i, d := range mine {
		if _, err := s.Put(d, doc("run-"+d, AnonFull), true); err != nil {
			t.Fatal(err)
		}
		_ = i
		time.Sleep(2 * time.Millisecond)
	}
	if _, err := s.Put("phone-b", doc("run-secret", AnonFull), true); err != nil {
		t.Fatal(err)
	}

	got := s.ListFor(mine)
	if len(got) != 2 {
		t.Fatalf("account history has %d runs, want 2", len(got))
	}
	for _, m := range got {
		if m.ID == "run-secret" {
			t.Fatal("another account's run appeared in the history")
		}
	}

	// The decisive one: knowing the id is not enough.
	if _, ok := s.OwnerOf(mine, "run-secret"); ok {
		t.Fatal("a run id from another account resolved against this account's devices")
	}
	if owner, ok := s.OwnerOf(mine, "run-phone-a"); !ok || owner != "phone-a" {
		t.Fatalf("own run did not resolve: owner=%q ok=%v", owner, ok)
	}
	// A sibling device's run must resolve — that is the point of the feature.
	if owner, ok := s.OwnerOf(mine, "run-tablet-a"); !ok || owner != "tablet-a" {
		t.Fatalf("sibling device's run did not resolve: owner=%q ok=%v", owner, ok)
	}
}

func TestAccountHistoryIsNewestFirstAcrossDevices(t *testing.T) {
	s, _ := open(t, DefaultPolicy())
	if _, err := s.Put("phone", doc("older", AnonFull), true); err != nil {
		t.Fatal(err)
	}
	time.Sleep(5 * time.Millisecond)
	if _, err := s.Put("tablet", doc("newer", AnonFull), true); err != nil {
		t.Fatal(err)
	}
	got := s.ListFor([]string{"phone", "tablet"})
	if len(got) != 2 || got[0].ID != "newer" {
		t.Fatalf("not merged newest-first: %+v", got)
	}
}

func TestEmptyDeviceSetSeesNothing(t *testing.T) {
	s, _ := open(t, DefaultPolicy())
	if _, err := s.Put("someone", doc("run-1", AnonFull), true); err != nil {
		t.Fatal(err)
	}
	if got := s.ListFor(nil); len(got) != 0 {
		t.Fatalf("an empty device set returned %d runs", len(got))
	}
	if _, ok := s.OwnerOf(nil, "run-1"); ok {
		t.Fatal("a run resolved against an empty device set")
	}
}