from __future__ import annotations

import unittest

from govoplan_files.backend.storage.connector_policy import (
    ConnectorAccessRequest,
    ConnectorPolicySource,
    connector_policy_decision,
)


class ConnectorPolicyPatternTests(unittest.TestCase):
    def test_resource_reference_allow_patterns_match(self) -> None:
        decision = connector_policy_decision(
            ConnectorAccessRequest(
                connector_id="dev-smb",
                credential_id="credential-primary",
                provider="smb",
            ),
            (
                ConnectorPolicySource(
                    scope_type="tenant",
                    scope_id="tenant-1",
                    label="Tenant",
                    policy={
                        "allow": {
                            "connectors": ["dev-*"],
                            "credentials": ["credential-*"],
                            "providers": ["s?b"],
                        }
                    },
                ),
            ),
        )

        self.assertTrue(decision.allowed)

    def test_resource_reference_deny_patterns_take_precedence(self) -> None:
        decision = connector_policy_decision(
            ConnectorAccessRequest(
                connector_id="dev-smb",
                credential_id="credential-legacy",
                provider="smb",
            ),
            (
                ConnectorPolicySource(
                    scope_type="tenant",
                    scope_id="tenant-1",
                    label="Tenant",
                    policy={
                        "allow": {"connectors": ["dev-*"]},
                        "deny": {"credentials": ["*-legacy"]},
                    },
                ),
            ),
        )

        self.assertFalse(decision.allowed)
        self.assertEqual(
            ("connector_policy_denylist",),
            decision.requirements,
        )


if __name__ == "__main__":
    unittest.main()