package access

import (
	"net"
	"testing"

	"github.com/owen/vibeproxy/internal/models"
)

func TestAccessListAllowDeny(t *testing.T) {
	m := models.AccessList{
		DefaultAllow: false,
		Rules: []models.AccessRule{
			{Action: models.AccessAllow, CIDR: "10.0.0.0/8", Priority: 0},
			{Action: models.AccessDeny, CIDR: "10.1.0.0/16", Priority: 1},
		},
	}
	l := Compile(m)

	cases := []struct {
		ip   string
		want bool
	}{
		{"10.2.3.4", true},     // matches allow 10.0.0.0/8 first
		{"192.168.1.1", false}, // no match, default deny
	}
	for _, c := range cases {
		got := l.Allowed(net.ParseIP(c.ip))
		if got != c.want {
			t.Errorf("Allowed(%s) = %v, want %v", c.ip, got, c.want)
		}
	}
}

func TestAccessListDefaultAllow(t *testing.T) {
	m := models.AccessList{DefaultAllow: true}
	l := Compile(m)
	if !l.Allowed(net.ParseIP("8.8.8.8")) {
		t.Fatal("expected default allow to permit unmatched IP")
	}
}

func TestAccessListRequiresAuth(t *testing.T) {
	m := models.AccessList{BasicAuthUsers: []models.AccessListUser{{Username: "bob", PasswordHash: "x"}}}
	l := Compile(m)
	if !l.RequiresAuth() {
		t.Fatal("expected RequiresAuth to be true when users are configured")
	}
}