using w4c_workflows.Services.Nodes;
using Xunit;

namespace w4c_workflows.Tests;

/// <summary>
/// Compile-time credential checks: a step may only reference aliases its
/// blueprint declares, and one alias cannot be bound to two different
/// credentials in the same workflow (so the run can resolve them once).
/// </summary>
public class NodeCredentialValidationTests
{
    private static NodeGraphCompileResult Compile(string yaml)
        => new NodeGraphCompiler(NodeTestData.CoreCatalog()).Compile(NodeTestData.Parse(yaml));

    [Fact]
    public void Records_the_alias_to_reference_map()
    {
        var yaml = """
            name: cred-demo
            tasks:
              - id: fetch
                node: { type: core.httpRequest }
                parameters: { url: "https://api.example.com" }
                credentials:
                  httpAuth: my-api
            """;

        var result = Compile(yaml);

        Assert.True(result.Success, string.Join("\n", result.Errors));
        Assert.Equal("my-api", result.Graph!.Find("fetch")!.CredentialRefs["httpAuth"]);
    }

    [Fact]
    public void Rejects_an_alias_the_blueprint_does_not_declare()
    {
        var yaml = """
            name: cred-unknown
            tasks:
              - id: fetch
                node: { type: core.httpRequest }
                parameters: { url: "https://api.example.com" }
                credentials:
                  nope: my-api
            """;

        var result = Compile(yaml);

        Assert.False(result.Success);
        Assert.Contains(result.Errors, e => e.Contains("has no credential alias 'nope'"));
    }

    [Fact]
    public void Rejects_one_alias_bound_to_two_different_credentials()
    {
        var yaml = """
            name: cred-conflict
            tasks:
              - id: a
                node: { type: core.httpRequest }
                parameters: { url: "https://a.example.com" }
                credentials: { httpAuth: cred-one }
                next: b
              - id: b
                node: { type: core.httpRequest }
                parameters: { url: "https://b.example.com" }
                credentials: { httpAuth: cred-two }
            """;

        var result = Compile(yaml);

        Assert.False(result.Success);
        Assert.Contains(result.Errors, e => e.Contains("bound to two different credentials"));
    }
}