package app

import "testing"

func TestNativeServicePrincipalScope(t *testing.T) {
	principal := &User{
		PrincipalType: "service",
		PrincipalKey:  "cache",
		Scopes:        []string{"auth:introspect", "crm:account-contact:load"},
	}
	if !principal.IsServicePrincipal("cache") {
		t.Fatal("expected stable service-principal match")
	}
	if !principal.HasScope("crm:account-contact:load") {
		t.Fatal("expected exact scope grant")
	}
	if principal.HasScope("crm:account:write") {
		t.Fatal("unexpected scope grant")
	}
}

func TestLegacyUserCannotClaimServiceScope(t *testing.T) {
	legacy := &User{APIKey: "legacy", Scopes: []string{"crm:account-contact:load"}}
	if legacy.IsServicePrincipal("cache") || legacy.HasScope("crm:account-contact:load") {
		t.Fatal("legacy user must not satisfy native service authorization")
	}
}