package openstack

import "testing"

func TestBuildAuthOptionsToken(t *testing.T) {
	opts, err := buildAuthOptions(ClientConfig{
		AuthURL:   "https://keystone.example:5000/v3/",
		Method:    AuthMethodToken,
		Token:     "tok-123",
		ProjectID: "proj-1",
	})
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}
	if opts.TokenID != "tok-123" {
		t.Fatalf("expected TokenID to be passed through, got %q", opts.TokenID)
	}
	if opts.Scope != nil {
		t.Fatalf("expected Scope to be unset for token passthrough, got %+v", opts.Scope)
	}
	if opts.AllowReauth {
		t.Fatalf("expected AllowReauth=false for token passthrough")
	}
}

func TestBuildAuthOptionsTokenDefaultMethod(t *testing.T) {
	// Method: "" must behave identically to AuthMethodToken.
	opts, err := buildAuthOptions(ClientConfig{
		AuthURL:   "https://keystone.example:5000/v3/",
		Token:     "tok-123",
		ProjectID: "proj-1",
	})
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}
	if opts.TokenID != "tok-123" || opts.Scope != nil {
		t.Fatalf("expected default method to behave as token passthrough, got %+v", opts)
	}
}

func TestBuildAuthOptionsTokenMissing(t *testing.T) {
	_, err := buildAuthOptions(ClientConfig{
		AuthURL:   "https://keystone.example:5000/v3/",
		Method:    AuthMethodToken,
		ProjectID: "proj-1",
	})
	if err == nil {
		t.Fatal("expected error for missing token")
	}
}

func TestBuildAuthOptionsPassword(t *testing.T) {
	opts, err := buildAuthOptions(ClientConfig{
		AuthURL:        "https://keystone.example:5000/v3/",
		Method:         AuthMethodPassword,
		Username:       "a.yurishchev",
		Password:       "secret",
		UserDomainName: "users",
		ProjectID:      "proj-1",
	})
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}
	if opts.Username != "a.yurishchev" || opts.Password != "secret" || opts.DomainName != "users" {
		t.Fatalf("expected password credentials to be passed through, got %+v", opts)
	}
	if opts.Scope == nil || opts.Scope.ProjectID != "proj-1" {
		t.Fatalf("expected scope to be set to project ID, got %+v", opts.Scope)
	}
	if !opts.AllowReauth {
		t.Fatalf("expected AllowReauth=true for password auth")
	}
}

func TestBuildAuthOptionsPasswordMissingCredentials(t *testing.T) {
	_, err := buildAuthOptions(ClientConfig{
		AuthURL:   "https://keystone.example:5000/v3/",
		Method:    AuthMethodPassword,
		Username:  "a.yurishchev",
		ProjectID: "proj-1",
	})
	if err == nil {
		t.Fatal("expected error for missing password")
	}
}

func TestBuildAuthOptionsUnknownMethod(t *testing.T) {
	_, err := buildAuthOptions(ClientConfig{
		AuthURL:   "https://keystone.example:5000/v3/",
		Method:    "totp",
		ProjectID: "proj-1",
	})
	if err == nil {
		t.Fatal("expected error for unknown auth method")
	}
}

func TestBuildAuthOptionsMissingAuthURL(t *testing.T) {
	_, err := buildAuthOptions(ClientConfig{
		Method:    AuthMethodToken,
		Token:     "tok-123",
		ProjectID: "proj-1",
	})
	if err == nil {
		t.Fatal("expected error for missing auth URL")
	}
}

func TestBuildAuthOptionsMissingProjectID(t *testing.T) {
	_, err := buildAuthOptions(ClientConfig{
		AuthURL: "https://keystone.example:5000/v3/",
		Method:  AuthMethodToken,
		Token:   "tok-123",
	})
	if err == nil {
		t.Fatal("expected error for missing project ID")
	}
}