Authorization/services/policy_evaluator_test.go

package services

import (
	"authorization/models"
	"testing"
)

func TestResolveVariables(t *testing.T) {
	tests := []struct {
		name     string
		value    string
		ctx      *models.AuthorizationContext
		expected string
	}{
		{
			name:  "resolves user attribute",
			value: "${user.department}",
			ctx: &models.AuthorizationContext{
				UserAttributes: map[string]string{"department": "Engineering"},
			},
			expected: "Engineering",
		},
		{
			name:  "resolves resource attribute",
			value: "${resource.owner}",
			ctx: &models.AuthorizationContext{
				ResourceData: map[string]string{"owner": "user123"},
			},
			expected: "user123",
		},
		{
			name:  "resolves environment attribute",
			value: "${environment.time}",
			ctx: &models.AuthorizationContext{
				Environment: map[string]string{"time": "12:00"},
			},
			expected: "12:00",
		},
		{
			name:  "resolves multiple variables",
			value: "${user.name} from ${user.department}",
			ctx: &models.AuthorizationContext{
				UserAttributes: map[string]string{
					"name":       "John",
					"department": "IT",
				},
			},
			expected: "John from IT",
		},
		{
			name:     "leaves unresolved variables unchanged",
			value:    "${user.nonexistent}",
			ctx:      &models.AuthorizationContext{UserAttributes: map[string]string{}},
			expected: "${user.nonexistent}",
		},
		{
			name:     "handles no variables",
			value:    "plain text",
			ctx:      &models.AuthorizationContext{},
			expected: "plain text",
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got := resolveVariables(tt.value, tt.ctx)
			if got != tt.expected {
				t.Errorf("resolveVariables() = %v, want %v", got, tt.expected)
			}
		})
	}
}

func TestCompare_Equality(t *testing.T) {
	tests := []struct {
		name     string
		actual   string
		expected string
		operator string
		want     bool
	}{
		{"equal strings", "admin", "admin", "=", true},
		{"not equal strings", "admin", "user", "=", false},
		{"not equal operator true", "admin", "user", "!=", true},
		{"not equal operator false", "admin", "admin", "!=", false},
		{"equal with whitespace", " admin ", "admin", "=", true},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got := compare(tt.actual, tt.expected, tt.operator)
			if got != tt.want {
				t.Errorf("compare(%q, %q, %q) = %v, want %v", tt.actual, tt.expected, tt.operator, got, tt.want)
			}
		})
	}
}

func TestCompare_Numeric(t *testing.T) {
	tests := []struct {
		name     string
		actual   string
		expected string
		operator string
		want     bool
	}{
		{"greater than true", "10", "5", ">", true},
		{"greater than false", "5", "10", ">", false},
		{"less than true", "5", "10", "<", true},
		{"less than false", "10", "5", "<", false},
		{"greater or equal true equal", "10", "10", ">=", true},
		{"greater or equal true greater", "11", "10", ">=", true},
		{"greater or equal false", "9", "10", ">=", false},
		{"less or equal true equal", "10", "10", "<=", true},
		{"less or equal true less", "9", "10", "<=", true},
		{"less or equal false", "11", "10", "<=", false},
		{"invalid number returns false", "abc", "10", ">", false},
		{"float comparison", "10.5", "10.2", ">", true},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got := compare(tt.actual, tt.expected, tt.operator)
			if got != tt.want {
				t.Errorf("compare(%q, %q, %q) = %v, want %v", tt.actual, tt.expected, tt.operator, got, tt.want)
			}
		})
	}
}

func TestCompare_IN(t *testing.T) {
	tests := []struct {
		name     string
		actual   string
		expected string
		want     bool
	}{
		{"value in list", "admin", "admin,user,guest", true},
		{"value not in list", "superuser", "admin,user,guest", false},
		{"value in list with spaces", "admin", " admin , user , guest ", true},
		{"case insensitive match", "ADMIN", "admin,user,guest", true},
		{"single value match", "admin", "admin", true},
		{"empty list", "admin", "", false},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got := compare(tt.actual, tt.expected, "IN")
			if got != tt.want {
				t.Errorf("compare(%q, %q, IN) = %v, want %v", tt.actual, tt.expected, got, tt.want)
			}
		})
	}
}

func TestCompare_StringOperations(t *testing.T) {
	tests := []struct {
		name     string
		actual   string
		expected string
		operator string
		want     bool
	}{
		{"contains true", "hello world", "world", "CONTAINS", true},
		{"contains false", "hello world", "xyz", "CONTAINS", false},
		{"contains case insensitive", "Hello World", "WORLD", "CONTAINS", true},
		{"starts with true", "hello world", "hello", "STARTS_WITH", true},
		{"starts with false", "hello world", "world", "STARTS_WITH", false},
		{"starts with case insensitive", "Hello World", "HELLO", "STARTS_WITH", true},
		{"ends with true", "hello world", "world", "ENDS_WITH", true},
		{"ends with false", "hello world", "hello", "ENDS_WITH", false},
		{"ends with case insensitive", "Hello World", "WORLD", "ENDS_WITH", true},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got := compare(tt.actual, tt.expected, tt.operator)
			if got != tt.want {
				t.Errorf("compare(%q, %q, %q) = %v, want %v", tt.actual, tt.expected, tt.operator, got, tt.want)
			}
		})
	}
}

func TestCompare_UnknownOperator(t *testing.T) {
	got := compare("value", "value", "UNKNOWN")
	if got != false {
		t.Errorf("compare with unknown operator should return false, got %v", got)
	}
}

func TestNumericCompare(t *testing.T) {
	tests := []struct {
		name      string
		actual    string
		expected  string
		compareFn func(float64, float64) bool
		want      bool
	}{
		{
			name:      "valid numbers greater",
			actual:    "10",
			expected:  "5",
			compareFn: func(a, e float64) bool { return a > e },
			want:      true,
		},
		{
			name:      "valid numbers less",
			actual:    "5",
			expected:  "10",
			compareFn: func(a, e float64) bool { return a < e },
			want:      true,
		},
		{
			name:      "invalid actual number",
			actual:    "abc",
			expected:  "10",
			compareFn: func(a, e float64) bool { return a > e },
			want:      false,
		},
		{
			name:      "invalid expected number",
			actual:    "10",
			expected:  "xyz",
			compareFn: func(a, e float64) bool { return a > e },
			want:      false,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got := numericCompare(tt.actual, tt.expected, tt.compareFn)
			if got != tt.want {
				t.Errorf("numericCompare(%q, %q) = %v, want %v", tt.actual, tt.expected, got, tt.want)
			}
		})
	}
}

func TestInComparison(t *testing.T) {
	tests := []struct {
		name     string
		actual   string
		expected string
		want     bool
	}{
		{"match in list", "admin", "admin,user,guest", true},
		{"no match in list", "superuser", "admin,user,guest", false},
		{"case insensitive", "ADMIN", "admin,user", true},
		{"with whitespace", " admin ", " admin , user ", true},
		{"single item match", "admin", "admin", true},
		{"empty expected", "admin", "", false},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			got := inComparison(tt.actual, tt.expected)
			if got != tt.want {
				t.Errorf("inComparison(%q, %q) = %v, want %v", tt.actual, tt.expected, got, tt.want)
			}
		})
	}
}

func TestEvaluatePolicy(t *testing.T) {
	tests := []struct {
		name            string
		policy          models.PolicyAttribute
		ctx             *models.AuthorizationContext
		wantSatisfied   bool
		wantReasonEmpty bool
	}{
		{
			name: "user attribute satisfied",
			policy: models.PolicyAttribute{
				AttributeType:  "user",
				AttributeName:  "department",
				Comparison:     "=",
				AttributeValue: "Engineering",
			},
			ctx: &models.AuthorizationContext{
				UserAttributes: map[string]string{"department": "Engineering"},
			},
			wantSatisfied:   true,
			wantReasonEmpty: true,
		},
		{
			name: "user attribute not satisfied",
			policy: models.PolicyAttribute{
				AttributeType:  "user",
				AttributeName:  "department",
				Comparison:     "=",
				AttributeValue: "HR",
			},
			ctx: &models.AuthorizationContext{
				UserAttributes: map[string]string{"department": "Engineering"},
			},
			wantSatisfied:   false,
			wantReasonEmpty: false,
		},
		{
			name: "user attribute not found",
			policy: models.PolicyAttribute{
				AttributeType:  "user",
				AttributeName:  "nonexistent",
				Comparison:     "=",
				AttributeValue: "value",
			},
			ctx: &models.AuthorizationContext{
				UserAttributes: map[string]string{},
			},
			wantSatisfied:   false,
			wantReasonEmpty: false,
		},
		{
			name: "resource attribute satisfied",
			policy: models.PolicyAttribute{
				AttributeType:  "resource",
				AttributeName:  "owner",
				Comparison:     "=",
				AttributeValue: "user123",
			},
			ctx: &models.AuthorizationContext{
				ResourceData: map[string]string{"owner": "user123"},
			},
			wantSatisfied:   true,
			wantReasonEmpty: true,
		},
		{
			name: "environment attribute satisfied",
			policy: models.PolicyAttribute{
				AttributeType:  "environment",
				AttributeName:  "location",
				Comparison:     "=",
				AttributeValue: "US",
			},
			ctx: &models.AuthorizationContext{
				Environment: map[string]string{"location": "US"},
			},
			wantSatisfied:   true,
			wantReasonEmpty: true,
		},
		{
			name: "unknown attribute type",
			policy: models.PolicyAttribute{
				AttributeType:  "unknown",
				AttributeName:  "attr",
				Comparison:     "=",
				AttributeValue: "value",
			},
			ctx:             &models.AuthorizationContext{},
			wantSatisfied:   false,
			wantReasonEmpty: false,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			satisfied, reason := evaluatePolicy(tt.policy, tt.ctx)

			if satisfied != tt.wantSatisfied {
				t.Errorf("evaluatePolicy() satisfied = %v, want %v", satisfied, tt.wantSatisfied)
			}

			if tt.wantReasonEmpty && reason != "" {
				t.Errorf("evaluatePolicy() reason = %q, want empty", reason)
			}

			if !tt.wantReasonEmpty && reason == "" {
				t.Errorf("evaluatePolicy() reason is empty, want non-empty")
			}
		})
	}
}

func TestEvaluatePolicies(t *testing.T) {
	tests := []struct {
		name            string
		policies        []models.PolicyAttribute
		ctx             *models.AuthorizationContext
		wantSatisfied   bool
		wantReasonEmpty bool
	}{
		{
			name:            "no policies returns true",
			policies:        []models.PolicyAttribute{},
			ctx:             &models.AuthorizationContext{},
			wantSatisfied:   true,
			wantReasonEmpty: false,
		},
		{
			name: "all policies satisfied",
			policies: []models.PolicyAttribute{
				{
					AttributeType:  "user",
					AttributeName:  "department",
					Comparison:     "=",
					AttributeValue: "Engineering",
				},
				{
					AttributeType:  "user",
					AttributeName:  "level",
					Comparison:     ">=",
					AttributeValue: "3",
				},
			},
			ctx: &models.AuthorizationContext{
				UserAttributes: map[string]string{
					"department": "Engineering",
					"level":      "5",
				},
			},
			wantSatisfied:   true,
			wantReasonEmpty: false,
		},
		{
			name: "one policy fails",
			policies: []models.PolicyAttribute{
				{
					AttributeType:  "user",
					AttributeName:  "department",
					Comparison:     "=",
					AttributeValue: "Engineering",
				},
				{
					AttributeType:  "user",
					AttributeName:  "level",
					Comparison:     ">=",
					AttributeValue: "5",
				},
			},
			ctx: &models.AuthorizationContext{
				UserAttributes: map[string]string{
					"department": "Engineering",
					"level":      "3",
				},
			},
			wantSatisfied:   false,
			wantReasonEmpty: false,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			satisfied, reason := EvaluatePolicies(tt.policies, tt.ctx)

			if satisfied != tt.wantSatisfied {
				t.Errorf("EvaluatePolicies() satisfied = %v, want %v", satisfied, tt.wantSatisfied)
			}

			if tt.wantReasonEmpty && reason != "" {
				t.Errorf("EvaluatePolicies() reason = %q, want empty", reason)
			}

			if !tt.wantReasonEmpty && reason == "" {
				t.Errorf("EvaluatePolicies() reason is empty, want non-empty")
			}
		})
	}
}