ZDDC/zddc/internal/zddc/acl_test.go

package zddc

import "testing"

func TestGlobMatch(t *testing.T) {
	cases := []struct {
		pattern string
		s       string
		want    bool
	}{
		// Literal (no wildcard)
		{"alice", "alice", true},
		{"alice", "bob", false},
		{"", "", true},
		{"", "x", false},

		// Lone wildcard
		{"*", "anything", true},
		{"*", "", true},

		// Prefix wildcard
		{"*@example.com", "@example.com", true},
		{"*.com", "example.com", true},
		{"*.com", "example.org", false},

		// Suffix wildcard
		{"alice*", "alice", true},
		{"alice*", "alice@example.com", true},
		{"alice*", "bob", false},

		// Middle wildcard
		{"a*b", "ab", true},
		{"a*b", "axxxb", true},
		{"a*b", "axxx", false},
		{"a*b", "xxxb", false},

		// Multiple wildcards
		{"*-*-*", "a-b-c", true},
		{"*-*-*", "ab-c", false},

		// Anchored: no implicit leading wildcard
		{"alice@*", "bob@example.com", false},
	}
	for _, tc := range cases {
		t.Run(tc.pattern+"|"+tc.s, func(t *testing.T) {
			if got := globMatch(tc.pattern, tc.s); got != tc.want {
				t.Errorf("globMatch(%q, %q) = %v, want %v", tc.pattern, tc.s, got, tc.want)
			}
		})
	}
}

func TestMatchesPattern(t *testing.T) {
	cases := []struct {
		pattern string
		email   string
		want    bool
	}{
		// Exact match
		{"alice@example.com", "alice@example.com", true},
		{"alice@example.com", "bob@example.com", false},

		// Wildcard local part, fixed domain
		{"*@example.com", "alice@example.com", true},
		{"*@example.com", "anyone@example.com", true},
		{"*@example.com", "alice@evil.com", false},

		// Fixed local part, wildcard domain
		{"alice@*", "alice@example.com", true},
		{"alice@*", "alice@evil.com", true},
		{"alice@*", "bob@example.com", false},

		// @-boundary respected: * in local part does not eat the @
		{"alice*", "alice@example.com", true}, // pattern has no @, matches against full email
		// But splitting on @ for both sides:
		{"*", "alice@example.com", true}, // lone * matches anything
		{"*@*", "alice@example.com", true},
		{"*@*", "no-at-sign", false}, // pattern has @, email doesn't

		// Pattern with @, email without
		{"alice@example.com", "alice", false},

		// Empty email: lone "*" should still match per docstring? Actually globMatch("*", "") = true
		// But MatchesPattern("*", "") splits "*" on @ → ["*"]. Then globMatch("*", "") = true.
		// The docstring says "matches any non-empty email" but the implementation matches empty too.
		// Document the actual behavior in the test.
		{"*", "", true},
	}
	for _, tc := range cases {
		t.Run(tc.pattern+"|"+tc.email, func(t *testing.T) {
			if got := MatchesPattern(tc.pattern, tc.email); got != tc.want {
				t.Errorf("MatchesPattern(%q, %q) = %v, want %v", tc.pattern, tc.email, got, tc.want)
			}
		})
	}
}

func TestAllowedAtLevel(t *testing.T) {
	cases := []struct {
		name        string
		level       ZddcFile
		email       string
		wantAllowed bool
		wantMatched bool
	}{
		{
			name:        "no rules: not matched",
			level:       ZddcFile{},
			email:       "alice@example.com",
			wantAllowed: false,
			wantMatched: false,
		},
		{
			name: "allow matched",
			level: ZddcFile{ACL: ACLRules{
				Permissions: map[string]string{"*@example.com": "rwcd"},
			}},
			email:       "alice@example.com",
			wantAllowed: true,
			wantMatched: true,
		},
		{
			name: "deny matched",
			level: ZddcFile{ACL: ACLRules{
				Permissions: map[string]string{"alice@example.com": ""},
			}},
			email:       "alice@example.com",
			wantAllowed: false,
			wantMatched: true,
		},
		{
			name: "deny wins over allow at the same level",
			level: ZddcFile{ACL: ACLRules{
				Permissions: map[string]string{
					"*@example.com":     "rwcd",
					"alice@example.com": "",
				},
			}},
			email:       "alice@example.com",
			wantAllowed: false,
			wantMatched: true,
		},
		{
			name: "neither rule matches",
			level: ZddcFile{ACL: ACLRules{
				Permissions: map[string]string{
					"*@example.com": "rwcd",
					"*@evil.com":    "",
				},
			}},
			email:       "carol@other.org",
			wantAllowed: false,
			wantMatched: false,
		},
	}
	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			gotAllowed, gotMatched := AllowedAtLevel(tc.level, tc.email)
			if gotAllowed != tc.wantAllowed || gotMatched != tc.wantMatched {
				t.Errorf("AllowedAtLevel(%v, %q) = (%v, %v), want (%v, %v)",
					tc.level, tc.email, gotAllowed, gotMatched, tc.wantAllowed, tc.wantMatched)
			}
		})
	}
}