package roomserver

import "testing"

func TestACLMatching(t *testing.T) {
	no := false
	acl := aclContent{
		Allow:           []string{"*"},
		Deny:            []string{"evil.example", "*.bad.example", "spam?.example"},
		AllowIPLiterals: &no,
	}
	cases := map[string]bool{
		"good.example":          true,
		"GOOD.example":          true,
		"evil.example":          false,
		"EVIL.EXAMPLE":          false,
		"evil.example:8448":     false, // the port is not part of the match
		"a.bad.example":         false,
		"bad.example":           true, // "*.bad.example" needs a subdomain
		"spam1.example":         false,
		"spam12.example":        true,
		"1.2.3.4":               false,
		"[::1]:8448":            false,
		"notevil.example":       true,
		"evil.example.attacker": true,
	}
	for server, want := range cases {
		if got := aclAllows(acl, server); got != want {
			t.Errorf("aclAllows(%q) = %v, want %v", server, got, want)
		}
	}

	// An empty allow list allows nobody.
	if aclAllows(aclContent{}, "anyone.example") {
		t.Error("an ACL with no allow list let a server in")
	}
	// IP literals are allowed unless the ACL says otherwise.
	if !aclAllows(aclContent{Allow: []string{"*"}}, "1.2.3.4") {
		t.Error("an IP literal was refused by an ACL that does not mention them")
	}
}