package api

import (
	"context"
	"os"
	"path/filepath"
	"testing"

	"chfs-ng/internal/auth"
	"github.com/emersion/go-webdav"
)

func TestWebDAVAuthFSCheckTree(t *testing.T) {
	root := t.TempDir()
	if err := os.MkdirAll(filepath.Join(root, "test", "private"), 0o755); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(filepath.Join(root, "test", "public.txt"), []byte("public"), 0o644); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(filepath.Join(root, "test", "private", "secret.txt"), []byte("secret"), 0o644); err != nil {
		t.Fatal(err)
	}

	account := &auth.Account{Mask: auth.Delete, Rules: []auth.PathRule{
		{Dir: "test", Mask: auth.Delete},
		{Dir: "test/private", Mask: auth.None},
	}}
	fs := &webdavAuthFS{inner: webdav.LocalFileSystem(root), account: account}

	if err := fs.checkTree(context.Background(), "/test", auth.Delete); err == nil {
		t.Fatal("expected recursive delete permission check to reject inaccessible descendant")
	}
	if err := fs.checkTree(context.Background(), "/test/public.txt", auth.Delete); err != nil {
		t.Fatalf("public file should be deletable: %v", err)
	}
}