package auth

import "testing"

func TestResolveStoreBinding(t *testing.T) {
	one := int64(4)
	// restricted single-store member, nil binding -> implied
	sc := NewStoreScope([]int64{4})
	got, ok := sc.ResolveStoreBinding(nil)
	if !ok || got == nil || *got != one {
		t.Fatalf("single-store nil: got=%v ok=%v", got, ok)
	}
	// in-scope explicit binding kept
	in := int64(4)
	got, ok = sc.ResolveStoreBinding(&in)
	if !ok || got == nil || *got != 4 {
		t.Fatalf("in-scope explicit: got=%v ok=%v", got, ok)
	}
	// out-of-scope explicit binding denied
	out := int64(1)
	if _, ok := sc.ResolveStoreBinding(&out); ok {
		t.Fatal("out-of-scope binding must be denied")
	}
	// platform-wide: passthrough
	pw := NewStoreScope(nil)
	got, ok = pw.ResolveStoreBinding(nil)
	if !ok || got != nil {
		t.Fatalf("platform-wide nil: got=%v ok=%v", got, ok)
	}
	// multi-store member with nil -> ambiguous, denied
	multi := NewStoreScope([]int64{4, 5})
	if _, ok := multi.ResolveStoreBinding(nil); ok {
		t.Fatal("multi-store nil binding should be denied")
	}
}