package waf

import (
	"testing"
	"time"

	"git.netcell-it.de/projekte/edgeguard-native/internal/models"
)

func TestMergeProfileExclusions(t *testing.T) {
	base := time.Date(2026, 8, 3, 10, 0, 0, 0, time.UTC)
	newer := base.Add(1 * time.Hour)
	profiles := map[string]models.WafAppProfile{
		"nc": {Name: "nc", RuleExclusions: []string{"942100", "920420"}, UpdatedAt: newer},
		"wp": {Name: "wp", RuleExclusions: []string{"942100", "941100"}, UpdatedAt: base},
	}

	t.Run("keine Profile → unverändert", func(t *testing.T) {
		got, ts := mergeProfileExclusions([]string{"1000"}, base, nil, profiles)
		if len(got) != 1 || got[0] != "1000" || !ts.Equal(base) {
			t.Fatalf("got=%v ts=%v", got, ts)
		}
	})

	t.Run("union dedupliziert, Reihenfolge stabil", func(t *testing.T) {
		got, ts := mergeProfileExclusions([]string{"942100", "900001"}, base, []string{"nc", "wp"}, profiles)
		want := []string{"942100", "900001", "920420", "941100"} // 942100 nicht doppelt
		if len(got) != len(want) {
			t.Fatalf("got=%v want=%v", got, want)
		}
		for i := range want {
			if got[i] != want[i] {
				t.Fatalf("got=%v want=%v", got, want)
			}
		}
		// effektives updated_at = max(base, nc.newer) = newer
		if !ts.Equal(newer) {
			t.Fatalf("ts=%v want=%v (Profil-Edit muss Rebuild ausloesen)", ts, newer)
		}
	})

	t.Run("unbekanntes Profil defensiv ignoriert", func(t *testing.T) {
		got, ts := mergeProfileExclusions([]string{"1000"}, base, []string{"gibtsnicht"}, profiles)
		if len(got) != 1 || got[0] != "1000" || !ts.Equal(base) {
			t.Fatalf("got=%v ts=%v", got, ts)
		}
	})
}