package resource

import (
	"testing"
)

func TestFullNameString(t *testing.T) {
	n := NewFullName("ns1", "l1")
	if n.String() != "ns1/l1" {
		t.Fatalf("unexpected name string: %v", n.String())
	}
}

func TestFullNameString_NoName(t *testing.T) {
	n := NewFullName("ns1", "")
	if n.String() != "ns1/" {
		t.Fatalf("unexpected name string: %v", n.String())
	}
}

				-A KUBE-SERVICES -m comment --comment "ns1/svc1:p80 cluster IP" -m tcp -p tcp -d 10.20.30.41 --dport 80 -j KUBE-SVC-XPGD46QRK7WJZT7O
				-A KUBE-SVC-XPGD46QRK7WJZT7O -m comment --comment "ns1/svc1:p80 cluster IP" -m tcp -p tcp -d 10.20.30.41 --dport 80 ! -s 10.0.0.0/24 -j KUBE-MARK-MASQ
				-A KUBE-SVC-XPGD46QRK7WJZT7O -m comment --comment ns1/svc1:p80 -j KUBE-SEP-SXIVWICOYRO3J4NJ

		{
			name: "unquoted comment",
			rule: `-A KUBE-SVC-XPGD46QRK7WJZT7O -m comment --comment ns1/svc1:p80 -j KUBE-SEP-SXIVWICOYRO3J4NJ`,
			parsed: &Rule{
				Raw:     `-A KUBE-SVC-XPGD46QRK7WJZT7O -m comment --comment ns1/svc1:p80 -j KUBE-SEP-SXIVWICOYRO3J4NJ`,
				Chain:   iptables.Chain("KUBE-SVC-XPGD46QRK7WJZT7O"),
				Comment: &IPTablesValue{Value: "ns1/svc1:p80"},
				Jump:    &IPTablesValue{Value: "KUBE-SEP-SXIVWICOYRO3J4NJ"},
			},
		},
		{

metadata:
  name: http1
  namespace: ns1
spec:
  host: http1.ns1.svc.cluster.local
  subsets:
  - name: v1
    labels:
      version: v1
  - name: v2
    labels:
      version: v2
---
apiVersion: networking.istio.io/v1alpha3
kind: VirtualService
metadata:
  name: http1
  namespace: ns1
spec:
  hosts:
  - http1.ns1.svc.cluster.local
  http:
  - route:

					ServiceAccount: "spiffe://cluster.local/ns/ns1/sa/scooby",
					TLSMode:        "istio",
					Namespace:      "ns1",
					Locality: model.Locality{
						ClusterID: cluster.ID(clusterID),
					},
				},
				DNSServiceEntryOnly: true,
			},
		},
		{
			name: "DNS address",
			wle: config.Config{
				Meta: config.Meta{
					Namespace: "ns1",
				},
				Spec: &networking.WorkloadEntry{

`
	namespaceContent = `
apiVersion: v1
kind: Namespace
metadata:
  name: ns1
`
	jsonpatchContent = `[
    {"op": "add", "path": "/spec/replica", "value": "3"}
]`

	expectedContent = `apiVersion: v1
kind: Namespace
metadata:
  annotations:
    note: This is a test annotation
  labels:
    app: nginx
  name: ns1
---
apiVersion: v1
data:
  DB_PASSWORD: somepw
  DB_USERNAME: admin

			steps: []step{
				{"add", "ns1", "secret1", "pod1"},
				{"add", "ns1", "secret1", "pod1"},
				{"delete", "ns1", "secret1", "pod1"},
				{"delete", "ns1", "secret1", "pod1"},
			},
			expects: []expect{
				{"ns1", "secret1", "pod1", 1},
				{"ns1", "secret1", "pod1", 2},
				{"ns1", "secret1", "pod1", 1},
				{"ns1", "secret1", "pod1", 0},
			},
		},
		{

	s.AssertEmpty(t, time.Millisecond*10)

	ns1.Annotations = map[string]string{"foo": "bar"}
	ns.Update(ns1)
	s.AssertEmpty(t, time.Millisecond*10)

	ns2.Annotations = map[string]string{"foo": "bar"}
	ns.Update(ns2)
	s.AssertEmpty(t, time.Millisecond*10)

	ns1.Labels["bar"] = "foo"
	ns.Update(ns1)
	s.AssertEmpty(t, time.Millisecond*10)

	ns2.Labels["foo"] = "bar"
	ns.Update(ns2)

					}
				})
		})
}

func TestAuthz_Namespace(t *testing.T) {
	framework.NewTest(t).
		Run(func(t framework.TestContext) {
			// Allow anything from ns1. Any service in ns1 will work as the `from` (just using ns1.A)
			allowed := apps.Ns1.A
			denied := apps.Ns2.A

			from := allowed.Append(denied)
			fromMatch := match.AnyServiceName(from.NamespacedNames())
			toMatch := match.Not(fromMatch)

kind: Sidecar
metadata:
  name: no-selector # Since this is the only Sidecar in the namespace without a workload selector, no conflict
  namespace: ns1
spec:
  egress:
  - hosts:
    - "./*"
---
apiVersion: networking.istio.io/v1alpha3
kind: Sidecar
metadata:
  name: has-selector
  namespace: ns1
spec:
  workloadSelector: # Since this has a workload selector, it shouldn't conflict with the other Sidecar in the namespace
    labels: