OrchestrAD/backend/internal/rules/engine/reconcile_test.go

package engine

import (
	"encoding/json"
	"sort"
	"testing"

	"github.com/Grace-Solutions/OrchestrAD/internal/logging"
	"github.com/Grace-Solutions/OrchestrAD/internal/models"
	"github.com/Grace-Solutions/OrchestrAD/internal/types"
)

// fakeClient is an in-memory membershipClient for reconciliation tests.
type fakeClient struct {
	members map[string][]string // groupDN -> member DNs
	exists  map[string]bool
	created []string
}

func (f *fakeClient) Exists(dn string) (bool, error) { return f.exists[dn], nil }
func (f *fakeClient) GetGroupMembers(groupDN string) ([]string, error) {
	return append([]string(nil), f.members[groupDN]...), nil
}
func (f *fakeClient) AddGroupMember(groupDN, memberDN string) error {
	f.members[groupDN] = append(f.members[groupDN], memberDN)
	return nil
}
func (f *fakeClient) RemoveGroupMember(groupDN, memberDN string) error {
	cur := f.members[groupDN]
	out := cur[:0]
	for _, m := range cur {
		if m != memberDN {
			out = append(out, m)
		}
	}
	f.members[groupDN] = out
	return nil
}
func (f *fakeClient) CreateGroup(groupDN, groupType, groupScope string) error {
	f.created = append(f.created, groupDN)
	f.exists[groupDN] = true
	f.members[groupDN] = nil
	return nil
}
func (f *fakeClient) EnsureOUPath(ouDN string) error { return nil }

// fakeStore is an in-memory ManagedMemberStore.
type fakeStore struct {
	m map[string]map[string]bool // ruleID|groupDN -> set of member DNs
}

func newFakeStore() *fakeStore                         { return &fakeStore{m: map[string]map[string]bool{}} }
func (s *fakeStore) key(ruleID, groupDN string) string { return ruleID + "|" + groupDN }
func (s *fakeStore) List(ruleID, groupDN string) ([]string, error) {
	var out []string
	for dn := range s.m[s.key(ruleID, groupDN)] {
		out = append(out, dn)
	}
	return out, nil
}
func (s *fakeStore) Add(ruleID, groupDN, memberDN string) error {
	k := s.key(ruleID, groupDN)
	if s.m[k] == nil {
		s.m[k] = map[string]bool{}
	}
	s.m[k][memberDN] = true
	return nil
}
func (s *fakeStore) Remove(ruleID, groupDN, memberDN string) error {
	delete(s.m[s.key(ruleID, groupDN)], memberDN)
	return nil
}

func syncAction(t *testing.T, group, mode string, createIfMissing bool) *models.RuleAction {
	t.Helper()
	cfg := models.ActionConfig{TargetGroupDN: group, SyncMode: mode, CreateIfMissing: createIfMissing}
	b, err := json.Marshal(cfg)
	if err != nil {
		t.Fatalf("marshal cfg: %v", err)
	}
	return &models.RuleAction{ID: "action-1", ActionType: string(types.ActionSyncGroupMembership), ConfigurationJSON: string(b), IsEnabled: true}
}

func sortedMembers(f *fakeClient, group string) []string {
	out := append([]string(nil), f.members[group]...)
	sort.Strings(out)
	return out
}

const grp = "CN=Dyn,OU=Groups,DC=x,DC=y"

func TestReconcileFullSync(t *testing.T) {
	eng := NewEngine(logging.Default())
	f := &fakeClient{
		members: map[string][]string{grp: {"CN=A,DC=x,DC=y", "CN=B,DC=x,DC=y", "CN=X,DC=x,DC=y"}},
		exists:  map[string]bool{grp: true},
	}
	rule := &models.Rule{ID: "rule-1"}
	matched := []string{"CN=A,DC=x,DC=y", "CN=B,DC=x,DC=y", "CN=C,DC=x,DC=y"}

	results := eng.reconcileMembership(syncAction(t, grp, string(types.SyncModeFull), false), rule, matched, f, newFakeStore())

	// Expect: add C, remove X.
	if got := sortedMembers(f, grp); len(got) != 3 || got[0] != "CN=A,DC=x,DC=y" || got[1] != "CN=B,DC=x,DC=y" || got[2] != "CN=C,DC=x,DC=y" {
		t.Fatalf("full sync membership wrong: %v", got)
	}
	var adds, removes int
	for _, r := range results {
		if !r.Success {
			t.Errorf("unexpected failure: %+v", r)
		}
		switch r.ActionType {
		case string(types.ActionAddToGroup):
			adds++
		case string(types.ActionRemoveFromGroupIfNoMatch):
			removes++
		}
	}
	if adds != 1 || removes != 1 {
		t.Errorf("expected 1 add / 1 remove, got %d / %d", adds, removes)
	}
}

func TestReconcileManagedAddLeavesManualMembers(t *testing.T) {
	eng := NewEngine(logging.Default())
	f := &fakeClient{
		members: map[string][]string{grp: {"CN=B,DC=x,DC=y", "CN=X,DC=x,DC=y", "CN=Manual,DC=x,DC=y"}},
		exists:  map[string]bool{grp: true},
	}
	store := newFakeStore()
	// The rule previously added B and X.
	_ = store.Add("rule-1", grp, "CN=B,DC=x,DC=y")
	_ = store.Add("rule-1", grp, "CN=X,DC=x,DC=y")
	rule := &models.Rule{ID: "rule-1"}
	matched := []string{"CN=B,DC=x,DC=y"} // X no longer matches; Manual was never managed

	eng.reconcileMembership(syncAction(t, grp, string(types.SyncModeManaged), false), rule, matched, f, store)

	got := sortedMembers(f, grp)
	// B stays (matched), X removed (managed + unmatched), Manual stays (not managed).
	if len(got) != 2 || got[0] != "CN=B,DC=x,DC=y" || got[1] != "CN=Manual,DC=x,DC=y" {
		t.Fatalf("managed sync membership wrong: %v", got)
	}
}

func TestReconcileAddOnlyNeverRemoves(t *testing.T) {
	eng := NewEngine(logging.Default())
	f := &fakeClient{
		members: map[string][]string{grp: {"CN=Stale,DC=x,DC=y"}},
		exists:  map[string]bool{grp: true},
	}
	rule := &models.Rule{ID: "rule-1"}
	matched := []string{"CN=A,DC=x,DC=y"}

	eng.reconcileMembership(syncAction(t, grp, string(types.SyncModeAddOnly), false), rule, matched, f, newFakeStore())

	got := sortedMembers(f, grp)
	if len(got) != 2 || got[0] != "CN=A,DC=x,DC=y" || got[1] != "CN=Stale,DC=x,DC=y" {
		t.Fatalf("add-only membership wrong: %v", got)
	}
}

func TestReconcileCreatesMissingGroup(t *testing.T) {
	eng := NewEngine(logging.Default())
	f := &fakeClient{members: map[string][]string{}, exists: map[string]bool{}}
	rule := &models.Rule{ID: "rule-1"}
	matched := []string{"CN=A,DC=x,DC=y"}

	results := eng.reconcileMembership(syncAction(t, grp, string(types.SyncModeFull), true), rule, matched, f, newFakeStore())

	if len(f.created) != 1 || f.created[0] != grp {
		t.Fatalf("expected group to be created, created=%v", f.created)
	}
	if got := sortedMembers(f, grp); len(got) != 1 || got[0] != "CN=A,DC=x,DC=y" {
		t.Fatalf("membership after create wrong: %v", got)
	}
	var sawCreate bool
	for _, r := range results {
		if r.ActionType == string(types.ActionEnsureGroupExists) {
			sawCreate = true
		}
	}
	if !sawCreate {
		t.Errorf("expected an EnsureGroupExists result")
	}
}

func TestReconcileMissingGroupNoCreateFails(t *testing.T) {
	eng := NewEngine(logging.Default())
	f := &fakeClient{members: map[string][]string{}, exists: map[string]bool{}}
	rule := &models.Rule{ID: "rule-1"}

	results := eng.reconcileMembership(syncAction(t, grp, string(types.SyncModeFull), false), rule, []string{"CN=A,DC=x,DC=y"}, f, newFakeStore())
	if len(results) != 1 || results[0].Success {
		t.Fatalf("expected a single failure result, got %+v", results)
	}
}