package store

import "testing"

func TestFilterAccessRulesBySubjectTypeExcludesAPIKeyRulesOnly(t *testing.T) {
	rules := []AccessRule{
		{ID: "api-key-allow", SubjectType: "api_key", Effect: "allow"},
		{ID: "api-key-deny", SubjectType: "api_key", Effect: "deny"},
		{ID: "user-group-allow", SubjectType: "user_group", Effect: "allow"},
		{ID: "user-deny", SubjectType: "user", Effect: "deny"},
		{ID: "tenant-allow", SubjectType: "tenant", Effect: "allow"},
	}

	filtered := filterAccessRulesBySubjectType(rules, map[string]bool{"api_key": true})
	if len(filtered) != 3 {
		t.Fatalf("filtered rule count = %d, want 3: %+v", len(filtered), filtered)
	}
	for _, rule := range filtered {
		if rule.SubjectType == "api_key" {
			t.Fatalf("api-key rule should not affect the owning user's assignable resources: %+v", rule)
		}
	}
}