suite: test serviceaccount
templates:
  - serviceaccount.yaml
  - deployment.yaml
tests:
  # =============================================================================
  # DEFAULT BEHAVIOR
  # =============================================================================

  - it: should create ServiceAccount by default
    template: serviceaccount.yaml
    asserts:
      - hasDocuments:
          count: 1
      - isKind:
          of: ServiceAccount
      - isAPIVersion:
          of: v1

  - it: should have auto-generated name by default
    template: serviceaccount.yaml
    asserts:
      - equal:
          path: metadata.name
          value: RELEASE-NAME-jellyfin

  - it: should use ServiceAccount in deployment by default
    template: deployment.yaml
    asserts:
      - equal:
          path: spec.template.spec.serviceAccountName
          value: RELEASE-NAME-jellyfin

  - it: should automount service account token by default
    template: deployment.yaml
    asserts:
      - equal:
          path: spec.template.spec.automountServiceAccountToken
          value: true

  # =============================================================================
  # CREATE CONFIGURATION
  # =============================================================================

  - it: should not create ServiceAccount when create is false
    template: serviceaccount.yaml
    set:
      serviceAccount.create: false
    asserts:
      - hasDocuments:
          count: 0

  - it: should use default ServiceAccount when create is false
    template: deployment.yaml
    set:
      serviceAccount.create: false
    asserts:
      - equal:
          path: spec.template.spec.serviceAccountName
          value: default

  - it: should create ServiceAccount when explicitly enabled
    template: serviceaccount.yaml
    set:
      serviceAccount.create: true
    asserts:
      - hasDocuments:
          count: 1

  # =============================================================================
  # CUSTOM NAME
  # =============================================================================

  - it: should use custom name when specified
    template: serviceaccount.yaml
    set:
      serviceAccount.name: my-custom-sa
    asserts:
      - equal:
          path: metadata.name
          value: my-custom-sa

  - it: should use custom name in deployment
    template: deployment.yaml
    set:
      serviceAccount.name: my-custom-sa
    asserts:
      - equal:
          path: spec.template.spec.serviceAccountName
          value: my-custom-sa

  - it: should use custom name when create is false
    template: deployment.yaml
    set:
      serviceAccount.create: false
      serviceAccount.name: existing-sa
    asserts:
      - equal:
          path: spec.template.spec.serviceAccountName
          value: existing-sa

  - it: should not create SA but use custom name when create is false
    template: serviceaccount.yaml
    set:
      serviceAccount.create: false
      serviceAccount.name: existing-external-sa
    asserts:
      - hasDocuments:
          count: 0

  # =============================================================================
  # ANNOTATIONS
  # =============================================================================

  - it: should not have annotations by default
    template: serviceaccount.yaml
    asserts:
      - isNull:
          path: metadata.annotations

  - it: should add custom annotations
    template: serviceaccount.yaml
    set:
      serviceAccount.annotations:
        eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/jellyfin-role
    asserts:
      - equal:
          path: metadata.annotations.eks\.amazonaws\.com/role-arn
          value: arn:aws:iam::123456789012:role/jellyfin-role

  - it: should support multiple annotations
    template: serviceaccount.yaml
    set:
      serviceAccount.annotations:
        annotation1: value1
        annotation2: value2
        annotation3: value3
    asserts:
      - equal:
          path: metadata.annotations.annotation1
          value: value1
      - equal:
          path: metadata.annotations.annotation2
          value: value2
      - equal:
          path: metadata.annotations.annotation3
          value: value3

  - it: should support GCP Workload Identity annotation
    template: serviceaccount.yaml
    set:
      serviceAccount.annotations:
        iam.gke.io/gcp-service-account: jellyfin@project-id.iam.gserviceaccount.com
    asserts:
      - equal:
          path: metadata.annotations.iam\.gke\.io/gcp-service-account
          value: jellyfin@project-id.iam.gserviceaccount.com

  - it: should support Azure Workload Identity annotation
    template: serviceaccount.yaml
    set:
      serviceAccount.annotations:
        azure.workload.identity/client-id: 12345678-1234-1234-1234-123456789012
    asserts:
      - equal:
          path: metadata.annotations.azure\.workload\.identity/client-id
          value: 12345678-1234-1234-1234-123456789012

  # =============================================================================
  # AUTOMOUNT CONFIGURATION
  # =============================================================================

  - it: should enable automount by default
    template: deployment.yaml
    asserts:
      - equal:
          path: spec.template.spec.automountServiceAccountToken
          value: true

  - it: should disable automount when set to false
    template: deployment.yaml
    set:
      serviceAccount.automount: false
    asserts:
      - equal:
          path: spec.template.spec.automountServiceAccountToken
          value: false

  - it: should explicitly enable automount when set to true
    template: deployment.yaml
    set:
      serviceAccount.automount: true
    asserts:
      - equal:
          path: spec.template.spec.automountServiceAccountToken
          value: true

  # =============================================================================
  # EDGE CASES
  # =============================================================================

  - it: should handle empty name gracefully (use auto-generated)
    template: serviceaccount.yaml
    set:
      serviceAccount.name: ""
    asserts:
      - equal:
          path: metadata.name
          value: RELEASE-NAME-jellyfin

  - it: should handle empty annotations object
    template: serviceaccount.yaml
    set:
      serviceAccount.annotations: {}
    asserts:
      - isNull:
          path: metadata.annotations

  - it: should work with custom name and annotations together
    template: serviceaccount.yaml
    set:
      serviceAccount.name: custom-sa
      serviceAccount.annotations:
        custom: annotation
    asserts:
      - equal:
          path: metadata.name
          value: custom-sa
      - equal:
          path: metadata.annotations.custom
          value: annotation

  - it: should work with all options combined
    template: serviceaccount.yaml
    set:
      serviceAccount.create: true
      serviceAccount.name: jellyfin-prod-sa
      serviceAccount.annotations:
        eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/jellyfin
        custom.io/annotation: value
    asserts:
      - equal:
          path: metadata.name
          value: jellyfin-prod-sa
      - equal:
          path: metadata.annotations.eks\.amazonaws\.com/role-arn
          value: arn:aws:iam::123456789012:role/jellyfin
      - equal:
          path: metadata.annotations.custom\.io/annotation
          value: value

  # =============================================================================
  # REGRESSION TESTS
  # =============================================================================

  - it: should always have correct labels
    template: serviceaccount.yaml
    asserts:
      - equal:
          path: metadata.labels.app\.kubernetes\.io/name
          value: jellyfin
      - equal:
          path: metadata.labels.app\.kubernetes\.io/instance
          value: RELEASE-NAME

  - it: should always use v1 API version
    template: serviceaccount.yaml
    asserts:
      - equal:
          path: apiVersion
          value: v1

  - it: should always be ServiceAccount kind
    template: serviceaccount.yaml
    asserts:
      - equal:
          path: kind
          value: ServiceAccount

  # Verify deployment always sets serviceAccountName
  - it: should always set serviceAccountName in deployment
    template: deployment.yaml
    asserts:
      - isNotNull:
          path: spec.template.spec.serviceAccountName

  - it: should always set automountServiceAccountToken in deployment
    template: deployment.yaml
    asserts:
      - isNotNull:
          path: spec.template.spec.automountServiceAccountToken

  # =============================================================================
  # INTEGRATION SCENARIOS
  # =============================================================================

  # Scenario: Using existing external ServiceAccount
  - it: should use existing external ServiceAccount without creating new one
    set:
      serviceAccount.create: false
      serviceAccount.name: external-jellyfin-sa
      serviceAccount.automount: false
    asserts:
      - template: serviceaccount.yaml
        hasDocuments:
          count: 0
      - template: deployment.yaml
        equal:
          path: spec.template.spec.serviceAccountName
          value: external-jellyfin-sa
      - template: deployment.yaml
        equal:
          path: spec.template.spec.automountServiceAccountToken
          value: false

  # Scenario: AWS IRSA (IAM Roles for Service Accounts)
  - it: should configure for AWS IRSA
    template: serviceaccount.yaml
    set:
      serviceAccount.create: true
      serviceAccount.name: jellyfin-irsa
      serviceAccount.annotations:
        eks.amazonaws.com/role-arn: arn:aws:iam::123456789012:role/jellyfin-s3-access
    asserts:
      - equal:
          path: metadata.name
          value: jellyfin-irsa
      - equal:
          path: metadata.annotations.eks\.amazonaws\.com/role-arn
          value: arn:aws:iam::123456789012:role/jellyfin-s3-access

  # Scenario: GCP Workload Identity
  - it: should configure for GCP Workload Identity
    template: serviceaccount.yaml
    set:
      serviceAccount.annotations:
        iam.gke.io/gcp-service-account: jellyfin@my-project.iam.gserviceaccount.com
    asserts:
      - equal:
          path: metadata.annotations.iam\.gke\.io/gcp-service-account
          value: jellyfin@my-project.iam.gserviceaccount.com

  # Scenario: Minimal security (no automount)
  - it: should support minimal security setup without token automount
    set:
      serviceAccount.create: true
      serviceAccount.automount: false
    asserts:
      - template: serviceaccount.yaml
        hasDocuments:
          count: 1
      - template: deployment.yaml
        equal:
          path: spec.template.spec.automountServiceAccountToken
          value: false