package matching

import "testing"

// TestClampMaxCandidates proves the slate candidate cap is bounded on both ends: a non positive request
// defaults, an in range request passes through, and an oversized or hostile request is clamped to the hard
// bound so a single slate generation can never balloon the transaction or the member count. A stress finding
// motivated this: MaxCandidates had no upper clamp.
func TestClampMaxCandidates(t *testing.T) {
	cases := []struct{ in, want int32 }{
		{0, defaultMaxCandidates},
		{-1, defaultMaxCandidates},
		{-1000000, defaultMaxCandidates},
		{1, 1},
		{499, 499},
		{defaultMaxCandidates, defaultMaxCandidates},
		{maxSlateCandidates, maxSlateCandidates},
		{maxSlateCandidates + 1, maxSlateCandidates},
		{1000000, maxSlateCandidates},
	}
	for _, c := range cases {
		if got := clampMaxCandidates(c.in); got != c.want {
			t.Errorf("clampMaxCandidates(%d) = %d, want %d", c.in, got, c.want)
		}
	}
}