/*
 *
 *    Copyright (c) 2021 Project CHIP Authors
 *    All rights reserved.
 *
 *    Licensed under the Apache License, Version 2.0 (the "License");
 *    you may not use this file except in compliance with the License.
 *    You may obtain a copy of the License at
 *
 *        http://www.apache.org/licenses/LICENSE-2.0
 *
 *    Unless required by applicable law or agreed to in writing, software
 *    distributed under the License is distributed on an "AS IS" BASIS,
 *    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 *    See the License for the specific language governing permissions and
 *    limitations under the License.
 */

#include "access/AccessControl.h"
#include "access/examples/ExampleAccessControlDelegate.h"
#include "access/examples/GroupAuxiliaryAccessControlDelegateImpl.h"
#include <credentials/FabricTable.h>
#include <credentials/GroupDataProvider.h>
#include <credentials/GroupDataProviderImpl.h>
#include <credentials/PersistentStorageOpCertStore.h>
#include <credentials/tests/CHIPCert_unit_test_vectors.h>
#include <crypto/PersistentStorageOperationalKeystore.h>
#include <lib/core/Optional.h>
#include <set>

#include <pw_unit_test/framework.h>

#include <crypto/DefaultSessionKeystore.h>
#include <lib/core/CHIPCore.h>
#include <lib/core/StringBuilderAdapters.h>
#include <lib/support/CHIPMem.h>
#include <lib/support/TestPersistentStorageDelegate.h>
#include <lib/support/tests/ExtraPwTestMacros.h>

namespace {

constexpr uint16_t kMaxGroupsPerFabric    = 5;
constexpr uint16_t kMaxGroupKeysPerFabric = 8;

chip::TestPersistentStorageDelegate gTestStorage;
chip::Crypto::DefaultSessionKeystore gSessionKeystore;
chip::Credentials::GroupDataProviderImpl gGroupsProvider(kMaxGroupsPerFabric, kMaxGroupKeysPerFabric);

chip::Access::Examples::GroupAuxiliaryAccessControlDelegateImpl gGroupAuxiliaryAccessControlDelegate;

} // namespace

namespace chip {
namespace Access {

using namespace chip;
using namespace chip::Access;

using Entry         = AccessControl::Entry;
using EntryIterator = AccessControl::EntryIterator;
using Target        = Entry::Target;

AccessControl accessControl;

constexpr ClusterId kOnOffCluster         = 0x0000'0006;
constexpr ClusterId kLevelControlCluster  = 0x0000'0008;
constexpr ClusterId kAccessControlCluster = 0x0000'001F;
constexpr ClusterId kColorControlCluster  = 0x0000'0300;

constexpr NodeId kPaseVerifier0 = NodeIdFromPAKEKeyId(0x0000);
constexpr NodeId kPaseVerifier1 = NodeIdFromPAKEKeyId(0x0001);
constexpr NodeId kPaseVerifier3 = NodeIdFromPAKEKeyId(0x0003);

constexpr NodeId kOperationalNodeId0 = 0x0123456789ABCDEF;
constexpr NodeId kOperationalNodeId1 = 0x1234567812345678;
constexpr NodeId kOperationalNodeId2 = 0x1122334455667788;
constexpr NodeId kOperationalNodeId3 = 0x1111111111111111;
constexpr NodeId kOperationalNodeId4 = 0x2222222222222222;
constexpr NodeId kOperationalNodeId5 = 0x3333333333333333;

constexpr CASEAuthTag kCASEAuthTag0 = 0x0001'0001;
constexpr CASEAuthTag kCASEAuthTag1 = 0x0002'0001;
constexpr CASEAuthTag kCASEAuthTag2 = 0xABCD'0002;
constexpr CASEAuthTag kCASEAuthTag3 = 0xABCD'0008;
constexpr CASEAuthTag kCASEAuthTag4 = 0xABCD'ABCD;

constexpr NodeId kCASEAuthTagAsNodeId0 = NodeIdFromCASEAuthTag(kCASEAuthTag0);
constexpr NodeId kCASEAuthTagAsNodeId1 = NodeIdFromCASEAuthTag(kCASEAuthTag1);
constexpr NodeId kCASEAuthTagAsNodeId2 = NodeIdFromCASEAuthTag(kCASEAuthTag2);
constexpr NodeId kCASEAuthTagAsNodeId3 = NodeIdFromCASEAuthTag(kCASEAuthTag3);
constexpr NodeId kCASEAuthTagAsNodeId4 = NodeIdFromCASEAuthTag(kCASEAuthTag4);

constexpr NodeId kGroup2 = NodeIdFromGroupId(0x0002);
constexpr NodeId kGroup4 = NodeIdFromGroupId(0x0004);
constexpr NodeId kGroup6 = NodeIdFromGroupId(0x0006);
constexpr NodeId kGroup8 = NodeIdFromGroupId(0x0008);

constexpr AuthMode authModes[] = { AuthMode::kCase, AuthMode::kGroup };

constexpr FabricIndex fabricIndexes[] = { 1, 2, 3 };

constexpr Privilege privileges[] = { Privilege::kView, Privilege::kProxyView, Privilege::kOperate, Privilege::kManage,
                                     Privilege::kAdminister };

constexpr NodeId subjects[][3] = { {
                                       kOperationalNodeId0,
                                       kCASEAuthTagAsNodeId1,
                                       kCASEAuthTagAsNodeId2,
                                   },
                                   {
                                       kGroup4,
                                       kGroup6,
                                       kGroup8,
                                   } };

constexpr Target targets[] = {
    { .flags = Target::kCluster, .cluster = kOnOffCluster },
    { .flags = Target::kEndpoint, .endpoint = 3 },
    { .flags = Target::kCluster | Target::kEndpoint, .cluster = kLevelControlCluster, .endpoint = 5 },
};

constexpr FabricIndex invalidFabricIndexes[] = { kUndefinedFabricIndex };

// clang-format off
constexpr NodeId validCaseSubjects[] = {
    0x0000'0000'0000'0001, // min operational
    0x0000'0000'0000'0002,
    0x0123'4567'89AB'CDEF,
    0xFFFF'FFEF'FFFF'FFFE,
    0xFFFF'FFEF'FFFF'FFFF, // max operational

    NodeIdFromCASEAuthTag(0x0000'0001),
    NodeIdFromCASEAuthTag(0x0000'0002),
    NodeIdFromCASEAuthTag(0x0000'FFFE),
    NodeIdFromCASEAuthTag(0x0000'FFFF),

    NodeIdFromCASEAuthTag(0x0001'0001),
    NodeIdFromCASEAuthTag(0x0001'0002),
    NodeIdFromCASEAuthTag(0x0001'FFFE),
    NodeIdFromCASEAuthTag(0x0001'FFFF),

    NodeIdFromCASEAuthTag(0xFFFE'0001),
    NodeIdFromCASEAuthTag(0xFFFE'0002),
    NodeIdFromCASEAuthTag(0xFFFE'FFFE),
    NodeIdFromCASEAuthTag(0xFFFE'FFFF),

    NodeIdFromCASEAuthTag(0xFFFF'0001),
    NodeIdFromCASEAuthTag(0xFFFF'0002),
    NodeIdFromCASEAuthTag(0xFFFF'FFFE),
    NodeIdFromCASEAuthTag(0xFFFF'FFFF),
};
// clang-format on

// clang-format off
constexpr NodeId validGroupSubjects[] = {
    NodeIdFromGroupId(0x0001), // start of fabric-scoped
    NodeIdFromGroupId(0x0002),
    NodeIdFromGroupId(0x7FFE),
    NodeIdFromGroupId(0x7FFF), // end of fabric-scoped
    NodeIdFromGroupId(0x8000), // start of universal
    NodeIdFromGroupId(0x8001),
    NodeIdFromGroupId(0xFFFB),
    NodeIdFromGroupId(0xFFFC), // end of universal
    NodeIdFromGroupId(0xFFFD), // all proxies
    NodeIdFromGroupId(0xFFFE), // all non sleepy
    NodeIdFromGroupId(0xFFFF), // all nodes
};
// clang-format on

// clang-format off
constexpr NodeId validPaseSubjects[] = {
    NodeIdFromPAKEKeyId(0x0000), // start
    NodeIdFromPAKEKeyId(0x0001),
    NodeIdFromPAKEKeyId(0xFFFE),
    NodeIdFromPAKEKeyId(0xFFFF), // end
};
// clang-format on

// clang-format off
constexpr NodeId invalidSubjects[] = {
    0x0000'0000'0000'0000, // unspecified

    0xFFFF'FFF0'0000'0000, // start reserved
    0xFFFF'FFF0'0000'0001,
    0xFFFF'FFF0'FFFF'FFFE,
    0xFFFF'FFF0'FFFF'FFFF, // end reserved

    0xFFFF'FFF1'0000'0000, // start reserved
    0xFFFF'FFF1'0000'0001,
    0xFFFF'FFF1'FFFF'FFFE,
    0xFFFF'FFF1'FFFF'FFFF, // end reserved

    0xFFFF'FFF2'0000'0000, // start reserved
    0xFFFF'FFF2'0000'0001,
    0xFFFF'FFF2'FFFF'FFFE,
    0xFFFF'FFF2'FFFF'FFFF, // end reserved

    0xFFFF'FFF3'0000'0000, // start reserved
    0xFFFF'FFF3'0000'0001,
    0xFFFF'FFF3'FFFF'FFFE,
    0xFFFF'FFF3'FFFF'FFFF, // end reserved

    0xFFFF'FFF4'0000'0000, // start reserved
    0xFFFF'FFF4'0000'0001,
    0xFFFF'FFF4'FFFF'FFFE,
    0xFFFF'FFF4'FFFF'FFFF, // end reserved

    0xFFFF'FFF5'0000'0000, // start reserved
    0xFFFF'FFF5'0000'0001,
    0xFFFF'FFF5'FFFF'FFFE,
    0xFFFF'FFF5'FFFF'FFFF, // end reserved

    0xFFFF'FFF6'0000'0000, // start reserved
    0xFFFF'FFF6'0000'0001,
    0xFFFF'FFF6'FFFF'FFFE,
    0xFFFF'FFF6'FFFF'FFFF, // end reserved

    0xFFFF'FFF7'0000'0000, // start reserved
    0xFFFF'FFF7'0000'0001,
    0xFFFF'FFF7'FFFF'FFFE,
    0xFFFF'FFF7'FFFF'FFFF, // end reserved

    0xFFFF'FFF8'0000'0000, // start reserved
    0xFFFF'FFF8'0000'0001,
    0xFFFF'FFF8'FFFF'FFFE,
    0xFFFF'FFF8'FFFF'FFFF, // end reserved

    0xFFFF'FFF9'0000'0000, // start reserved
    0xFFFF'FFF9'0000'0001,
    0xFFFF'FFF9'FFFF'FFFE,
    0xFFFF'FFF9'FFFF'FFFF, // end reserved

    0xFFFF'FFFA'0000'0000, // start reserved
    0xFFFF'FFFA'0000'0001,
    0xFFFF'FFFA'FFFF'FFFE,
    0xFFFF'FFFA'FFFF'FFFF, // end reserved

    0xFFFF'FFFB'0001'0000, // PASE with unused bits used
    0xFFFF'FFFB'0001'0001, // PASE with unused bits used
    0xFFFF'FFFB'0001'FFFE, // PASE with unused bits used
    0xFFFF'FFFB'0001'FFFF, // PASE with unused bits used

    0xFFFF'FFFB'FFFE'0000, // PASE with unused bits used
    0xFFFF'FFFB'FFFE'0001, // PASE with unused bits used
    0xFFFF'FFFB'FFFE'FFFE, // PASE with unused bits used
    0xFFFF'FFFB'FFFE'FFFF, // PASE with unused bits used

    0xFFFF'FFFB'FFFF'0000, // PASE with unused bits used
    0xFFFF'FFFB'FFFF'0001, // PASE with unused bits used
    0xFFFF'FFFB'FFFF'FFFE, // PASE with unused bits used
    0xFFFF'FFFB'FFFF'FFFF, // PASE with unused bits used

    0xFFFF'FFFC'0000'0000, // start reserved
    0xFFFF'FFFC'0000'0001,
    0xFFFF'FFFC'FFFF'FFFE,
    0xFFFF'FFFC'FFFF'FFFF, // end reserved

    0xFFFF'FFFD'0000'0000, // CAT with version 0
    0xFFFF'FFFD'0001'0000, // CAT with version 0
    0xFFFF'FFFD'FFFE'0000, // CAT with version 0
    0xFFFF'FFFD'FFFF'0000, // CAT with version 0

    0xFFFF'FFFE'0000'0000, // start temporary local
    0xFFFF'FFFE'0000'0001,
    0xFFFF'FFFE'FFFF'FFFE,
    0xFFFF'FFFE'FFFF'FFFF, // end temporary local (used for placeholder)

    0xFFFF'FFFF'0000'0000, // start reserved
    0xFFFF'FFFF'0000'0001,
    0xFFFF'FFFF'FFFE'FFFE,
    0xFFFF'FFFF'FFFE'FFFF, // end reserved

    0xFFFF'FFFF'FFFF'0000, // group 0
};
// clang-format on

// clang-format off
constexpr ClusterId validClusters[] = {
    0x0000'0000, // start std
    0x0000'0001,
    0x0000'7FFE,
    0x0000'7FFF, // end std

    0x0001'FC00, // start MS
    0x0001'FC01,
    0x0001'FFFD,
    0x0001'FFFE, // end MS

    0xFFF1'FC00, // start MS
    0xFFF1'FC01,
    0xFFF1'FFFD,
    0xFFF1'FFFE, // end MS

    0xFFF4'FC00, // start MS
    0xFFF4'FC01,
    0xFFF4'FFFD,
    0xFFF4'FFFE, // end MS
};
// clang-format on

// clang-format off
constexpr ClusterId invalidClusters[] = {
    0x0000'8000, // start unused
    0x0000'8001,
    0x0000'FBFE,
    0x0000'FBFF, // end unused
    0x0000'FC00, // start MS
    0x0000'FC01,
    0x0000'FFFD,
    0x0000'FFFE, // end MS
    0x0000'FFFF, // wildcard

    0x0001'0000, // start std
    0x0001'0001,
    0x0001'7FFE,
    0x0001'7FFF, // end std
    0x0001'8000, // start unused
    0x0001'8001,
    0x0001'FBFE,
    0x0001'FBFF, // end unused
    0x0001'FFFF, // wildcard

    0xFFF4'0000, // start std
    0xFFF4'0001,
    0xFFF4'7FFE,
    0xFFF4'7FFF, // end std
    0xFFF4'8000, // start unused
    0xFFF4'8001,
    0xFFF4'FBFE,
    0xFFF4'FBFF, // end unused
    0xFFF4'FFFF, // wildcard

    0xFFFD'0000, // start std
    0xFFFD'0001,
    0xFFFD'7FFE,
    0xFFFD'7FFF, // end std
    0xFFFD'8000, // start unused
    0xFFFD'8001,
    0xFFFD'FBFE,
    0xFFFD'FBFF, // end unused
    0xFFFD'FC00, // start MS
    0xFFFD'FC01,
    0xFFFD'FFFD,
    0xFFFD'FFFE, // end MS
    0xFFFD'FFFF, // wildcard

    0xFFFE'0000, // start std
    0xFFFE'0001,
    0xFFFE'7FFE,
    0xFFFE'7FFF, // end std
    0xFFFE'8000, // start unused
    0xFFFE'8001,
    0xFFFE'FBFE,
    0xFFFE'FBFF, // end unused
    0xFFFE'FC00, // start MS
    0xFFFE'FC01,
    0xFFFE'FFFD,
    0xFFFE'FFFE, // end MS
    0xFFFE'FFFF, // wildcard

    0xFFFF'0000, // start std
    0xFFFF'0001,
    0xFFFF'7FFE,
    0xFFFF'7FFF, // end std
    0xFFFF'8000, // start unused
    0xFFFF'8001,
    0xFFFF'FBFE,
    0xFFFF'FBFF, // end unused
    0xFFFF'FC00, // start MS
    0xFFFF'FC01,
    0xFFFF'FFFD,
    0xFFFF'FFFE, // end MS
    0xFFFF'FFFF, // wildcard
};
// clang-format on

// clang-format off
constexpr EndpointId validEndpoints[] = {
    0x0000, // start
    0x0001,
    0xFFFD,
    0xFFFE, // end
};
// clang-format on

// clang-format off
constexpr EndpointId invalidEndpoints[] = {
    kInvalidEndpointId
};
// clang-format on

// clang-format off
constexpr DeviceTypeId validDeviceTypes[] = {
    0x0000'0000, // start
    0x0000'0001,
    0x0000'BFFE,
    0x0000'BFFF, // end

    0x0001'0000, // start
    0x0001'0001,
    0x0001'BFFE,
    0x0001'BFFF, // end

    0xFFFD'0000, // start
    0xFFFD'0001,
    0xFFFD'BFFE,
    0xFFFD'BFFF, // end

    0xFFFE'0000, // start
    0xFFFE'0001,
    0xFFFE'BFFE,
    0xFFFE'BFFF, // end
};
// clang-format on

// clang-format off
constexpr DeviceTypeId invalidDeviceTypes[] = {
    0x0000'C000, // start unused
    0x0000'C001,
    0x0000'FFFD,
    0x0000'FFFE, // end unused
    0x0000'FFFF, // wildcard

    0x0001'C000, // start unused
    0x0001'C001,
    0x0001'FFFD,
    0x0001'FFFE, // end unused
    0x0001'FFFF, // wildcard

    0xFFFE'C000, // start unused
    0xFFFE'C001,
    0xFFFE'FFFD,
    0xFFFE'FFFE, // end unused
    0xFFFE'FFFF, // wildcard

    0xFFFF'0000, // start used
    0xFFFF'0001,
    0xFFFF'BFFE,
    0xFFFF'BFFF, // end used
    0xFFFF'C000, // start unused
    0xFFFF'C001,
    0xFFFF'FFFD,
    0xFFFF'FFFE, // end unused
    0xFFFF'FFFF, // wildcard
};
// clang-format on

class DeviceTypeResolver : public AccessControl::DeviceTypeResolver
{
public:
    bool IsDeviceTypeOnEndpoint(DeviceTypeId deviceType, EndpointId endpoint) override { return false; }
} testDeviceTypeResolver;

// For testing, supports one subject and target, allows any value (valid or invalid)
class TestEntryDelegate : public Entry::Delegate
{
public:
    void Release() override {}

    CHIP_ERROR GetAuthMode(AuthMode & authMode) const override
    {
        authMode = mAuthMode;
        return CHIP_NO_ERROR;
    }

    CHIP_ERROR GetAuxiliaryType(AuxiliaryType & auxiliaryType) const override
    {
        auxiliaryType = mAuxiliaryType;
        return CHIP_NO_ERROR;
    }

    CHIP_ERROR GetFabricIndex(FabricIndex & fabricIndex) const override
    {
        fabricIndex = mFabricIndex;
        return CHIP_NO_ERROR;
    }

    CHIP_ERROR GetPrivilege(Privilege & privilege) const override
    {
        privilege = mPrivilege;
        return CHIP_NO_ERROR;
    }

    CHIP_ERROR SetAuthMode(AuthMode authMode) override
    {
        mAuthMode = authMode;
        return CHIP_NO_ERROR;
    }

    CHIP_ERROR SetAuxiliaryType(AuxiliaryType auxiliaryType) override
    {
        mAuxiliaryType = auxiliaryType;
        return CHIP_NO_ERROR;
    }

    CHIP_ERROR SetFabricIndex(FabricIndex fabricIndex) override
    {
        mFabricIndex = fabricIndex;
        return CHIP_NO_ERROR;
    }

    CHIP_ERROR SetPrivilege(Privilege privilege) override
    {
        mPrivilege = privilege;
        return CHIP_NO_ERROR;
    }

    CHIP_ERROR GetSubjectCount(size_t & count) const override
    {
        count = mSubjectCount;
        return CHIP_NO_ERROR;
    }
    CHIP_ERROR GetSubject(size_t index, NodeId & subject) const override
    {
        VerifyOrDie(index < mSubjectCount);
        subject = mSubject;
        return CHIP_NO_ERROR;
    }

    CHIP_ERROR SetSubject(size_t index, NodeId subject) override
    {
        VerifyOrDie(index < mSubjectCount);
        mSubject = subject;
        return CHIP_NO_ERROR;
    }

    CHIP_ERROR AddSubject(size_t * index, NodeId subject) override
    {
        VerifyOrDie(mSubjectCount == 0);
        mSubjectCount = 1;
        mSubject      = subject;
        return CHIP_NO_ERROR;
    }

    CHIP_ERROR RemoveSubject(size_t index) override
    {
        VerifyOrDie(mSubjectCount == 1);
        mSubjectCount = 0;
        return CHIP_NO_ERROR;
    }

    CHIP_ERROR GetTargetCount(size_t & count) const override
    {
        count = mTargetCount;
        return CHIP_NO_ERROR;
    }
    CHIP_ERROR GetTarget(size_t index, Target & target) const override
    {
        VerifyOrDie(index < mTargetCount);
        target = mTarget;
        return CHIP_NO_ERROR;
    }

    CHIP_ERROR SetTarget(size_t index, const Target & target) override
    {
        VerifyOrDie(index < mTargetCount);
        mTarget = target;
        return CHIP_NO_ERROR;
    }

    CHIP_ERROR AddTarget(size_t * index, const Target & target) override
    {
        VerifyOrDie(mTargetCount == 0);
        mTargetCount = 1;
        mTarget      = target;
        return CHIP_NO_ERROR;
    }

    CHIP_ERROR RemoveTarget(size_t index) override
    {
        VerifyOrDie(mTargetCount == 1);
        mTargetCount = 0;
        return CHIP_NO_ERROR;
    }

    FabricIndex mFabricIndex     = 1;
    Privilege mPrivilege         = Privilege::kView;
    AuthMode mAuthMode           = AuthMode::kCase;
    AuxiliaryType mAuxiliaryType = AuxiliaryType::kSystem;
    NodeId mSubject              = kOperationalNodeId0;
    Target mTarget               = { .flags = Target::kCluster, .cluster = kOnOffCluster };
    size_t mSubjectCount         = 1;
    size_t mTargetCount          = 1;
};

bool operator==(const Target & a, const Target & b)
{
    if (a.flags != b.flags)
        return false;
    if ((a.flags & Target::kCluster) && a.cluster != b.cluster)
        return false;
    if ((a.flags & Target::kEndpoint) && a.endpoint != b.endpoint)
        return false;
    if ((a.flags & Target::kDeviceType) && a.deviceType != b.deviceType)
        return false;
    return true;
}

bool operator!=(const Target & a, const Target & b)
{
    return !(a == b);
}

struct EntryData
{
    static constexpr int kMaxSubjects = 3;
    static constexpr int kMaxTargets  = 3;

    FabricIndex fabricIndex       = kUndefinedFabricIndex;
    Privilege privilege           = Privilege::kView;
    AuthMode authMode             = AuthMode::kNone;
    NodeId subjects[kMaxSubjects] = { 0 };
    Target targets[kMaxTargets]   = { { 0 } };

    void Clear() { *this = EntryData(); }

    bool IsEmpty() const { return authMode == AuthMode::kNone; }

    size_t GetSubjectCount() const
    {
        size_t count = 0;
        for (auto & subject : subjects)
        {
            if (subject == kUndefinedNodeId)
            {
                break;
            }
            count++;
        }
        return count;
    }

    void AddSubject(size_t * index, NodeId subject)
    {
        size_t count = GetSubjectCount();
        if (count < kMaxSubjects)
        {
            subjects[count] = subject;
            if (index)
            {
                *index = count;
            }
        }
    }

    void RemoveSubject(size_t index)
    {
        size_t count = GetSubjectCount();
        if (index < count)
        {
            while (++index < kMaxSubjects)
            {
                subjects[index - 1] = subjects[index];
            }
            subjects[kMaxSubjects - 1] = { 0 };
        }
    }

    size_t GetTargetCount() const
    {
        size_t count = 0;
        for (auto & target : targets)
        {
            if (target.flags == 0)
            {
                break;
            }
            count++;
        }
        return count;
    }

    void AddTarget(size_t * index, const Target & target)
    {
        size_t count = GetTargetCount();
        if (count < kMaxTargets)
        {
            targets[count] = target;
            if (index)
            {
                *index = count;
            }
        }
    }

    void RemoveTarget(size_t index)
    {
        size_t count = GetTargetCount();
        if (index < count)
        {
            while (++index < kMaxTargets)
            {
                targets[index - 1] = targets[index];
            }
            targets[kMaxTargets - 1] = { 0 };
        }
    }
};

struct AuxiliaryEquivalenceEntry
{
    chip::FabricIndex fabricIndex;
    chip::GroupId groupId;
    chip::EndpointId endpointId;

    bool operator<(const AuxiliaryEquivalenceEntry & other) const
    {
        if (fabricIndex != other.fabricIndex)
            return fabricIndex < other.fabricIndex;
        if (groupId != other.groupId)
            return groupId < other.groupId;
        return endpointId < other.endpointId;
    }

    bool operator==(const AuxiliaryEquivalenceEntry & other) const
    {
        return fabricIndex == other.fabricIndex && groupId == other.groupId && endpointId == other.endpointId;
    }
};

CHIP_ERROR CompareEntry(const Entry & entry, const EntryData & entryData)
{
    AuthMode authMode = AuthMode::kNone;
    ReturnErrorOnFailure(entry.GetAuthMode(authMode));
    VerifyOrReturnError(authMode == entryData.authMode, CHIP_ERROR_INCORRECT_STATE);
    FabricIndex fabricIndex = kUndefinedFabricIndex;
    ReturnErrorOnFailure(entry.GetFabricIndex(fabricIndex));
    VerifyOrReturnError(fabricIndex == entryData.fabricIndex, CHIP_ERROR_INCORRECT_STATE);
    Privilege privilege = Privilege::kView;
    ReturnErrorOnFailure(entry.GetPrivilege(privilege));
    VerifyOrReturnError(privilege == entryData.privilege, CHIP_ERROR_INCORRECT_STATE);
    size_t subjectCount = 0;
    ReturnErrorOnFailure(entry.GetSubjectCount(subjectCount));
    VerifyOrReturnError(subjectCount == entryData.GetSubjectCount(), CHIP_ERROR_INCORRECT_STATE);
    for (size_t i = 0; i < subjectCount; ++i)
    {
        NodeId subject = kUndefinedNodeId;
        ReturnErrorOnFailure(entry.GetSubject(i, subject));
        VerifyOrReturnError(subject == entryData.subjects[i], CHIP_ERROR_INCORRECT_STATE);
    }
    size_t targetCount = 0;
    ReturnErrorOnFailure(entry.GetTargetCount(targetCount));
    VerifyOrReturnError(targetCount == entryData.GetTargetCount(), CHIP_ERROR_INCORRECT_STATE);
    for (size_t i = 0; i < targetCount; ++i)
    {
        Target target;
        ReturnErrorOnFailure(entry.GetTarget(i, target));
        VerifyOrReturnError(target == entryData.targets[i], CHIP_ERROR_INCORRECT_STATE);
    }
    return CHIP_NO_ERROR;
}

CHIP_ERROR LoadEntry(Entry & entry, const EntryData & entryData)
{
    ReturnErrorOnFailure(entry.SetAuthMode(entryData.authMode));
    ReturnErrorOnFailure(entry.SetFabricIndex(entryData.fabricIndex));
    ReturnErrorOnFailure(entry.SetPrivilege(entryData.privilege));
    for (size_t i = 0; i < entryData.GetSubjectCount(); ++i)
    {
        ReturnErrorOnFailure(entry.AddSubject(nullptr, entryData.subjects[i]));
    }
    for (size_t i = 0; i < entryData.GetTargetCount(); ++i)
    {
        ReturnErrorOnFailure(entry.AddTarget(nullptr, entryData.targets[i]));
    }
    return CHIP_NO_ERROR;
}

CHIP_ERROR ClearAccessControl(AccessControl & ac)
{
    CHIP_ERROR err;
    do
    {
        err = accessControl.DeleteEntry(0);
    } while (err == CHIP_NO_ERROR);
    return CHIP_NO_ERROR;
}

CHIP_ERROR CompareAccessControl(AccessControl & ac, const EntryData * entryData, size_t count)
{
    Entry entry;
    for (size_t i = 0; i < count; ++i, ++entryData)
    {
        ReturnErrorOnFailure(ac.ReadEntry(i, entry));
        ReturnErrorOnFailure(CompareEntry(entry, *entryData));
    }
    VerifyOrReturnError(ac.ReadEntry(count, entry) != CHIP_NO_ERROR, CHIP_ERROR_INCORRECT_STATE);
    return CHIP_NO_ERROR;
}

CHIP_ERROR LoadAccessControl(AccessControl & ac, const EntryData * entryData, size_t count)
{
    Entry entry;
    for (size_t i = 0; i < count; ++i, ++entryData)
    {
        ReturnErrorOnFailure(ac.PrepareEntry(entry));
        ReturnErrorOnFailure(LoadEntry(entry, *entryData));
        ReturnErrorOnFailure(ac.CreateEntry(nullptr, entry));
    }
    return CHIP_NO_ERROR;
}

struct GroupCheckData
{
    SubjectDescriptor subjectDescriptor;
    RequestPath requestPath;
    Privilege privilege;
    // If not specified, this means the expected result is NOT CHIP_NO_ERROR, but also may not be CHIP_ERROR_ACCESS_DENIED.
    // This can happen if tests have malformed access control requests or group data fetch requests, which are expected to
    // fail earlier in execution. Main purpose of tests that don't specify this are to ensure some sort of failure in the
    // process of doing the check occurs before approving/denying access.
    Optional<CHIP_ERROR> expectedResult;
};

const GroupCheckData groupCheckData[] = {
    // Allowed (access granted)
    { .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kGroup, .subject = NodeIdFromGroupId(0x1111) },
      .requestPath       = { .endpoint = 10, .requestType = Access::RequestType::kCommandInvokeRequest },
      .privilege         = Privilege::kOperate,
      .expectedResult    = Optional<CHIP_ERROR>::Value(CHIP_NO_ERROR) },

    // Not allowed (access denied) because TestGroupAuxiliaryCheck will purposely NOT add the kHasAuxiliaryACL flag to the group.
    { .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kGroup, .subject = NodeIdFromGroupId(0x2222) },
      .requestPath       = { .endpoint = 20, .requestType = Access::RequestType::kCommandInvokeRequest },
      .privilege         = Privilege::kOperate,
      .expectedResult    = Optional<CHIP_ERROR>::Value(CHIP_ERROR_ACCESS_DENIED) },

    // Not allowed (access denied) because the wrong request type is used.
    { .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kGroup, .subject = NodeIdFromGroupId(0x1111) },
      .requestPath       = { .endpoint = 10, .requestType = Access::RequestType::kAttributeWriteRequest },
      .privilege         = Privilege::kOperate,
      .expectedResult    = Optional<CHIP_ERROR>::Value(CHIP_ERROR_ACCESS_DENIED) },

    // Not allowed (access denied) because access should never be granted for endpoint 0.
    { .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kGroup, .subject = NodeIdFromGroupId(0x1111) },
      .requestPath       = { .endpoint = 0, .requestType = Access::RequestType::kCommandInvokeRequest },
      .privilege         = Privilege::kOperate,
      .expectedResult    = Optional<CHIP_ERROR>::Value(CHIP_ERROR_ACCESS_DENIED) },

    // Allowed (access granted)
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kGroup, .subject = NodeIdFromGroupId(0x3333) },
      .requestPath       = { .endpoint = 30, .requestType = Access::RequestType::kCommandInvokeRequest },
      .privilege         = Privilege::kOperate,
      .expectedResult    = Optional<CHIP_ERROR>::Value(CHIP_NO_ERROR) },

    // Not allowed (access denied) because TestGroupAuxiliaryCheck will purposely NOT add the kHasAuxiliaryACL flag to the group.
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kGroup, .subject = NodeIdFromGroupId(0x4444) },
      .requestPath       = { .endpoint = 40, .requestType = Access::RequestType::kCommandInvokeRequest },
      .privilege         = Privilege::kOperate,
      .expectedResult    = Optional<CHIP_ERROR>::Value(CHIP_ERROR_ACCESS_DENIED) },

    // Not allowed (access denied) because the wrong privilige is used.
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kGroup, .subject = NodeIdFromGroupId(0x3333) },
      .requestPath       = { .endpoint = 30, .requestType = Access::RequestType::kCommandInvokeRequest },
      .privilege         = Privilege::kManage,
      .expectedResult    = Optional<CHIP_ERROR>::Value(CHIP_ERROR_ACCESS_DENIED) },

    // Not allowed (access denied) because the wrong auth mode is used.
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kNone, .subject = NodeIdFromGroupId(0x3333) },
      .requestPath       = { .endpoint = 30, .requestType = Access::RequestType::kCommandInvokeRequest },
      .privilege         = Privilege::kOperate,
      .expectedResult    = Optional<CHIP_ERROR>::Value(CHIP_ERROR_ACCESS_DENIED) },

    // Not allowed (access denied) because the endpoint does not exist on the group
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kGroup, .subject = NodeIdFromGroupId(0x3333) },
      .requestPath       = { .endpoint = 9, .requestType = Access::RequestType::kCommandInvokeRequest },
      .privilege         = Privilege::kOperate,
      .expectedResult    = Optional<CHIP_ERROR>::Value(CHIP_ERROR_ACCESS_DENIED) },

    // Not allowed (failure in execution) because the endpoint doesn't exist on the specified fabric index for the group
    { .subjectDescriptor = { .fabricIndex = 9, .authMode = AuthMode::kGroup, .subject = NodeIdFromGroupId(0x3333) },
      .requestPath       = { .endpoint = 30, .requestType = Access::RequestType::kCommandInvokeRequest },
      .privilege         = Privilege::kOperate },

    // Not allowed (failure in execution) because the group does not exist
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kGroup, .subject = NodeIdFromGroupId(0x9999) },
      .requestPath       = { .endpoint = 30, .requestType = Access::RequestType::kCommandInvokeRequest },
      .privilege         = Privilege::kOperate },
};

/**
 * The format of Auxiliary entries is up to the implementation of the appropriate
 * access control delegate. This means there is not only 1 valid format of entries, rather
 * there is a set of rules that the collection of entries follows. This function reduces
 * the entries reported to the base equivalence class to compare with an expected set.
 */
void ValidateAuxiliaryEntries(AccessControl & ac, FabricIndex fabric, const std::set<AuxiliaryEquivalenceEntry> & expectedSet)
{
    EntryIterator iterator;
    EXPECT_EQ(ac.AuxiliaryEntries(fabric, iterator), CHIP_NO_ERROR);

    std::set<AuxiliaryEquivalenceEntry> actualSet;
    Entry entry;

    while (iterator.Next(entry) == CHIP_NO_ERROR)
    {
        FabricIndex entryFabric;
        size_t subjectCount = 0;
        size_t targetCount  = 0;

        EXPECT_EQ(entry.GetFabricIndex(entryFabric), CHIP_NO_ERROR);
        EXPECT_EQ(entry.GetSubjectCount(subjectCount), CHIP_NO_ERROR);
        EXPECT_EQ(entry.GetTargetCount(targetCount), CHIP_NO_ERROR);

        for (size_t s = 0; s < subjectCount; ++s)
        {
            NodeId subject;
            if (entry.GetSubject(s, subject) == CHIP_NO_ERROR && IsGroupId(subject))
            {
                GroupId groupId = GroupIdFromNodeId(subject);
                if (targetCount > 0)
                {
                    for (size_t t = 0; t < targetCount; ++t)
                    {
                        Entry::Target target;
                        if (entry.GetTarget(t, target) == CHIP_NO_ERROR)
                        {
                            actualSet.insert({ .fabricIndex = entryFabric, .groupId = groupId, .endpointId = target.endpoint });
                        }
                    }
                }
                else
                {
                    // Target can be unspecified, which represents a wildcard of all endpoints from
                    // a root node's descriptor cluster part list being represented from 1 entry.
                    // This can be verified in end-to-end tests, but for the purposes of unit tests
                    // here checking against the group auxiliary delegate in access control, endpoint
                    // information can be pulled from the group data provider.
                    Credentials::GroupDataProvider * provider = Credentials::GetGroupDataProvider();
                    if (provider)
                    {
                        auto * it = provider->IterateEndpoints(entryFabric, groupId);
                        if (it)
                        {
                            Credentials::GroupDataProvider::GroupEndpoint endpoint;
                            while (it->Next(endpoint))
                            {
                                if (endpoint.endpoint_id != kRootEndpointId)
                                {
                                    actualSet.insert(
                                        { .fabricIndex = entryFabric, .groupId = groupId, .endpointId = endpoint.endpoint_id });
                                }
                            }
                            it->Release();
                        }
                    }
                }
            }
        }
    }

    // Comparing sets provides a clear diff if the test fails
    EXPECT_EQ(actualSet, expectedSet);
}

constexpr size_t kNumFabric1EntriesInEntryData1 = 4;
constexpr size_t kNumFabric2EntriesInEntryData1 = 5;

constexpr EntryData entryData1[] = {
    {
        .fabricIndex = 1,
        .privilege   = Privilege::kAdminister,
        .authMode    = AuthMode::kCase,
        .subjects    = { kOperationalNodeId3 },
    },
    {
        .fabricIndex = 1,
        .privilege   = Privilege::kView,
        .authMode    = AuthMode::kCase,
    },
    {
        .fabricIndex = 2,
        .privilege   = Privilege::kAdminister,
        .authMode    = AuthMode::kCase,
        .subjects    = { kOperationalNodeId4 },
    },
    {
        .fabricIndex = 1,
        .privilege   = Privilege::kOperate,
        .authMode    = AuthMode::kCase,
        .targets     = { { .flags = Target::kCluster, .cluster = kOnOffCluster } },
    },
    {
        .fabricIndex = 2,
        .privilege   = Privilege::kManage,
        .authMode    = AuthMode::kCase,
        .subjects    = { kOperationalNodeId5 },
        .targets     = { { .flags = Target::kCluster | Target::kEndpoint, .cluster = kOnOffCluster, .endpoint = 2 } },
    },
    {
        .fabricIndex = 2,
        .privilege   = Privilege::kProxyView,
        .authMode    = AuthMode::kGroup,
        .subjects    = { kGroup2 },
        .targets     = { { .flags = Target::kCluster | Target::kEndpoint, .cluster = kLevelControlCluster, .endpoint = 1 },
                         { .flags = Target::kCluster, .cluster = kOnOffCluster },
                         { .flags = Target::kEndpoint, .endpoint = 2 } },
    },
    {
        .fabricIndex = 1,
        .privilege   = Privilege::kAdminister,
        .authMode    = AuthMode::kCase,
        .subjects    = { kCASEAuthTagAsNodeId0 },
    },
    {
        .fabricIndex = 2,
        .privilege   = Privilege::kManage,
        .authMode    = AuthMode::kCase,
        .subjects    = { kCASEAuthTagAsNodeId3, kCASEAuthTagAsNodeId1 },
        .targets     = { { .flags = Target::kCluster, .cluster = kOnOffCluster } },
    },
    {
        .fabricIndex = 2,
        .privilege   = Privilege::kOperate,
        .authMode    = AuthMode::kCase,
        .subjects    = { kCASEAuthTagAsNodeId4, kCASEAuthTagAsNodeId1 },
        .targets     = { { .flags = Target::kCluster, .cluster = kLevelControlCluster } },
    },
};

constexpr size_t entryData1Count = MATTER_ARRAY_SIZE(entryData1);
static_assert(entryData1Count == (kNumFabric1EntriesInEntryData1 + kNumFabric2EntriesInEntryData1),
              "Must maintain both fabric counts for some tests");

struct CheckData
{
    SubjectDescriptor subjectDescriptor;
    RequestPath requestPath;
    Privilege privilege;
    bool allow;
};

constexpr CheckData checkData1[] = {
    // Checks for implicit PASE
    { .subjectDescriptor = { .fabricIndex = 0, .authMode = AuthMode::kPase, .subject = kPaseVerifier0 },
      .requestPath       = { .cluster = 1, .endpoint = 2 },
      .privilege         = Privilege::kAdminister,
      .allow             = true },
    { .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kPase, .subject = kPaseVerifier0 },
      .requestPath       = { .cluster = 3, .endpoint = 4 },
      .privilege         = Privilege::kAdminister,
      .allow             = true },
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kPase, .subject = kPaseVerifier0 },
      .requestPath       = { .cluster = 5, .endpoint = 6 },
      .privilege         = Privilege::kAdminister,
      .allow             = true },
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kPase, .subject = kPaseVerifier1 },
      .requestPath       = { .cluster = 5, .endpoint = 6 },
      .privilege         = Privilege::kAdminister,
      .allow             = true },
    { .subjectDescriptor = { .fabricIndex = 3, .authMode = AuthMode::kPase, .subject = kPaseVerifier3 },
      .requestPath       = { .cluster = 7, .endpoint = 8 },
      .privilege         = Privilege::kAdminister,
      .allow             = true },
    // Checks for entry 0
    { .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId3 },
      .requestPath       = { .cluster = kAccessControlCluster, .endpoint = 0 },
      .privilege         = Privilege::kAdminister,
      .allow             = true },
    { .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId3 },
      .requestPath       = { .cluster = 1, .endpoint = 2 },
      .privilege         = Privilege::kManage,
      .allow             = true },
    { .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId3 },
      .requestPath       = { .cluster = 3, .endpoint = 4 },
      .privilege         = Privilege::kOperate,
      .allow             = true },
    { .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId3 },
      .requestPath       = { .cluster = 5, .endpoint = 6 },
      .privilege         = Privilege::kView,
      .allow             = true },
    { .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId3 },
      .requestPath       = { .cluster = 7, .endpoint = 8 },
      .privilege         = Privilege::kProxyView,
      .allow             = true },
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId3 },
      .requestPath       = { .cluster = 1, .endpoint = 2 },
      .privilege         = Privilege::kAdminister,
      .allow             = false },
    { .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kGroup, .subject = kOperationalNodeId3 },
      .requestPath       = { .cluster = 1, .endpoint = 2 },
      .privilege         = Privilege::kAdminister,
      .allow             = false },
    { .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId4 },
      .requestPath       = { .cluster = 1, .endpoint = 2 },
      .privilege         = Privilege::kAdminister,
      .allow             = false },
    // Checks for entry 1
    { .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId1 },
      .requestPath       = { .cluster = 11, .endpoint = 13 },
      .privilege         = Privilege::kView,
      .allow             = true },
    { .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId1 },
      .requestPath       = { .cluster = 11, .endpoint = 13 },
      .privilege         = Privilege::kOperate,
      .allow             = false },
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId1 },
      .requestPath       = { .cluster = 11, .endpoint = 13 },
      .privilege         = Privilege::kView,
      .allow             = false },
    { .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kGroup, .subject = kOperationalNodeId1 },
      .requestPath       = { .cluster = 11, .endpoint = 13 },
      .privilege         = Privilege::kView,
      .allow             = false },
    // Checks for entry 2
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId4 },
      .requestPath       = { .cluster = kAccessControlCluster, .endpoint = 0 },
      .privilege         = Privilege::kAdminister,
      .allow             = true },
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId4 },
      .requestPath       = { .cluster = 1, .endpoint = 2 },
      .privilege         = Privilege::kManage,
      .allow             = true },
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId4 },
      .requestPath       = { .cluster = 3, .endpoint = 4 },
      .privilege         = Privilege::kOperate,
      .allow             = true },
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId4 },
      .requestPath       = { .cluster = 5, .endpoint = 6 },
      .privilege         = Privilege::kView,
      .allow             = true },
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId4 },
      .requestPath       = { .cluster = 7, .endpoint = 8 },
      .privilege         = Privilege::kProxyView,
      .allow             = true },
    { .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId4 },
      .requestPath       = { .cluster = 1, .endpoint = 2 },
      .privilege         = Privilege::kAdminister,
      .allow             = false },
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kGroup, .subject = kOperationalNodeId4 },
      .requestPath       = { .cluster = 1, .endpoint = 2 },
      .privilege         = Privilege::kAdminister,
      .allow             = false },
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId3 },
      .requestPath       = { .cluster = 1, .endpoint = 2 },
      .privilege         = Privilege::kAdminister,
      .allow             = false },
    // Checks for entry 3
    { .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId1 },
      .requestPath       = { .cluster = kOnOffCluster, .endpoint = 11 },
      .privilege         = Privilege::kOperate,
      .allow             = true },
    { .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId2 },
      .requestPath       = { .cluster = kOnOffCluster, .endpoint = 13 },
      .privilege         = Privilege::kOperate,
      .allow             = true },
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId1 },
      .requestPath       = { .cluster = kOnOffCluster, .endpoint = 11 },
      .privilege         = Privilege::kOperate,
      .allow             = false },
    { .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId1 },
      .requestPath       = { .cluster = 123, .endpoint = 11 },
      .privilege         = Privilege::kOperate,
      .allow             = false },
    { .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId1 },
      .requestPath       = { .cluster = kOnOffCluster, .endpoint = 11 },
      .privilege         = Privilege::kManage,
      .allow             = false },
    // Checks for entry 4
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId5 },
      .requestPath       = { .cluster = kOnOffCluster, .endpoint = 2 },
      .privilege         = Privilege::kManage,
      .allow             = true },
    { .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId5 },
      .requestPath       = { .cluster = kOnOffCluster, .endpoint = 2 },
      .privilege         = Privilege::kManage,
      .allow             = false },
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kGroup, .subject = kOperationalNodeId5 },
      .requestPath       = { .cluster = kOnOffCluster, .endpoint = 2 },
      .privilege         = Privilege::kManage,
      .allow             = false },
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId3 },
      .requestPath       = { .cluster = kOnOffCluster, .endpoint = 2 },
      .privilege         = Privilege::kManage,
      .allow             = false },
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId5 },
      .requestPath       = { .cluster = kLevelControlCluster, .endpoint = 2 },
      .privilege         = Privilege::kManage,
      .allow             = false },
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId5 },
      .requestPath       = { .cluster = kOnOffCluster, .endpoint = 1 },
      .privilege         = Privilege::kManage,
      .allow             = false },
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kOperationalNodeId5 },
      .requestPath       = { .cluster = kOnOffCluster, .endpoint = 2 },
      .privilege         = Privilege::kAdminister,
      .allow             = false },
    // Checks for entry 5
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kGroup, .subject = kGroup2 },
      .requestPath       = { .cluster = kLevelControlCluster, .endpoint = 1 },
      .privilege         = Privilege::kProxyView,
      .allow             = true },
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kGroup, .subject = kGroup2 },
      .requestPath       = { .cluster = kOnOffCluster, .endpoint = 3 },
      .privilege         = Privilege::kProxyView,
      .allow             = true },
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kGroup, .subject = kGroup2 },
      .requestPath       = { .cluster = kColorControlCluster, .endpoint = 2 },
      .privilege         = Privilege::kProxyView,
      .allow             = true },
    { .subjectDescriptor = { .fabricIndex = 1, .authMode = AuthMode::kGroup, .subject = kGroup2 },
      .requestPath       = { .cluster = kLevelControlCluster, .endpoint = 1 },
      .privilege         = Privilege::kProxyView,
      .allow             = false },
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kCase, .subject = kGroup2 },
      .requestPath       = { .cluster = kLevelControlCluster, .endpoint = 1 },
      .privilege         = Privilege::kProxyView,
      .allow             = false },
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kGroup, .subject = kGroup4 },
      .requestPath       = { .cluster = kLevelControlCluster, .endpoint = 1 },
      .privilege         = Privilege::kProxyView,
      .allow             = false },
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kGroup, .subject = kGroup2 },
      .requestPath       = { .cluster = kColorControlCluster, .endpoint = 1 },
      .privilege         = Privilege::kProxyView,
      .allow             = false },
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kGroup, .subject = kGroup2 },
      .requestPath       = { .cluster = kColorControlCluster, .endpoint = 1 },
      .privilege         = Privilege::kProxyView,
      .allow             = false },
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kGroup, .subject = kGroup2 },
      .requestPath       = { .cluster = kLevelControlCluster, .endpoint = 3 },
      .privilege         = Privilege::kProxyView,
      .allow             = false },
    { .subjectDescriptor = { .fabricIndex = 2, .authMode = AuthMode::kGroup, .subject = kGroup2 },
      .requestPath       = { .cluster = kLevelControlCluster, .endpoint = 1 },
      .privilege         = Privilege::kOperate,
      .allow             = false },
    // Checks for entry 6
    { .subjectDescriptor = { .fabricIndex = 2,
                             .authMode    = AuthMode::kCase,
                             .cats        = { kCASEAuthTag0, kUndefinedCAT, kUndefinedCAT } },
      .requestPath       = { .cluster = kLevelControlCluster, .endpoint = 1 },
      .privilege         = Privilege::kOperate,
      .allow             = false },
    { .subjectDescriptor = { .fabricIndex = 1,
                             .authMode    = AuthMode::kCase,
                             .cats        = { kCASEAuthTag0, kUndefinedCAT, kUndefinedCAT } },
      .requestPath       = { .cluster = kLevelControlCluster, .endpoint = 1 },
      .privilege         = Privilege::kOperate,
      .allow             = true },
    { .subjectDescriptor = { .fabricIndex = 1,
                             .authMode    = AuthMode::kCase,
                             .cats        = { kCASEAuthTag1, kUndefinedCAT, kUndefinedCAT } },
      .requestPath       = { .cluster = kLevelControlCluster, .endpoint = 1 },
      .privilege         = Privilege::kOperate,
      .allow             = false },
    // Checks for entry 7
    { .subjectDescriptor = { .fabricIndex = 2,
                             .authMode    = AuthMode::kCase,
                             .cats        = { kCASEAuthTag0, kUndefinedCAT, kUndefinedCAT } },
      .requestPath       = { .cluster = kOnOffCluster, .endpoint = 1 },
      .privilege         = Privilege::kOperate,
      .allow             = false },
    { .subjectDescriptor = { .fabricIndex = 2,
                             .authMode    = AuthMode::kCase,
                             .cats        = { kCASEAuthTag0, kCASEAuthTag2, kUndefinedCAT } },
      .requestPath       = { .cluster = kOnOffCluster, .endpoint = 1 },
      .privilege         = Privilege::kOperate,
      .allow             = false },
    { .subjectDescriptor = { .fabricIndex = 2,
                             .authMode    = AuthMode::kCase,
                             .cats        = { kCASEAuthTag0, kCASEAuthTag3, kUndefinedCAT } },
      .requestPath       = { .cluster = kOnOffCluster, .endpoint = 1 },
      .privilege         = Privilege::kOperate,
      .allow             = true },
    { .subjectDescriptor = { .fabricIndex = 2,
                             .authMode    = AuthMode::kCase,
                             .cats        = { kCASEAuthTag0, kCASEAuthTag4, kUndefinedCAT } },
      .requestPath       = { .cluster = kOnOffCluster, .endpoint = 1 },
      .privilege         = Privilege::kManage,
      .allow             = true },
    // Checks for entry 8
    { .subjectDescriptor = { .fabricIndex = 2,
                             .authMode    = AuthMode::kCase,
                             .cats        = { kCASEAuthTag0, kCASEAuthTag3, kUndefinedCAT } },
      .requestPath       = { .cluster = kLevelControlCluster, .endpoint = 1 },
      .privilege         = Privilege::kOperate,
      .allow             = false },
    { .subjectDescriptor = { .fabricIndex = 2,
                             .authMode    = AuthMode::kCase,
                             .cats        = { kCASEAuthTag0, kCASEAuthTag4, kUndefinedCAT } },
      .requestPath       = { .cluster = kLevelControlCluster, .endpoint = 2 },
      .privilege         = Privilege::kOperate,
      .allow             = true },
    { .subjectDescriptor = { .fabricIndex = 2,
                             .authMode    = AuthMode::kCase,
                             .cats        = { kCASEAuthTag1, kUndefinedCAT, kUndefinedCAT } },
      .requestPath       = { .cluster = kLevelControlCluster, .endpoint = 2 },
      .privilege         = Privilege::kOperate,
      .allow             = true },
};

class TestAccessControl : public ::testing::Test
{
public: // protected
    void SetUp() override { ASSERT_EQ(ClearAccessControl(accessControl), CHIP_NO_ERROR); }
    static void SetUpTestSuite()
    {
        ASSERT_EQ(chip::Platform::MemoryInit(), CHIP_NO_ERROR);

        // Set and init access control delegate
        AccessControl::Delegate * delegate = Examples::GetAccessControlDelegate();
        SetAccessControl(accessControl);
        SuccessOrDie(GetAccessControl().Init(delegate, testDeviceTypeResolver));

        // Set and init group data provider
        gTestStorage.ClearStorage();
        gGroupsProvider.SetStorageDelegate(&gTestStorage);
        gGroupsProvider.SetSessionKeystore(&gSessionKeystore);
        gGroupsProvider.SetGroupcastEnabled(true);
        ASSERT_EQ(gGroupsProvider.Init(), CHIP_NO_ERROR);
        chip::Credentials::SetGroupDataProvider(&gGroupsProvider);

        // Register group auxilary access control delegate.
        // The shared global delegate is not tied to a FabricTable.
        SuccessOrDie(gGroupAuxiliaryAccessControlDelegate.Initialize(&gGroupsProvider, nullptr));
        SuccessOrDie(GetAccessControl().RegisterGroupAuxiliaryDelegate(&gGroupAuxiliaryAccessControlDelegate));
    }
    static void TearDownTestSuite()
    {
        GetAccessControl().Finish();
        ResetAccessControlToDefault();
        chip::Platform::MemoryShutdown();
    }
};

TEST_F(TestAccessControl, MetaTest)
{
    EXPECT_EQ(LoadAccessControl(accessControl, entryData1, entryData1Count), CHIP_NO_ERROR);
    EXPECT_EQ(CompareAccessControl(accessControl, entryData1, entryData1Count), CHIP_NO_ERROR);
    EXPECT_EQ(accessControl.DeleteEntry(3), CHIP_NO_ERROR);
    EXPECT_NE(CompareAccessControl(accessControl, entryData1, entryData1Count), CHIP_NO_ERROR);
}

TEST_F(TestAccessControl, TestAclValidateAuthModeSubject)
{
    TestEntryDelegate delegate; // outlive entry
    Entry entry;

    // Use prepared entry for valid cases
    EXPECT_EQ(accessControl.PrepareEntry(entry), CHIP_NO_ERROR);
    EXPECT_EQ(entry.SetFabricIndex(1), CHIP_NO_ERROR);
    EXPECT_EQ(entry.SetPrivilege(Privilege::kView), CHIP_NO_ERROR);
    EXPECT_EQ(entry.SetAuthMode(AuthMode::kCase), CHIP_NO_ERROR);
    EXPECT_EQ(entry.AddSubject(nullptr, kOperationalNodeId0), CHIP_NO_ERROR);
    EXPECT_EQ(entry.AddTarget(nullptr, { .flags = Target::kCluster, .cluster = kOnOffCluster }), CHIP_NO_ERROR);

    // Each case tries to update the first entry, then add a second entry, then unconditionally delete it
    EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);

    // CASE and group may have empty subjects list
    {
        EXPECT_EQ(entry.RemoveSubject(0), CHIP_NO_ERROR);

        EXPECT_EQ(entry.SetAuthMode(AuthMode::kCase), CHIP_NO_ERROR);
        EXPECT_EQ(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_SUCCESS(accessControl.DeleteEntry(1));

        EXPECT_EQ(entry.SetAuthMode(AuthMode::kGroup), CHIP_NO_ERROR);
        EXPECT_EQ(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_SUCCESS(accessControl.DeleteEntry(1));

        EXPECT_EQ(entry.AddSubject(nullptr, kOperationalNodeId0), CHIP_NO_ERROR);
    }

    EXPECT_EQ(entry.SetAuthMode(AuthMode::kCase), CHIP_NO_ERROR);
    for (auto subject : validCaseSubjects)
    {
        EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
        EXPECT_EQ(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_SUCCESS(accessControl.DeleteEntry(1));
    }

    EXPECT_EQ(entry.SetAuthMode(AuthMode::kGroup), CHIP_NO_ERROR);
    for (auto subject : validGroupSubjects)
    {
        EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
        EXPECT_EQ(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_SUCCESS(accessControl.DeleteEntry(1));
    }

    // Use test entry for invalid cases (to ensure it can hold invalid data)
    entry.SetDelegate(delegate);

    // Operational PASE not supported
    EXPECT_EQ(entry.SetAuthMode(AuthMode::kPase), CHIP_NO_ERROR);
    for (auto subject : validPaseSubjects)
    {
        EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
    }

    EXPECT_EQ(entry.SetAuthMode(AuthMode::kCase), CHIP_NO_ERROR);
    for (auto subject : validGroupSubjects)
    {
        EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
    }
    for (auto subject : validPaseSubjects)
    {
        EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
    }
    for (auto subject : invalidSubjects)
    {
        EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
    }

    EXPECT_EQ(entry.SetAuthMode(AuthMode::kGroup), CHIP_NO_ERROR);
    for (auto subject : validCaseSubjects)
    {
        EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
    }
    for (auto subject : validPaseSubjects)
    {
        EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
    }
    for (auto subject : invalidSubjects)
    {
        EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
    }

    EXPECT_EQ(entry.SetAuthMode(AuthMode::kPase), CHIP_NO_ERROR);
    for (auto subject : validCaseSubjects)
    {
        EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
    }
    for (auto subject : validGroupSubjects)
    {
        EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
    }
    for (auto subject : invalidSubjects)
    {
        EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
    }

    EXPECT_EQ(entry.SetAuthMode(AuthMode::kNone), CHIP_NO_ERROR);
    for (auto subject : validCaseSubjects)
    {
        EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
    }
    for (auto subject : validGroupSubjects)
    {
        EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
    }
    for (auto subject : validPaseSubjects)
    {
        EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
    }
    for (auto subject : invalidSubjects)
    {
        EXPECT_EQ(entry.SetSubject(0, subject), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
    }

    // Next cases have no subject
    EXPECT_EQ(entry.RemoveSubject(0), CHIP_NO_ERROR);

    // PASE must have subject
    {
        EXPECT_EQ(entry.SetAuthMode(AuthMode::kPase), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
    }

    // None is not a real auth mode but also shouldn't work with no subject
    {
        EXPECT_EQ(entry.SetAuthMode(AuthMode::kNone), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
    }
}

TEST_F(TestAccessControl, TestAclValidateFabricIndex)
{
    TestEntryDelegate delegate; // outlive entry
    Entry entry;

    // Use prepared entry for valid cases
    EXPECT_EQ(accessControl.PrepareEntry(entry), CHIP_NO_ERROR);
    EXPECT_EQ(entry.SetFabricIndex(1), CHIP_NO_ERROR);
    EXPECT_EQ(entry.SetPrivilege(Privilege::kView), CHIP_NO_ERROR);
    EXPECT_EQ(entry.SetAuthMode(AuthMode::kCase), CHIP_NO_ERROR);
    EXPECT_EQ(entry.AddSubject(nullptr, kOperationalNodeId0), CHIP_NO_ERROR);
    EXPECT_EQ(entry.AddTarget(nullptr, { .flags = Target::kCluster, .cluster = kOnOffCluster }), CHIP_NO_ERROR);

    // Each case tries to update the first entry, then add a second entry, then unconditionally delete it
    EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);

    for (auto fabricIndex : fabricIndexes)
    {
        EXPECT_EQ(entry.SetFabricIndex(fabricIndex), CHIP_NO_ERROR);
        EXPECT_EQ(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_SUCCESS(accessControl.DeleteEntry(1));
    }

    // Use test entry for invalid cases (to ensure it can hold invalid data)
    entry.SetDelegate(delegate);

    for (auto fabricIndex : invalidFabricIndexes)
    {
        EXPECT_EQ(entry.SetFabricIndex(fabricIndex), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
    }
}

TEST_F(TestAccessControl, TestAclValidatePrivilege)
{
    TestEntryDelegate delegate; // outlive entry
    Entry entry;

    // Use prepared entry for valid cases
    EXPECT_EQ(accessControl.PrepareEntry(entry), CHIP_NO_ERROR);
    EXPECT_EQ(entry.SetFabricIndex(1), CHIP_NO_ERROR);
    EXPECT_EQ(entry.SetPrivilege(Privilege::kView), CHIP_NO_ERROR);
    EXPECT_EQ(entry.SetAuthMode(AuthMode::kCase), CHIP_NO_ERROR);
    EXPECT_EQ(entry.AddSubject(nullptr, kOperationalNodeId0), CHIP_NO_ERROR);
    EXPECT_EQ(entry.AddTarget(nullptr, { .flags = Target::kCluster, .cluster = kOnOffCluster }), CHIP_NO_ERROR);

    // Each case tries to update the first entry, then add a second entry, then unconditionally delete it
    EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);

    for (auto privilege : privileges)
    {
        EXPECT_EQ(entry.SetPrivilege(privilege), CHIP_NO_ERROR);
        EXPECT_EQ(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_SUCCESS(accessControl.DeleteEntry(1));
    }

    // Use test entry for invalid cases (to ensure it can hold invalid data)
    entry.SetDelegate(delegate);

    // Cannot grant administer privilege to group auth mode
    {
        EXPECT_EQ(entry.SetPrivilege(Privilege::kAdminister), CHIP_NO_ERROR);
        EXPECT_EQ(entry.SetAuthMode(AuthMode::kGroup), CHIP_NO_ERROR);
        EXPECT_EQ(entry.SetSubject(0, kGroup4), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
    }
}

TEST_F(TestAccessControl, TestAclValidateTarget)
{
    TestEntryDelegate delegate; // outlive entry
    Entry entry;

    // Use prepared entry for valid cases
    EXPECT_EQ(accessControl.PrepareEntry(entry), CHIP_NO_ERROR);
    EXPECT_EQ(entry.SetFabricIndex(1), CHIP_NO_ERROR);
    EXPECT_EQ(entry.SetPrivilege(Privilege::kView), CHIP_NO_ERROR);
    EXPECT_EQ(entry.SetAuthMode(AuthMode::kCase), CHIP_NO_ERROR);
    EXPECT_EQ(entry.AddSubject(nullptr, kOperationalNodeId0), CHIP_NO_ERROR);
    EXPECT_EQ(entry.AddTarget(nullptr, { .flags = Target::kCluster, .cluster = kOnOffCluster }), CHIP_NO_ERROR);

    // Each case tries to update the first entry, then add a second entry, then unconditionally delete it
    EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);

    for (auto cluster : validClusters)
    {
        EXPECT_EQ(entry.SetTarget(0, { .flags = Target::kCluster, .cluster = cluster }), CHIP_NO_ERROR);
        EXPECT_EQ(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_SUCCESS(accessControl.DeleteEntry(1));
    }

    for (auto endpoint : validEndpoints)
    {
        EXPECT_EQ(entry.SetTarget(0, { .flags = Target::kEndpoint, .endpoint = endpoint }), CHIP_NO_ERROR);
        EXPECT_EQ(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_SUCCESS(accessControl.DeleteEntry(1));
    }

    for (auto deviceType : validDeviceTypes)
    {
        EXPECT_EQ(entry.SetTarget(0, { .flags = Target::kDeviceType, .deviceType = deviceType }), CHIP_NO_ERROR);
        EXPECT_EQ(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_SUCCESS(accessControl.DeleteEntry(1));
    }

    for (auto cluster : validClusters)
    {
        for (auto endpoint : validEndpoints)
        {
            EXPECT_EQ(
                entry.SetTarget(0, { .flags = Target::kCluster | Target::kEndpoint, .cluster = cluster, .endpoint = endpoint }),
                CHIP_NO_ERROR);
            EXPECT_EQ(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
            EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
            EXPECT_SUCCESS(accessControl.DeleteEntry(1));
        }
    }

    for (auto cluster : validClusters)
    {
        for (auto deviceType : validDeviceTypes)
        {
            EXPECT_EQ(entry.SetTarget(
                          0, { .flags = Target::kCluster | Target::kDeviceType, .cluster = cluster, .deviceType = deviceType }),
                      CHIP_NO_ERROR);
            EXPECT_EQ(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
            EXPECT_EQ(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
            EXPECT_SUCCESS(accessControl.DeleteEntry(1));
        }
    }

    // Use test entry for invalid cases (to ensure it can hold invalid data)
    entry.SetDelegate(delegate);

    // Cannot target endpoint and device type
    for (auto endpoint : validEndpoints)
    {
        for (auto deviceType : validDeviceTypes)
        {
            EXPECT_EQ(entry.SetTarget(
                          0, { .flags = Target::kEndpoint | Target::kDeviceType, .endpoint = endpoint, .deviceType = deviceType }),
                      CHIP_NO_ERROR);
            EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
            EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
            EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
        }
    }

    // Cannot target all
    for (auto cluster : validClusters)
    {
        for (auto endpoint : validEndpoints)
        {
            for (auto deviceType : validDeviceTypes)
            {
                EXPECT_EQ(entry.SetTarget(0,
                                          { .flags      = Target::kCluster | Target::kEndpoint | Target::kDeviceType,
                                            .cluster    = cluster,
                                            .endpoint   = endpoint,
                                            .deviceType = deviceType }),
                          CHIP_NO_ERROR);
                EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
                EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
                EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
            }
        }
    }

    // Cannot target none
    {
        EXPECT_EQ(entry.SetTarget(0, { .flags = 0 }), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
    }

    for (auto cluster : invalidClusters)
    {
        EXPECT_EQ(entry.SetTarget(0, { .flags = Target::kCluster, .cluster = cluster }), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
    }

    for (auto endpoint : invalidEndpoints)
    {
        EXPECT_EQ(entry.SetTarget(0, { .flags = Target::kEndpoint, .endpoint = endpoint }), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
    }

    for (auto deviceType : invalidDeviceTypes)
    {
        EXPECT_EQ(entry.SetTarget(0, { .flags = Target::kDeviceType, .deviceType = deviceType }), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
        EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
    }

    for (auto cluster : invalidClusters)
    {
        for (auto endpoint : invalidEndpoints)
        {
            EXPECT_EQ(
                entry.SetTarget(0, { .flags = Target::kCluster | Target::kEndpoint, .cluster = cluster, .endpoint = endpoint }),
                CHIP_NO_ERROR);
            EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
            EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
            EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
        }
    }

    for (auto cluster : invalidClusters)
    {
        for (auto endpoint : validEndpoints)
        {
            EXPECT_EQ(
                entry.SetTarget(0, { .flags = Target::kCluster | Target::kEndpoint, .cluster = cluster, .endpoint = endpoint }),
                CHIP_NO_ERROR);
            EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
            EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
            EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
        }
    }

    for (auto cluster : validClusters)
    {
        for (auto endpoint : invalidEndpoints)
        {
            EXPECT_EQ(
                entry.SetTarget(0, { .flags = Target::kCluster | Target::kEndpoint, .cluster = cluster, .endpoint = endpoint }),
                CHIP_NO_ERROR);
            EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
            EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
            EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
        }
    }

    for (auto cluster : invalidClusters)
    {
        for (auto deviceType : invalidDeviceTypes)
        {
            EXPECT_EQ(entry.SetTarget(
                          0, { .flags = Target::kCluster | Target::kDeviceType, .cluster = cluster, .deviceType = deviceType }),
                      CHIP_NO_ERROR);
            EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
            EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
            EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
        }
    }

    for (auto cluster : invalidClusters)
    {
        for (auto deviceType : validDeviceTypes)
        {
            EXPECT_EQ(entry.SetTarget(
                          0, { .flags = Target::kCluster | Target::kDeviceType, .cluster = cluster, .deviceType = deviceType }),
                      CHIP_NO_ERROR);
            EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
            EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
            EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
        }
    }

    for (auto cluster : validClusters)
    {
        for (auto deviceType : invalidDeviceTypes)
        {
            EXPECT_EQ(entry.SetTarget(
                          0, { .flags = Target::kCluster | Target::kDeviceType, .cluster = cluster, .deviceType = deviceType }),
                      CHIP_NO_ERROR);
            EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
            EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
            EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
        }
    }

    for (auto endpoint : invalidEndpoints)
    {
        for (auto deviceType : invalidDeviceTypes)
        {
            EXPECT_EQ(entry.SetTarget(
                          0, { .flags = Target::kEndpoint | Target::kDeviceType, .endpoint = endpoint, .deviceType = deviceType }),
                      CHIP_NO_ERROR);
            EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
            EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
            EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
        }
    }

    for (auto endpoint : invalidEndpoints)
    {
        for (auto deviceType : validDeviceTypes)
        {
            EXPECT_EQ(entry.SetTarget(
                          0, { .flags = Target::kEndpoint | Target::kDeviceType, .endpoint = endpoint, .deviceType = deviceType }),
                      CHIP_NO_ERROR);
            EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
            EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
            EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
        }
    }

    for (auto endpoint : validEndpoints)
    {
        for (auto deviceType : invalidDeviceTypes)
        {
            EXPECT_EQ(entry.SetTarget(
                          0, { .flags = Target::kEndpoint | Target::kDeviceType, .endpoint = endpoint, .deviceType = deviceType }),
                      CHIP_NO_ERROR);
            EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
            EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
            EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
        }
    }

    for (auto cluster : invalidClusters)
    {
        for (auto endpoint : invalidEndpoints)
        {
            for (auto deviceType : invalidDeviceTypes)
            {
                EXPECT_EQ(entry.SetTarget(0,
                                          { .flags      = Target::kCluster | Target::kEndpoint | Target::kDeviceType,
                                            .cluster    = cluster,
                                            .endpoint   = endpoint,
                                            .deviceType = deviceType }),
                          CHIP_NO_ERROR);
                EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
                EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
                EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
            }
        }
    }

    for (auto cluster : invalidClusters)
    {
        for (auto endpoint : invalidEndpoints)
        {
            for (auto deviceType : validDeviceTypes)
            {
                EXPECT_EQ(entry.SetTarget(0,
                                          { .flags      = Target::kCluster | Target::kEndpoint | Target::kDeviceType,
                                            .cluster    = cluster,
                                            .endpoint   = endpoint,
                                            .deviceType = deviceType }),
                          CHIP_NO_ERROR);
                EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
                EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
                EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
            }
        }
    }

    for (auto cluster : invalidClusters)
    {
        for (auto endpoint : validEndpoints)
        {
            for (auto deviceType : invalidDeviceTypes)
            {
                EXPECT_EQ(entry.SetTarget(0,
                                          { .flags      = Target::kCluster | Target::kEndpoint | Target::kDeviceType,
                                            .cluster    = cluster,
                                            .endpoint   = endpoint,
                                            .deviceType = deviceType }),
                          CHIP_NO_ERROR);
                EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
                EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
                EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
            }
        }
    }

    for (auto cluster : validClusters)
    {
        for (auto endpoint : invalidEndpoints)
        {
            for (auto deviceType : invalidDeviceTypes)
            {
                EXPECT_EQ(entry.SetTarget(0,
                                          { .flags      = Target::kCluster | Target::kEndpoint | Target::kDeviceType,
                                            .cluster    = cluster,
                                            .endpoint   = endpoint,
                                            .deviceType = deviceType }),
                          CHIP_NO_ERROR);
                EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
                EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
                EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
            }
        }
    }

    for (auto cluster : invalidClusters)
    {
        for (auto endpoint : validEndpoints)
        {
            for (auto deviceType : validDeviceTypes)
            {
                EXPECT_EQ(entry.SetTarget(0,
                                          { .flags      = Target::kCluster | Target::kEndpoint | Target::kDeviceType,
                                            .cluster    = cluster,
                                            .endpoint   = endpoint,
                                            .deviceType = deviceType }),
                          CHIP_NO_ERROR);
                EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
                EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
                EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
            }
        }
    }

    for (auto cluster : validClusters)
    {
        for (auto endpoint : invalidEndpoints)
        {
            for (auto deviceType : validDeviceTypes)
            {
                EXPECT_EQ(entry.SetTarget(0,
                                          { .flags      = Target::kCluster | Target::kEndpoint | Target::kDeviceType,
                                            .cluster    = cluster,
                                            .endpoint   = endpoint,
                                            .deviceType = deviceType }),
                          CHIP_NO_ERROR);
                EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
                EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
                EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
            }
        }
    }

    for (auto cluster : validClusters)
    {
        for (auto endpoint : validEndpoints)
        {
            for (auto deviceType : invalidDeviceTypes)
            {
                EXPECT_EQ(entry.SetTarget(0,
                                          { .flags      = Target::kCluster | Target::kEndpoint | Target::kDeviceType,
                                            .cluster    = cluster,
                                            .endpoint   = endpoint,
                                            .deviceType = deviceType }),
                          CHIP_NO_ERROR);
                EXPECT_NE(accessControl.UpdateEntry(0, entry), CHIP_NO_ERROR);
                EXPECT_NE(accessControl.CreateEntry(nullptr, entry), CHIP_NO_ERROR);
                EXPECT_NE(accessControl.DeleteEntry(1), CHIP_NO_ERROR);
            }
        }
    }
}

TEST_F(TestAccessControl, TestCheck)
{
    EXPECT_SUCCESS(LoadAccessControl(accessControl, entryData1, entryData1Count));
    for (const auto & checkData : checkData1)
    {
        CHIP_ERROR expectedResult = checkData.allow ? CHIP_NO_ERROR : CHIP_ERROR_ACCESS_DENIED;
        auto requestPath          = checkData.requestPath;
#if CHIP_CONFIG_USE_ACCESS_RESTRICTIONS
        requestPath.requestType = Access::RequestType::kAttributeReadRequest;
#endif
        EXPECT_EQ(accessControl.Check(checkData.subjectDescriptor, requestPath, checkData.privilege), expectedResult);
    }
}

TEST_F(TestAccessControl, TestCreateReadEntry)
{
    for (size_t i = 0; i < entryData1Count; ++i)
    {
        EXPECT_EQ(LoadAccessControl(accessControl, entryData1 + i, 1), CHIP_NO_ERROR);
        EXPECT_EQ(CompareAccessControl(accessControl, entryData1, i + 1), CHIP_NO_ERROR);
    }
}

TEST_F(TestAccessControl, TestDeleteEntry)
{
    EntryData data[entryData1Count];
    for (size_t pos = 0; pos < MATTER_ARRAY_SIZE(data); ++pos)
    {
        for (size_t count = MATTER_ARRAY_SIZE(data) - pos; count > 0; --count)
        {
            memcpy(data, entryData1, sizeof(data));
            EXPECT_EQ(ClearAccessControl(accessControl), CHIP_NO_ERROR);
            EXPECT_EQ(LoadAccessControl(accessControl, data, MATTER_ARRAY_SIZE(data)), CHIP_NO_ERROR);

            memmove(&data[pos], &data[pos + count], (MATTER_ARRAY_SIZE(data) - count - pos) * sizeof(data[0]));

            for (size_t i = 0; i < count; ++i)
            {
                EXPECT_EQ(accessControl.DeleteEntry(pos), CHIP_NO_ERROR);
            }

            EXPECT_EQ(CompareAccessControl(accessControl, data, MATTER_ARRAY_SIZE(data) - count), CHIP_NO_ERROR);
        }
    }

    // Test fabric removal
    {
        memcpy(data, entryData1, sizeof(data));
        EXPECT_EQ(ClearAccessControl(accessControl), CHIP_NO_ERROR);
        EXPECT_EQ(LoadAccessControl(accessControl, data, MATTER_ARRAY_SIZE(data)), CHIP_NO_ERROR);

        // After deleting Fabric index 1, we should have the number of entries of Fabric index 2
        EXPECT_EQ(accessControl.DeleteAllEntriesForFabric(1), CHIP_NO_ERROR);
        size_t numEntriesForFabricIndex2 = 0;
        size_t numTotalEntries           = 0;
        EXPECT_EQ(accessControl.GetEntryCount(2, numEntriesForFabricIndex2), CHIP_NO_ERROR);
        EXPECT_EQ(accessControl.GetEntryCount(numTotalEntries), CHIP_NO_ERROR);
        EXPECT_EQ(numEntriesForFabricIndex2, kNumFabric2EntriesInEntryData1);
        EXPECT_EQ(numTotalEntries, kNumFabric2EntriesInEntryData1);

        // Delete fabric 2 as well, we should be at zero
        numTotalEntries = 1000;
        EXPECT_EQ(accessControl.DeleteAllEntriesForFabric(2), CHIP_NO_ERROR);
        EXPECT_EQ(accessControl.GetEntryCount(numTotalEntries), CHIP_NO_ERROR);
        EXPECT_EQ(numTotalEntries, 0u);
    }
}

TEST_F(TestAccessControl, TestFabricFilteredCreateEntry)
{
    for (auto & fabricIndex : fabricIndexes)
    {
        for (size_t count = 0; count < entryData1Count; ++count)
        {
            EXPECT_EQ(ClearAccessControl(accessControl), CHIP_NO_ERROR);
            EXPECT_EQ(LoadAccessControl(accessControl, entryData1, count), CHIP_NO_ERROR);

            constexpr size_t expectedIndexes[][entryData1Count] = {
                { 0, 1, 2, 2, 3, 3, 3, 4, 4 },
                { 0, 0, 0, 1, 1, 2, 3, 3, 4 },
                { 0, 0, 0, 0, 0, 0, 0, 0, 0 },
            };
            const size_t expectedIndex = expectedIndexes[&fabricIndex - fabricIndexes][count];

            Entry entry;
            EXPECT_EQ(accessControl.PrepareEntry(entry), CHIP_NO_ERROR);
            EXPECT_EQ(entry.SetFabricIndex(fabricIndex), CHIP_NO_ERROR);
            EXPECT_EQ(entry.SetAuthMode(AuthMode::kCase), CHIP_NO_ERROR);

            size_t outIndex            = 999;
            FabricIndex outFabricIndex = 123;
            EXPECT_EQ(accessControl.CreateEntry(&outIndex, entry, &outFabricIndex), CHIP_NO_ERROR);

            EXPECT_EQ(outIndex, expectedIndex);
            EXPECT_EQ(outFabricIndex, fabricIndex);
        }
    }
}

TEST_F(TestAccessControl, TestFabricFilteredReadEntry)
{
    EXPECT_EQ(LoadAccessControl(accessControl, entryData1, entryData1Count), CHIP_NO_ERROR);

    for (auto & fabricIndex : fabricIndexes)
    {
        constexpr size_t indexes[] = { 0, 1, 2, 3, 4, 5 };
        for (auto & index : indexes)
        {
            constexpr size_t illegalIndex                                  = entryData1Count;
            constexpr size_t expectedIndexes[][MATTER_ARRAY_SIZE(indexes)] = {
                { 0, 1, 3, 6, illegalIndex, illegalIndex },
                { 2, 4, 5, 7, 8, illegalIndex },
                { illegalIndex, illegalIndex, illegalIndex, illegalIndex, illegalIndex, illegalIndex },
            };
            const size_t expectedIndex = expectedIndexes[&fabricIndex - fabricIndexes][&index - indexes];

            Entry entry;
            CHIP_ERROR err = accessControl.ReadEntry(index, entry, &fabricIndex);

            if (expectedIndex != illegalIndex)
            {
                EXPECT_EQ(err, CHIP_NO_ERROR);
                EXPECT_EQ(CompareEntry(entry, entryData1[expectedIndex]), CHIP_NO_ERROR);
            }
            else
            {
                EXPECT_NE(err, CHIP_NO_ERROR);
            }
        }
    }
}

TEST_F(TestAccessControl, TestGroupAuxiliaryDelegateInit)
{
    Credentials::GroupDataProvider * provider = Credentials::GetGroupDataProvider();
    ASSERT_NE(provider, nullptr);

    Examples::GroupAuxiliaryAccessControlDelegateImpl delegate;
    EXPECT_FALSE(delegate.IsInitialized());

    // Null GroupDataProvider is rejected.
    EXPECT_EQ(delegate.Initialize(nullptr, nullptr), CHIP_ERROR_INVALID_ARGUMENT);
    EXPECT_FALSE(delegate.IsInitialized());

    // First Initialize succeeds; IsInitialized flips to true.
    EXPECT_EQ(delegate.Initialize(provider, nullptr), CHIP_NO_ERROR);
    EXPECT_TRUE(delegate.IsInitialized());

    // Double Initialize is rejected.
    EXPECT_EQ(delegate.Initialize(provider, nullptr), CHIP_ERROR_INCORRECT_STATE);
    EXPECT_TRUE(delegate.IsInitialized());

    delegate.Shutdown();
    EXPECT_FALSE(delegate.IsInitialized());
}

TEST_F(TestAccessControl, TestGroupAuxiliaryDelegateLifecycle)
{
    Credentials::GroupDataProvider * provider = Credentials::GetGroupDataProvider();
    ASSERT_NE(provider, nullptr);

    Examples::GroupAuxiliaryAccessControlDelegateImpl delegate;

    // AuxiliaryEntries before Initialize returns CHIP_ERROR_INCORRECT_STATE.
    {
        EntryIterator iterator;
        EXPECT_EQ(delegate.AuxiliaryEntries(iterator, nullptr), CHIP_ERROR_INCORRECT_STATE);
    }

    // Shutdown on an uninitialized delegate is a safe no-op.
    delegate.Shutdown();
    EXPECT_FALSE(delegate.IsInitialized());

    // Shutdown after Initialize resets state and re-Initialize succeeds.
    EXPECT_EQ(delegate.Initialize(provider, nullptr), CHIP_NO_ERROR);
    EXPECT_TRUE(delegate.IsInitialized());

    delegate.Shutdown();
    EXPECT_FALSE(delegate.IsInitialized());

    // AuxiliaryEntries fails again after Shutdown.
    {
        EntryIterator iterator;
        EXPECT_EQ(delegate.AuxiliaryEntries(iterator, nullptr), CHIP_ERROR_INCORRECT_STATE);
    }

    // Re-Initialize after Shutdown works.
    EXPECT_EQ(delegate.Initialize(provider, nullptr), CHIP_NO_ERROR);
    EXPECT_TRUE(delegate.IsInitialized());

    delegate.Shutdown();
}

TEST_F(TestAccessControl, TestGroupAuxiliaryDelegateRegistration)
{
    // The delegate is already registered in SetUpTestSuite.
    AccessControl::Delegate * delegate = &gGroupAuxiliaryAccessControlDelegate;

    // Verify registering again fails.
    EXPECT_EQ(accessControl.RegisterGroupAuxiliaryDelegate(delegate), CHIP_ERROR_INCORRECT_STATE);

    // Verify unregistration.
    accessControl.UnregisterGroupAuxiliaryDelegate();

    // Verify AuxiliaryEntries returns CHIP_ERROR_INCORRECT_STATE when no delegate is registered.
    EntryIterator iterator;
    EXPECT_EQ(accessControl.AuxiliaryEntries(1, iterator), CHIP_ERROR_NOT_IMPLEMENTED);

    // Verify registration again after unregistration.
    EXPECT_EQ(accessControl.RegisterGroupAuxiliaryDelegate(delegate), CHIP_NO_ERROR);
}

TEST_F(TestAccessControl, TestGroupAuxiliaryEntries)
{
    // Ensure GroupDataProvider is available
    Credentials::GroupDataProvider * provider = Credentials::GetGroupDataProvider();
    ASSERT_NE(provider, nullptr);

    FabricIndex fabric1 = 1;
    FabricIndex fabric2 = 2;

    // Set up group 1 data for fabric 1
    {
        Credentials::GroupDataProvider::GroupInfo info;
        info.group_id = 0x1111;
        info.SetName("Group 1");
        info.flags = to_underlying(Credentials::GroupDataProvider::GroupInfo::Flags::kHasAuxiliaryACL);
        EXPECT_EQ(provider->SetGroupInfo(fabric1, info), CHIP_NO_ERROR);
        EXPECT_EQ(provider->AddEndpoint(fabric1, info.group_id, 10), CHIP_NO_ERROR);
    }

    // Set up group 2 data for fabric 1
    {
        Credentials::GroupDataProvider::GroupInfo info;
        info.group_id = 0x2222;
        info.SetName("Group 2");
        info.flags = to_underlying(Credentials::GroupDataProvider::GroupInfo::Flags::kHasAuxiliaryACL);
        EXPECT_EQ(provider->SetGroupInfo(fabric1, info), CHIP_NO_ERROR);
        EXPECT_EQ(provider->AddEndpoint(fabric1, info.group_id, 20), CHIP_NO_ERROR);
    }

    // Set up group data for fabric 2
    {
        Credentials::GroupDataProvider::GroupInfo info;
        info.group_id = 0x3333;
        info.SetName("Group 3");
        info.flags = to_underlying(Credentials::GroupDataProvider::GroupInfo::Flags::kHasAuxiliaryACL);
        EXPECT_EQ(provider->SetGroupInfo(fabric2, info), CHIP_NO_ERROR);
        EXPECT_EQ(provider->AddEndpoint(fabric2, info.group_id, 30), CHIP_NO_ERROR);
        EXPECT_EQ(provider->AddEndpoint(fabric2, info.group_id, 40), CHIP_NO_ERROR);
    }

    // Set up group data for fabric 2, WITHOUT kHasAuxiliaryACL. This group information
    // should not appear in any auxiliary ACL entry.
    {
        Credentials::GroupDataProvider::GroupInfo info;
        info.group_id = 0x4444;
        info.SetName("Group 4");
        EXPECT_EQ(provider->SetGroupInfo(fabric2, info), CHIP_NO_ERROR);
        EXPECT_EQ(provider->AddEndpoint(fabric2, info.group_id, 50), CHIP_NO_ERROR);
    }

    // Define Golden Sets (The base equivalence classes) that are expected
    std::set<AuxiliaryEquivalenceEntry> expectedFabric1 = { { .fabricIndex = fabric1, .groupId = 0x1111, .endpointId = 10 },
                                                            { .fabricIndex = fabric1, .groupId = 0x2222, .endpointId = 20 } };

    std::set<AuxiliaryEquivalenceEntry> expectedFabric2 = {
        { .fabricIndex = fabric2, .groupId = 0x3333, .endpointId = 30 },
        { .fabricIndex = fabric2, .groupId = 0x3333, .endpointId = 40 },
    };

    // Execute Validation
    ValidateAuxiliaryEntries(accessControl, fabric1, expectedFabric1);
    ValidateAuxiliaryEntries(accessControl, fabric2, expectedFabric2);

    // Cleanup
    EXPECT_EQ(provider->RemoveFabric(fabric1), CHIP_NO_ERROR);
    EXPECT_EQ(provider->RemoveFabric(fabric2), CHIP_NO_ERROR);
}

TEST_F(TestAccessControl, TestGroupAuxiliaryEntriesAllFabrics)
{
    // Ensure GroupDataProvider is available
    Credentials::GroupDataProvider * provider = Credentials::GetGroupDataProvider();
    ASSERT_NE(provider, nullptr);

    FabricIndex fabric1 = 1;
    FabricIndex fabric2 = 2;

    // Set up group data for fabric 1
    {
        Credentials::GroupDataProvider::GroupInfo info;
        info.group_id = 0x1111;
        info.flags    = to_underlying(Credentials::GroupDataProvider::GroupInfo::Flags::kHasAuxiliaryACL);
        EXPECT_EQ(provider->SetGroupInfo(fabric1, info), CHIP_NO_ERROR);
        EXPECT_EQ(provider->AddEndpoint(fabric1, info.group_id, 10), CHIP_NO_ERROR);
    }

    // Set up group data for fabric 2
    {
        Credentials::GroupDataProvider::GroupInfo info;
        info.group_id = 0x2222;
        info.flags    = to_underlying(Credentials::GroupDataProvider::GroupInfo::Flags::kHasAuxiliaryACL);
        EXPECT_EQ(provider->SetGroupInfo(fabric2, info), CHIP_NO_ERROR);
        EXPECT_EQ(provider->AddEndpoint(fabric2, info.group_id, 20), CHIP_NO_ERROR);
    }

    // Define expected set across all fabrics
    std::set<AuxiliaryEquivalenceEntry> expectedAll = { { .fabricIndex = fabric1, .groupId = 0x1111, .endpointId = 10 },
                                                        { .fabricIndex = fabric2, .groupId = 0x2222, .endpointId = 20 } };

    // Path 1: Manual iteration (no FabricTable)
    {
        // Unregister global delegate first
        GetAccessControl().UnregisterGroupAuxiliaryDelegate();

        Examples::GroupAuxiliaryAccessControlDelegateImpl manualDelegate;
        EXPECT_EQ(manualDelegate.Initialize(provider, nullptr), CHIP_NO_ERROR);
        EXPECT_EQ(GetAccessControl().RegisterGroupAuxiliaryDelegate(&manualDelegate), CHIP_NO_ERROR);

        ValidateAuxiliaryEntries(accessControl, kUndefinedFabricIndex, expectedAll);
        GetAccessControl().UnregisterGroupAuxiliaryDelegate();
    }

    // Path 2: FabricTable iteration
    {
        // Setup a test Fabric Table
        PersistentStorageOperationalKeystore opKeyStore;
        Credentials::PersistentStorageOpCertStore opCertStore;
        FabricTable fabricTable;

        EXPECT_EQ(opKeyStore.Init(&gTestStorage), CHIP_NO_ERROR);
        EXPECT_EQ(opCertStore.Init(&gTestStorage), CHIP_NO_ERROR);

        FabricTable::InitParams initParams;
        initParams.storage             = &gTestStorage;
        initParams.operationalKeystore = &opKeyStore;
        initParams.opCertStore         = &opCertStore;
        EXPECT_EQ(fabricTable.Init(initParams), CHIP_NO_ERROR);

        FabricIndex f1, f2;
        EXPECT_EQ(fabricTable.AddNewFabricForTestIgnoringCollisions(
                      TestCerts::GetRootACertAsset().mCert, TestCerts::GetIAA1CertAsset().mCert,
                      TestCerts::GetNodeA1CertAsset().mCert, TestCerts::GetNodeA1CertAsset().mKey, &f1),
                  CHIP_NO_ERROR);
        EXPECT_EQ(fabricTable.AddNewFabricForTestIgnoringCollisions(
                      TestCerts::GetRootACertAsset().mCert, TestCerts::GetIAA1CertAsset().mCert,
                      TestCerts::GetNodeA2CertAsset().mCert, TestCerts::GetNodeA2CertAsset().mKey, &f2),
                  CHIP_NO_ERROR);

        // Create GroupAuxiliaryAccessControlDelegate with fabric table
        Examples::GroupAuxiliaryAccessControlDelegateImpl tableDelegate;
        EXPECT_EQ(tableDelegate.Initialize(provider, &fabricTable), CHIP_NO_ERROR);
        EXPECT_EQ(GetAccessControl().RegisterGroupAuxiliaryDelegate(&tableDelegate), CHIP_NO_ERROR);

        // Validate entries
        ValidateAuxiliaryEntries(accessControl, kUndefinedFabricIndex, expectedAll);

        // Cleanup
        GetAccessControl().UnregisterGroupAuxiliaryDelegate();
        fabricTable.Shutdown();
        opCertStore.Finish();
        opKeyStore.Finish();
    }

    // Restore global delegate for other tests
    EXPECT_EQ(GetAccessControl().RegisterGroupAuxiliaryDelegate(&gGroupAuxiliaryAccessControlDelegate), CHIP_NO_ERROR);

    // Cleanup
    EXPECT_EQ(provider->RemoveFabric(fabric1), CHIP_NO_ERROR);
    EXPECT_EQ(provider->RemoveFabric(fabric2), CHIP_NO_ERROR);
}

TEST_F(TestAccessControl, TestGroupAuxiliaryCheck)
{
    // Ensure GroupDataProvider is available
    Credentials::GroupDataProvider * provider = Credentials::GetGroupDataProvider();
    ASSERT_NE(provider, nullptr);

    // Set up group 1 data for fabric 1
    {
        Credentials::GroupDataProvider::GroupInfo info;
        info.group_id = 0x1111;
        info.SetName("Group 1");
        info.flags = to_underlying(Credentials::GroupDataProvider::GroupInfo::Flags::kHasAuxiliaryACL);
        EXPECT_EQ(provider->SetGroupInfo(1, info), CHIP_NO_ERROR);
        EXPECT_EQ(provider->AddEndpoint(1, info.group_id, 10), CHIP_NO_ERROR);
        // Noramally, Endpoint 0 should not be allowed to join a group. Test will confirm access control
        // checks with this fail.
        EXPECT_EQ(provider->AddEndpoint(1, info.group_id, 0), CHIP_NO_ERROR);
    }

    // Set up group 2 data for fabric 1, with no kHasAuxiliaryACL
    {
        Credentials::GroupDataProvider::GroupInfo info;
        info.group_id = 0x2222;
        info.SetName("Group 2");
        EXPECT_EQ(provider->SetGroupInfo(1, info), CHIP_NO_ERROR);
        EXPECT_EQ(provider->AddEndpoint(1, info.group_id, 20), CHIP_NO_ERROR);
    }

    // Set up group 3 data for fabric 2
    {
        Credentials::GroupDataProvider::GroupInfo info;
        info.group_id = 0x3333;
        info.SetName("Group 3");
        info.flags = to_underlying(Credentials::GroupDataProvider::GroupInfo::Flags::kHasAuxiliaryACL);
        EXPECT_EQ(provider->SetGroupInfo(2, info), CHIP_NO_ERROR);
        EXPECT_EQ(provider->AddEndpoint(2, info.group_id, 30), CHIP_NO_ERROR);
    }

    // Set up group 4 data for fabric 2, with no kHasAuxiliaryACL
    {
        Credentials::GroupDataProvider::GroupInfo info;
        info.group_id = 0x4444;
        info.SetName("Group 4");
        EXPECT_EQ(provider->SetGroupInfo(2, info), CHIP_NO_ERROR);
        EXPECT_EQ(provider->AddEndpoint(2, info.group_id, 40), CHIP_NO_ERROR);
    }

    for (const auto & data : groupCheckData)
    {
        if (data.expectedResult.HasValue())
        {
            EXPECT_EQ(accessControl.Check(data.subjectDescriptor, data.requestPath, data.privilege), data.expectedResult.Value());
        }
        else
        {
            EXPECT_NE(accessControl.Check(data.subjectDescriptor, data.requestPath, data.privilege), CHIP_NO_ERROR);
        }
    }

    // Cleanup
    EXPECT_EQ(provider->RemoveFabric(1), CHIP_NO_ERROR);
    EXPECT_EQ(provider->RemoveFabric(2), CHIP_NO_ERROR);
}

TEST_F(TestAccessControl, TestIterator)
{
    EXPECT_SUCCESS(LoadAccessControl(accessControl, entryData1, entryData1Count));

    FabricIndex fabricIndex;
    EntryIterator iterator;
    Entry entry;
    size_t count;

    EXPECT_EQ(accessControl.Entries(iterator), CHIP_NO_ERROR);
    count = 0;
    while (iterator.Next(entry) == CHIP_NO_ERROR)
    {
        EXPECT_EQ(CompareEntry(entry, entryData1[count]), CHIP_NO_ERROR);
        count++;
    }
    EXPECT_EQ(count, entryData1Count);

    fabricIndex = kUndefinedFabricIndex;
    EXPECT_EQ(accessControl.Entries(iterator, &fabricIndex), CHIP_NO_ERROR);
    EXPECT_NE(iterator.Next(entry), CHIP_NO_ERROR);

    fabricIndex = 1;
    EXPECT_EQ(accessControl.Entries(iterator, &fabricIndex), CHIP_NO_ERROR);
    size_t fabric1[] = { 0, 1, 3, 6 };
    count            = 0;
    while (iterator.Next(entry) == CHIP_NO_ERROR)
    {
        EXPECT_EQ(CompareEntry(entry, entryData1[fabric1[count]]), CHIP_NO_ERROR);
        count++;
    }
    EXPECT_EQ(count, MATTER_ARRAY_SIZE(fabric1));

    fabricIndex = 2;
    EXPECT_EQ(accessControl.Entries(iterator, &fabricIndex), CHIP_NO_ERROR);
    size_t fabric2[] = { 2, 4, 5, 7, 8 };
    count            = 0;
    while (iterator.Next(entry) == CHIP_NO_ERROR)
    {
        EXPECT_EQ(CompareEntry(entry, entryData1[fabric2[count]]), CHIP_NO_ERROR);
        count++;
    }
    EXPECT_EQ(count, MATTER_ARRAY_SIZE(fabric2));
}

TEST_F(TestAccessControl, TestPrepareEntry)
{
    Entry entry;
    for (auto authMode : authModes)
    {
        for (auto fabricIndex : fabricIndexes)
        {
            for (auto privilege : privileges)
            {
                EXPECT_EQ(accessControl.PrepareEntry(entry), CHIP_NO_ERROR);

                size_t subjectCount = 0;
                size_t targetCount  = 0;

                EXPECT_EQ(entry.GetSubjectCount(subjectCount), CHIP_NO_ERROR);
                EXPECT_EQ(entry.GetTargetCount(targetCount), CHIP_NO_ERROR);

                EXPECT_EQ(subjectCount, 0u);
                EXPECT_EQ(targetCount, 0u);

                EXPECT_EQ(entry.SetAuthMode(authMode), CHIP_NO_ERROR);
                EXPECT_EQ(entry.SetFabricIndex(fabricIndex), CHIP_NO_ERROR);
                EXPECT_EQ(entry.SetPrivilege(privilege), CHIP_NO_ERROR);

                int subjectIndex;
                switch (authMode)
                {
                default:
                case AuthMode::kCase:
                    subjectIndex = 0;
                    break;
                case AuthMode::kGroup:
                    subjectIndex = 1;
                    break;
                }

                for (auto subject : subjects[subjectIndex])
                {
                    EXPECT_EQ(entry.AddSubject(nullptr, subject), CHIP_NO_ERROR);
                }

                for (auto & target : targets)
                {
                    EXPECT_EQ(entry.AddTarget(nullptr, target), CHIP_NO_ERROR);
                }

                AuthMode a;
                FabricIndex f;
                Privilege p;

                EXPECT_EQ(entry.GetAuthMode(a), CHIP_NO_ERROR);
                EXPECT_EQ(entry.GetFabricIndex(f), CHIP_NO_ERROR);
                EXPECT_EQ(entry.GetPrivilege(p), CHIP_NO_ERROR);

                EXPECT_EQ(a, authMode);
                EXPECT_EQ(f, fabricIndex);
                EXPECT_EQ(p, privilege);

                EXPECT_EQ(entry.GetSubjectCount(subjectCount), CHIP_NO_ERROR);
                EXPECT_EQ(entry.GetTargetCount(targetCount), CHIP_NO_ERROR);

                EXPECT_EQ(subjectCount, MATTER_ARRAY_SIZE(subjects[0]));
                EXPECT_EQ(targetCount, MATTER_ARRAY_SIZE(targets));

                for (size_t i = 0; i < MATTER_ARRAY_SIZE(subjects[subjectIndex]); ++i)
                {
                    NodeId n;
                    EXPECT_EQ(entry.GetSubject(i, n), CHIP_NO_ERROR);
                    EXPECT_EQ(n, subjects[subjectIndex][i]);
                }

                for (size_t i = 0; i < MATTER_ARRAY_SIZE(targets); ++i)
                {
                    Target t;
                    EXPECT_EQ(entry.GetTarget(i, t), CHIP_NO_ERROR);
                    EXPECT_EQ(t, targets[i]);
                }
            }
        }
    }
}

TEST_F(TestAccessControl, TestSubjectsTargets)
{
    Entry entry;
    size_t index;

    EXPECT_EQ(accessControl.PrepareEntry(entry), CHIP_NO_ERROR);
    EXPECT_EQ(entry.SetFabricIndex(1), CHIP_NO_ERROR);
    EXPECT_EQ(entry.SetPrivilege(Privilege::kAdminister), CHIP_NO_ERROR);
    EXPECT_EQ(entry.SetAuthMode(AuthMode::kCase), CHIP_NO_ERROR);
    EXPECT_EQ(entry.AddTarget(nullptr, { Target::kCluster, 1, 0, 0 }), CHIP_NO_ERROR);
    index = 999;
    EXPECT_EQ(accessControl.CreateEntry(&index, entry), CHIP_NO_ERROR);
    EXPECT_EQ(index, 0u);

    EXPECT_EQ(accessControl.PrepareEntry(entry), CHIP_NO_ERROR);
    EXPECT_EQ(entry.SetFabricIndex(2), CHIP_NO_ERROR);
    EXPECT_EQ(entry.SetPrivilege(Privilege::kManage), CHIP_NO_ERROR);
    EXPECT_EQ(entry.SetAuthMode(AuthMode::kCase), CHIP_NO_ERROR);
    EXPECT_EQ(entry.AddSubject(nullptr, kOperationalNodeId1), CHIP_NO_ERROR);
    EXPECT_EQ(entry.AddTarget(nullptr, { Target::kEndpoint, 0, 2, 0 }), CHIP_NO_ERROR);
    index = 999;
    EXPECT_EQ(accessControl.CreateEntry(&index, entry), CHIP_NO_ERROR);
    EXPECT_EQ(index, 1u);

    EXPECT_EQ(accessControl.PrepareEntry(entry), CHIP_NO_ERROR);
    EXPECT_EQ(entry.SetFabricIndex(3), CHIP_NO_ERROR);
    EXPECT_EQ(entry.SetPrivilege(Privilege::kOperate), CHIP_NO_ERROR);
    EXPECT_EQ(entry.SetAuthMode(AuthMode::kGroup), CHIP_NO_ERROR);
    EXPECT_EQ(entry.AddSubject(nullptr, kGroup2), CHIP_NO_ERROR);
    EXPECT_EQ(entry.AddTarget(nullptr, { Target::kCluster, 2, 0, 0 }), CHIP_NO_ERROR);
    index = 999;
    EXPECT_EQ(accessControl.CreateEntry(&index, entry), CHIP_NO_ERROR);
    EXPECT_EQ(index, 2u);

    FabricIndex fabricIndex = 0;
    Privilege privilege     = Privilege::kView;
    AuthMode authMode       = AuthMode::kNone;
    size_t count            = 0;
    NodeId subject          = kUndefinedNodeId;
    Target target;

    EXPECT_EQ(accessControl.ReadEntry(0, entry), CHIP_NO_ERROR);
    EXPECT_EQ(entry.GetFabricIndex(fabricIndex), CHIP_NO_ERROR);
    EXPECT_EQ(fabricIndex, 1);
    EXPECT_EQ(entry.GetPrivilege(privilege), CHIP_NO_ERROR);
    EXPECT_EQ(privilege, Privilege::kAdminister);
    EXPECT_EQ(entry.GetAuthMode(authMode), CHIP_NO_ERROR);
    EXPECT_EQ(authMode, AuthMode::kCase);
    EXPECT_EQ(entry.GetSubjectCount(count), CHIP_NO_ERROR);
    EXPECT_EQ(count, 0u);
    EXPECT_EQ(entry.GetTargetCount(count), CHIP_NO_ERROR);
    EXPECT_EQ(count, 1u);
    EXPECT_EQ(entry.GetTarget(0, target), CHIP_NO_ERROR);
    EXPECT_EQ(target.flags, Target::kCluster);
    EXPECT_EQ(target.cluster, 1u);

    EXPECT_EQ(accessControl.ReadEntry(1, entry), CHIP_NO_ERROR);
    EXPECT_EQ(entry.GetFabricIndex(fabricIndex), CHIP_NO_ERROR);
    EXPECT_EQ(fabricIndex, 2);
    EXPECT_EQ(entry.GetPrivilege(privilege), CHIP_NO_ERROR);
    EXPECT_EQ(privilege, Privilege::kManage);
    EXPECT_EQ(entry.GetAuthMode(authMode), CHIP_NO_ERROR);
    EXPECT_EQ(authMode, AuthMode::kCase);
    EXPECT_EQ(entry.GetSubjectCount(count), CHIP_NO_ERROR);
    EXPECT_EQ(count, 1u);
    EXPECT_EQ(entry.GetSubject(0, subject), CHIP_NO_ERROR);
    EXPECT_EQ(subject, kOperationalNodeId1);
    EXPECT_EQ(entry.GetTargetCount(count), CHIP_NO_ERROR);
    EXPECT_EQ(count, 1u);
    EXPECT_EQ(entry.GetTarget(0, target), CHIP_NO_ERROR);
    EXPECT_EQ(target.flags, Target::kEndpoint);
    EXPECT_EQ(target.endpoint, 2);

    EXPECT_EQ(accessControl.ReadEntry(2, entry), CHIP_NO_ERROR);
    EXPECT_EQ(entry.GetFabricIndex(fabricIndex), CHIP_NO_ERROR);
    EXPECT_EQ(fabricIndex, 3);
    EXPECT_EQ(entry.GetPrivilege(privilege), CHIP_NO_ERROR);
    EXPECT_EQ(privilege, Privilege::kOperate);
    EXPECT_EQ(entry.GetAuthMode(authMode), CHIP_NO_ERROR);
    EXPECT_EQ(authMode, AuthMode::kGroup);
    EXPECT_EQ(entry.GetSubjectCount(count), CHIP_NO_ERROR);
    EXPECT_EQ(count, 1u);
    EXPECT_EQ(entry.GetSubject(0, subject), CHIP_NO_ERROR);
    EXPECT_EQ(subject, kGroup2);
    EXPECT_EQ(entry.GetTargetCount(count), CHIP_NO_ERROR);
    EXPECT_EQ(count, 1u);
    EXPECT_EQ(entry.GetTarget(0, target), CHIP_NO_ERROR);
    EXPECT_EQ(target.flags, Target::kCluster);
    EXPECT_EQ(target.cluster, 2u);

    EXPECT_EQ(accessControl.PrepareEntry(entry), CHIP_NO_ERROR);

    EXPECT_EQ(entry.SetFabricIndex(11), CHIP_NO_ERROR);
    EXPECT_EQ(entry.SetPrivilege(Privilege::kProxyView), CHIP_NO_ERROR);
    EXPECT_EQ(entry.SetAuthMode(AuthMode::kCase), CHIP_NO_ERROR);

    EXPECT_EQ(entry.AddSubject(nullptr, 0x11111111AAAAAAAA), CHIP_NO_ERROR);
    EXPECT_EQ(entry.AddSubject(nullptr, 0x22222222BBBBBBBB), CHIP_NO_ERROR);
    EXPECT_EQ(entry.AddSubject(nullptr, 0x33333333CCCCCCCC), CHIP_NO_ERROR);

    EXPECT_EQ(entry.AddTarget(nullptr, { Target::kCluster | Target::kEndpoint, 11, 22, 0 }), CHIP_NO_ERROR);
    EXPECT_EQ(entry.AddTarget(nullptr, { Target::kCluster | Target::kEndpoint, 33, 44, 0 }), CHIP_NO_ERROR);
    EXPECT_EQ(entry.AddTarget(nullptr, { Target::kCluster | Target::kEndpoint, 0xAAAAFC01, 0x6666, 0 }), CHIP_NO_ERROR);

    index = 999;
    EXPECT_EQ(accessControl.CreateEntry(&index, entry), CHIP_NO_ERROR);
    EXPECT_EQ(index, 3u);

    EXPECT_EQ(accessControl.ReadEntry(3, entry), CHIP_NO_ERROR);
    EXPECT_EQ(entry.GetFabricIndex(fabricIndex), CHIP_NO_ERROR);
    EXPECT_EQ(fabricIndex, 11);
    EXPECT_EQ(entry.GetPrivilege(privilege), CHIP_NO_ERROR);
    EXPECT_EQ(privilege, Privilege::kProxyView);
    EXPECT_EQ(entry.GetAuthMode(authMode), CHIP_NO_ERROR);
    EXPECT_EQ(authMode, AuthMode::kCase);
    EXPECT_EQ(entry.GetSubjectCount(count), CHIP_NO_ERROR);
    EXPECT_EQ(count, 3u);
    EXPECT_EQ(entry.GetSubject(0, subject), CHIP_NO_ERROR);
    EXPECT_EQ(subject, 0x11111111AAAAAAAAu);
    EXPECT_EQ(entry.GetSubject(1, subject), CHIP_NO_ERROR);
    EXPECT_EQ(subject, 0x22222222BBBBBBBBu);
    EXPECT_EQ(entry.GetSubject(2, subject), CHIP_NO_ERROR);
    EXPECT_EQ(subject, 0x33333333CCCCCCCCu);
    EXPECT_EQ(entry.GetTargetCount(count), CHIP_NO_ERROR);
    EXPECT_EQ(count, 3u);
    EXPECT_EQ(entry.GetTarget(0, target), CHIP_NO_ERROR);
    EXPECT_EQ(target.flags, (Target::kCluster | Target::kEndpoint));
    EXPECT_EQ(target.cluster, 11u);
    EXPECT_EQ(target.endpoint, 22);
    EXPECT_EQ(entry.GetTarget(1, target), CHIP_NO_ERROR);
    EXPECT_EQ(target.flags, (Target::kCluster | Target::kEndpoint));
    EXPECT_EQ(target.cluster, 33u);
    EXPECT_EQ(target.endpoint, 44);
    EXPECT_EQ(entry.GetTarget(2, target), CHIP_NO_ERROR);
    EXPECT_EQ(target.flags, (Target::kCluster | Target::kEndpoint));
    EXPECT_EQ(target.cluster, 0xAAAAFC01);
    EXPECT_EQ(target.endpoint, 0x6666);

    EXPECT_EQ(entry.RemoveSubject(1), CHIP_NO_ERROR);
    EXPECT_EQ(entry.GetSubjectCount(count), CHIP_NO_ERROR);
    EXPECT_EQ(count, 2u);
    EXPECT_EQ(entry.GetSubject(0, subject), CHIP_NO_ERROR);
    EXPECT_EQ(subject, 0x11111111AAAAAAAAu);
    EXPECT_EQ(entry.GetSubject(1, subject), CHIP_NO_ERROR);
    EXPECT_EQ(subject, 0x33333333CCCCCCCCu);
    EXPECT_NE(entry.GetSubject(2, subject), CHIP_NO_ERROR);

    EXPECT_EQ(entry.RemoveTarget(1), CHIP_NO_ERROR);
    EXPECT_EQ(entry.GetTargetCount(count), CHIP_NO_ERROR);
    EXPECT_EQ(count, 2u);
    EXPECT_EQ(entry.GetTarget(0, target), CHIP_NO_ERROR);
    EXPECT_EQ(target.flags, (Target::kCluster | Target::kEndpoint));
    EXPECT_EQ(target.cluster, 11u);
    EXPECT_EQ(target.endpoint, 22u);
    EXPECT_EQ(entry.GetTarget(1, target), CHIP_NO_ERROR);
    EXPECT_EQ(target.flags, (Target::kCluster | Target::kEndpoint));
    EXPECT_EQ(target.cluster, 0xAAAAFC01);
    EXPECT_EQ(target.endpoint, 0x6666);
    EXPECT_NE(entry.GetTarget(2, target), CHIP_NO_ERROR);
}

TEST_F(TestAccessControl, TestUpdateEntry)
{
    EntryData data[entryData1Count];
    memcpy(data, entryData1, sizeof(data));
    EXPECT_EQ(LoadAccessControl(accessControl, data, MATTER_ARRAY_SIZE(data)), CHIP_NO_ERROR);

    for (size_t i = 0; i < MATTER_ARRAY_SIZE(data); ++i)
    {
        EntryData updateData;
        updateData.authMode    = authModes[i % MATTER_ARRAY_SIZE(authModes)];
        updateData.fabricIndex = fabricIndexes[i % MATTER_ARRAY_SIZE(fabricIndexes)];
        updateData.privilege   = privileges[i % (MATTER_ARRAY_SIZE(privileges) - 1)];

        updateData.AddSubject(nullptr, subjects[i % MATTER_ARRAY_SIZE(authModes)][i % MATTER_ARRAY_SIZE(subjects[0])]);
        updateData.AddTarget(nullptr, targets[i % MATTER_ARRAY_SIZE(targets)]);

        data[i] = updateData;

        {
            Entry entry;
            EXPECT_EQ(accessControl.PrepareEntry(entry), CHIP_NO_ERROR);
            EXPECT_EQ(LoadEntry(entry, updateData), CHIP_NO_ERROR);
            EXPECT_EQ(accessControl.UpdateEntry(i, entry), CHIP_NO_ERROR);
        }

        EXPECT_EQ(CompareAccessControl(accessControl, data, MATTER_ARRAY_SIZE(data)), CHIP_NO_ERROR);
    }
}

TEST_F(TestAccessControl, TestCreateUpdateDeleteWithListener)
{
    //------------------------------------------------------------------
    // Fresh state + listener registration
    //------------------------------------------------------------------
    ASSERT_EQ(ClearAccessControl(accessControl), CHIP_NO_ERROR);

    struct CountingListener : public AccessControl::EntryListener
    {
        void OnEntryChanged(const SubjectDescriptor *, FabricIndex, size_t, const Entry *, ChangeType type) override
        {
            switch (type)
            {
            case ChangeType::kAdded:
                adds++;
                break;
            case ChangeType::kUpdated:
                updates++;
                break;
            case ChangeType::kRemoved:
                removes++;
                break;
            }
        }
        int adds    = 0;
        int updates = 0;
        int removes = 0;
    } listener;

    accessControl.AddEntryListener(listener);

    //------------------------------------------------------------------
    // Build a valid entry
    //------------------------------------------------------------------
    Entry entry;
    ASSERT_EQ(accessControl.PrepareEntry(entry), CHIP_NO_ERROR);
    ASSERT_EQ(entry.SetFabricIndex(1), CHIP_NO_ERROR);
    ASSERT_EQ(entry.SetPrivilege(Privilege::kOperate), CHIP_NO_ERROR);
    ASSERT_EQ(entry.SetAuthMode(AuthMode::kCase), CHIP_NO_ERROR);
    ASSERT_EQ(entry.AddSubject(nullptr, kOperationalNodeId0), CHIP_NO_ERROR);
    ASSERT_EQ(entry.AddTarget(nullptr, Target{ Target::kCluster, kOnOffCluster, 0, 0 }), CHIP_NO_ERROR);

    SubjectDescriptor sd{ .fabricIndex = 1, .authMode = AuthMode::kCase, .subject = kOperationalNodeId0 };

    //------------------------------------------------------------------
    // CreateEntry (subject‑aware overload)
    //------------------------------------------------------------------
    size_t idx = ~0u;
    ASSERT_EQ(accessControl.CreateEntry(&sd, /*fabric=*/1, &idx, entry), CHIP_NO_ERROR);
    EXPECT_EQ(idx, 0u);
    EXPECT_EQ(listener.adds, 1);
    EXPECT_EQ(listener.updates, 0);
    EXPECT_EQ(listener.removes, 0);

    //------------------------------------------------------------------
    // UpdateEntry
    //------------------------------------------------------------------
    ASSERT_EQ(entry.SetPrivilege(Privilege::kManage), CHIP_NO_ERROR);
    ASSERT_EQ(accessControl.UpdateEntry(&sd, /*fabric=*/1, idx, entry), CHIP_NO_ERROR);
    EXPECT_EQ(listener.adds, 1);
    EXPECT_EQ(listener.updates, 1);
    EXPECT_EQ(listener.removes, 0);

    //------------------------------------------------------------------
    // DeleteEntry  (listener still registered)
    //------------------------------------------------------------------
    ASSERT_EQ(accessControl.DeleteEntry(&sd, /*fabric=*/1, idx), CHIP_NO_ERROR);
    EXPECT_EQ(listener.adds, 1);
    EXPECT_EQ(listener.updates, 1);
    EXPECT_EQ(listener.removes, 1);

    //------------------------------------------------------------------
    // Listener removal — no more callbacks expected
    //------------------------------------------------------------------
    accessControl.RemoveEntryListener(listener);
    ASSERT_EQ(accessControl.PrepareEntry(entry), CHIP_NO_ERROR);
    ASSERT_EQ(entry.SetFabricIndex(1), CHIP_NO_ERROR);
    ASSERT_EQ(entry.SetPrivilege(Privilege::kView), CHIP_NO_ERROR);
    ASSERT_EQ(entry.SetAuthMode(AuthMode::kCase), CHIP_NO_ERROR);
    ASSERT_EQ(entry.AddSubject(nullptr, kOperationalNodeId1), CHIP_NO_ERROR);
    ASSERT_EQ(accessControl.CreateEntry(&sd, 1, nullptr, entry), CHIP_NO_ERROR);

    EXPECT_EQ(listener.adds, 1);
    EXPECT_EQ(listener.updates, 1);
    EXPECT_EQ(listener.removes, 1);

    //------------------------------------------------------------------
    // Sanity‑check helper: IsAccessRestrictionListSupported()
    //------------------------------------------------------------------
    EXPECT_FALSE(accessControl.IsAccessRestrictionListSupported());
}

TEST_F(TestAccessControl, TestBaseDelegateDefaultMethods)
{
    AccessControl::Delegate d;

    // Capabilities
    size_t v = 999;
    EXPECT_EQ(d.GetMaxEntriesPerFabric(v), CHIP_NO_ERROR);
    EXPECT_EQ(v, 0u);
    v = 999;
    EXPECT_EQ(d.GetMaxSubjectsPerEntry(v), CHIP_NO_ERROR);
    EXPECT_EQ(v, 0u);
    v = 999;
    EXPECT_EQ(d.GetMaxTargetsPerEntry(v), CHIP_NO_ERROR);
    EXPECT_EQ(v, 0u);
    v = 999;
    EXPECT_EQ(d.GetMaxEntryCount(v), CHIP_NO_ERROR);
    EXPECT_EQ(v, 0u);

    // Actualities
    FabricIndex fabric = 1;
    EXPECT_EQ(d.GetEntryCount(fabric, v), CHIP_NO_ERROR);
    EXPECT_EQ(v, 0u);
    v = 999;
    EXPECT_EQ(d.GetEntryCount(v), CHIP_NO_ERROR);
    EXPECT_EQ(v, 0u);

    // Preparation
    Entry e;
    EXPECT_EQ(d.PrepareEntry(e), CHIP_NO_ERROR);

    // CRUD (defaults just return CHIP_NO_ERROR)
    size_t idx = 123;
    EXPECT_EQ(d.CreateEntry(&idx, e, &fabric), CHIP_NO_ERROR);
    EXPECT_EQ(d.ReadEntry(0, e, &fabric), CHIP_NO_ERROR);
    EXPECT_EQ(d.UpdateEntry(0, e, &fabric), CHIP_NO_ERROR);
    EXPECT_EQ(d.DeleteEntry(0, &fabric), CHIP_NO_ERROR);

    // Iteration
    EntryIterator it;
    EXPECT_EQ(d.Entries(it, &fabric), CHIP_NO_ERROR);

    // Check (default returns ACCESS_DENIED)
    SubjectDescriptor sd{};
    RequestPath rp{ .cluster = 1, .endpoint = 1 };
    EXPECT_EQ(d.Check(sd, rp, Privilege::kView), CHIP_ERROR_ACCESS_DENIED);
}

} // namespace Access
} // namespace chip