//go:build linux

package activator

import (
	"context"
	"os"
	"path/filepath"
	"testing"
)

// PurgeSeedLocal is the import rollback's local removal (preflight M12):
// Plan 4's purge, so it covers the seed fetch leftovers (a copy of the
// customer database) and goes through instancefs. It leaves anything else
// in the directory, is idempotent, and is done for a directory that is
// not there.
func TestPurgeSeedLocalRemovesTheDatabaseAndEverythingThatStandsInForIt(t *testing.T) {
	dir := filepath.Join(t.TempDir(), "instances", "shop")
	if err := os.MkdirAll(dir, 0o700); err != nil {
		t.Fatal(err)
	}
	db := filepath.Join(dir, "a.shop.example.com.db")
	gone := []string{db, db + "-wal", db + "-shm", db + SeedMarkerSuffix,
		filepath.Join(dir, ".seed-sd_aaaaaaaaaaaaaaaaaaaaaaaaaa.tmp")}
	for _, p := range gone {
		if err := os.WriteFile(p, []byte("x"), 0o600); err != nil {
			t.Fatal(err)
		}
	}
	for _, d := range []string{db + "-litestream", filepath.Join(dir, ".activator-a.shop.example.com.db-litestream")} {
		if err := os.MkdirAll(filepath.Join(d, "generations"), 0o700); err != nil {
			t.Fatal(err)
		}
		gone = append(gone, d)
	}
	kept := filepath.Join(dir, "uploads")
	if err := os.WriteFile(kept, []byte("keep"), 0o600); err != nil {
		t.Fatal(err)
	}
	for i := 0; i < 2; i++ {
		if err := PurgeSeedLocal(db); err != nil {
			t.Fatalf("run %d: %v", i, err)
		}
	}
	for _, p := range gone {
		if _, err := os.Lstat(p); !os.IsNotExist(err) {
			t.Errorf("%s survived", p)
		}
	}
	if _, err := os.Stat(kept); err != nil {
		t.Fatalf("an unrelated file went: %v", err)
	}
	if err := PurgeSeedLocal(filepath.Join(t.TempDir(), "missing", "a.shop.example.com.db")); err != nil {
		t.Fatalf("a missing directory: %v", err)
	}
	for _, bad := range []string{"a.shop.example.com.db", "/data/instances/x/../a.db", "/data/instances/x/"} {
		if err := PurgeSeedLocal(bad); err == nil {
			t.Errorf("%q: no error", bad)
		}
	}
}

// A symlink at the database's name is removed as a link; its target stays.
func TestPurgeSeedLocalNeverFollowsASymlink(t *testing.T) {
	root := t.TempDir()
	dir := filepath.Join(root, "instance")
	if err := os.MkdirAll(dir, 0o700); err != nil {
		t.Fatal(err)
	}
	target := filepath.Join(root, "elsewhere.db")
	if err := os.WriteFile(target, []byte("someone else's"), 0o600); err != nil {
		t.Fatal(err)
	}
	db := filepath.Join(dir, "a.shop.example.com.db")
	if err := os.Symlink(target, db); err != nil {
		t.Fatal(err)
	}
	if err := PurgeSeedLocal(db); err != nil {
		t.Fatal(err)
	}
	if _, err := os.Lstat(db); !os.IsNotExist(err) {
		t.Fatal("the link survived")
	}
	if b, err := os.ReadFile(target); err != nil || string(b) != "someone else's" {
		t.Fatalf("the link's target was touched: %q %v", b, err)
	}
}

// Fix round 1, I1, the activator half: an aborted import's database left at
// a host's nested path is what a later plain instance at the host wakes
// on. After PurgeSeedLocal the wake finds no file and comes up fresh. Left
// there, its <db>.seed marker names a seed the plain row does not, so the
// wake purges it and comes up fresh all the same (final review F2b).
func TestAPlainWakeAfterPurgeSeedLocalFindsNoDatabase(t *testing.T) {
	for _, purge := range []bool{false, true} {
		b, rt := nestedBackend(t, &fakeControl{}, &fakeUnit{})
		if err := os.MkdirAll(filepath.Dir(rt.DBPath), 0o700); err != nil {
			t.Fatal(err)
		}
		for _, f := range []string{rt.DBPath, rt.DBPath + "-wal", rt.DBPath + SeedMarkerSuffix} {
			if err := os.WriteFile(f, []byte("an aborted import's data"), 0o600); err != nil {
				t.Fatal(err)
			}
		}
		if purge {
			if err := PurgeSeedLocal(rt.DBPath); err != nil {
				t.Fatal(err)
			}
		}
		oldRestore := restoreReplica
		restoreReplica = func(context.Context, string, string, string, string) (bool, error) { return false, nil }
		fresh, err := b.Restore(context.Background(), rt) // a plain row: no seed column
		restoreReplica = oldRestore
		if err != nil || !fresh {
			t.Fatalf("purge %v: fresh %v err %v", purge, fresh, err)
		}
		if _, err := os.Lstat(rt.DBPath); !os.IsNotExist(err) {
			t.Fatalf("the wake found a database at %s", rt.DBPath)
		}
	}
}

// Fix round 2: the marker beside a database is read through instancefs.
// It names a seed, or names none (absent, a symlink, a directory, no
// instance directory), or cannot be read (an error).
func TestReadSeedMarker(t *testing.T) {
	dir := filepath.Join(t.TempDir(), "instance")
	if err := os.MkdirAll(dir, 0o700); err != nil {
		t.Fatal(err)
	}
	db := filepath.Join(dir, "a.shop.example.com.db")
	marker := db + SeedMarkerSuffix
	check := func(name, want string, wantErr bool) {
		t.Helper()
		got, err := ReadSeedMarker(db)
		if got != want || (err != nil) != wantErr {
			t.Fatalf("%s: %q, %v; want %q, error %v", name, got, err, want, wantErr)
		}
	}
	check("no marker", "", false)
	if err := os.WriteFile(marker, []byte("sd_aaaaaaaaaaaaaaaaaaaaaaaaaa\n"), 0o600); err != nil {
		t.Fatal(err)
	}
	check("a marker", "sd_aaaaaaaaaaaaaaaaaaaaaaaaaa", false)
	os.Remove(marker)
	target := filepath.Join(t.TempDir(), "elsewhere")
	os.WriteFile(target, []byte("sd_bbbbbbbbbbbbbbbbbbbbbbbbbb"), 0o600)
	if err := os.Symlink(target, marker); err != nil {
		t.Fatal(err)
	}
	check("a symlinked marker", "", false)
	os.Remove(marker)
	if err := os.Mkdir(marker, 0o700); err != nil {
		t.Fatal(err)
	}
	check("a directory at the marker", "", false)
	os.Remove(marker)
	if got, err := ReadSeedMarker(filepath.Join(t.TempDir(), "gone", "a.db")); got != "" || err != nil {
		t.Fatalf("no instance directory: %q %v", got, err)
	}
	if os.Getuid() != 0 {
		if err := os.WriteFile(marker, []byte("sd_aaaaaaaaaaaaaaaaaaaaaaaaaa"), 0o600); err != nil {
			t.Fatal(err)
		}
		if err := os.Chmod(dir, 0o000); err != nil {
			t.Fatal(err)
		}
		t.Cleanup(func() { os.Chmod(dir, 0o700) })
		check("an unreadable directory", "", true)
	}
	if _, err := ReadSeedMarker("relative.db"); err == nil {
		t.Fatal("a relative path read")
	}
}