package console

import (
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"net/http"
	"strings"
	"sync"
	"testing"
	"time"

	"github.com/carlosframework/platform/internal/provision"
	"github.com/carlosframework/platform/internal/release"
	"github.com/carlosframework/platform/internal/status"
	"github.com/carlosframework/platform/internal/svcrole"
	"github.com/carlosframework/platform/internal/updatewords"
)

const updURL = "/api/cli/apps/bab/km/instances/a.example.com/updates"

// updatesFx is newConsoleFixture with app km in the ops account bab: v1 and
// v2 shipped, v1 promoted to stable (so v1 has a promotion record and v2 has
// none), and one instance record, a.example.com on stable with no settings.
type updatesFx struct {
	*consoleFixture
	t             *testing.T
	store         release.Store
	member        string // a CLI bearer for alice, a plain (non-owner) member of bab
	owner         string // a CLI bearer for paul, an owner of the ops account bab: the account in updURL
	instanceToken string // an app-wide svcrole.Instance credential for km
}

func updatesFixture(t *testing.T) *updatesFx {
	t.Helper()
	fx := newConsoleFixture(t)
	now := time.Now()
	if _, err := fx.st.CreateAppIn(OpsAccountID, "km", "paul@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	if err := fx.st.AddMember(OpsAccountID, "alice@keymail.dev", RoleMember, now); err != nil {
		t.Fatal(err)
	}
	shipVersion(t, fx, "km", "v1")
	shipVersion(t, fx, "km", "v2")
	seedChannel(t, fx, "km", "stable", "v1")
	ux := &updatesFx{
		consoleFixture: fx,
		t:              t,
		store:          fx.rel,
		member:         cliToken(t, fx, "alice@keymail.dev", "code-updates-member"),
		owner:          cliToken(t, fx, "paul@keymail.dev", "code-updates-owner"),
		instanceToken:  serviceToken(t, fx.st, OpsAccountID, "router", "km", svcrole.Instance),
	}
	ux.setManifest(provision.Manifest{Schema: 1, App: "km", Domain: "example.com", Channel: "stable"})
	ux.putRecord(provision.Record{Schema: 1, Host: "a.example.com", Slug: "a", App: "km",
		Account: release.OpsAccount, Channel: "stable", CreatedAt: now.UTC()})
	return ux
}

// putRecord replaces (or creates) the record at rec's key with rec.
func (fx *updatesFx) putRecord(rec provision.Record) {
	fx.t.Helper()
	ctx := context.Background()
	if err := fx.store.Delete(ctx, provision.RecordKey(rec.Account, rec.App, rec.Host)); err != nil {
		fx.t.Fatal(err)
	}
	if err := provision.CreateRecord(ctx, fx.store, rec); err != nil {
		fx.t.Fatal(err)
	}
}

func (fx *updatesFx) record(host string) provision.Record {
	fx.t.Helper()
	rec, err := provision.GetRecord(context.Background(), fx.store, release.OpsAccount, "km", host)
	if err != nil {
		fx.t.Fatal(err)
	}
	return *rec
}

// setManifest writes km's instances manifest (and so its update policy).
func (fx *updatesFx) setManifest(m provision.Manifest) {
	fx.t.Helper()
	enableInstances(fx.t, fx.consoleFixture, "km", m)
}

// manifest reads km's instances manifest back.
func (fx *updatesFx) manifest() provision.Manifest {
	fx.t.Helper()
	m, err := provision.GetManifest(context.Background(), fx.store, release.OpsAccount, "km")
	if err != nil {
		fx.t.Fatal(err)
	}
	return *m
}

// createInstance creates host through the console's create door as the
// member, naming no channel, so the record takes the manifest's.
func (fx *updatesFx) createInstance(t *testing.T, host string) {
	t.Helper()
	st, _, out := rawReq(t, http.MethodPost, instancesURL(fx.consoleFixture, "bab", "km"), fx.member, `{"host":"`+host+`"}`)
	if st != http.StatusCreated {
		t.Fatalf("create %s: %d %s", host, st, out)
	}
}

// boxesEnforce makes the deployment one box, ie-1: an edges record and a
// fresh heartbeat whose binary does (on) or does not apply update settings.
func (fx *updatesFx) boxesEnforce(on bool) {
	fx.t.Helper()
	if _, _, err := fx.store.Get(context.Background(), "control/edges/ie-1.json"); err != nil {
		seedEdgesRecord(fx.t, fx.consoleFixture, "ie-1")
	}
	m := &status.BoxMetrics{}
	if on {
		m.UpdateSettings = status.UpdateSettingsProtocol
	}
	seedSettingsBox(fx.t, fx.consoleFixture, "ie-1", time.Now(), m)
}

// sendJSON is rawReq with body marshalled to JSON.
func sendJSON(t *testing.T, method, u string, body any, bearer string) (int, string) {
	t.Helper()
	raw, err := json.Marshal(body)
	if err != nil {
		t.Fatal(err)
	}
	st, _, out := rawReq(t, method, u, bearer, string(raw))
	return st, out
}

func TestUpdatesGetShowsDefaults(t *testing.T) {
	fx := updatesFixture(t)
	st, out := getRaw(t, fx.ts.URL+updURL, fx.member)
	if st != http.StatusOK || !strings.Contains(out, `"updates":"auto"`) || !strings.Contains(out, `"enforced":false`) {
		t.Fatalf("GET: %d %s", st, out)
	}
}

func TestUpdatesPutIsRefusedUntilEveryBoxEnforces(t *testing.T) {
	fx := updatesFixture(t)
	fx.boxesEnforce(false)
	st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"updates": "manual"}, fx.member)
	if st != http.StatusConflict || !strings.Contains(out, "every box") {
		t.Fatalf("manual before the fleet enforces: %d %s", st, out)
	}
	// R3: a member is told how many boxes, never which.
	if strings.Contains(out, "ie-1") || !strings.Contains(out, "1 boxes") {
		t.Fatalf("the refusal must give a count and name no box: %s", out)
	}
	if fx.record("a.example.com").Updates != "" {
		t.Fatal("a refused enable wrote the record")
	}
	fx.boxesEnforce(true)
	st, out = sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"updates": "manual"}, fx.member)
	if st != http.StatusOK || fx.record("a.example.com").Updates != release.UpdatesManual {
		t.Fatalf("manual once enforced: %d %s", st, out)
	}
}

// R3: when the gate cannot read the boxes at all, enabling is refused with
// its own words, and the store's error text never reaches the member.
func TestUpdatesPutIsRefusedWhenEnforcementIsUnknown(t *testing.T) {
	fx := updatesFixture(t)
	fx.boxesEnforce(true)
	fx.srv.cfg.Releases = unlistableStore{fx.rel}
	st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"updates": "manual"}, fx.member)
	if st != http.StatusBadGateway || !strings.Contains(out, updatewords.Text("settings.console.enforcement-unknown")) {
		t.Fatalf("enable with an unreadable inventory: %d %s", st, out)
	}
	if strings.Contains(out, brokenStoreErr) {
		t.Fatalf("the refusal leaks the store's error: %s", out)
	}
	// Clearing is still allowed.
	if st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"updates": "auto"}, fx.member); st != http.StatusOK {
		t.Fatalf("disabling with an unreadable inventory: %d %s", st, out)
	}
}

// Review Focus 5.
func TestClearingIsNeverRefused(t *testing.T) {
	fx := updatesFixture(t)
	fx.putRecord(provision.Record{Schema: 1, Host: "a.example.com", App: "km", Account: "bab", Channel: "stable", Pin: "v1"})
	fx.boxesEnforce(false)
	st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"pin": ""}, fx.member)
	if st != http.StatusOK || fx.record("a.example.com").Pin != "" {
		t.Fatalf("clearing a pin: %d %s", st, out)
	}
}

// Fix round 1: a value re-sent unchanged beside a clear is not an enable, so
// a client that sends its full state can still clear while the fleet does not
// enforce. A changed value still waits.
func TestClearingBesideAnUnchangedEnableIsNeverRefused(t *testing.T) {
	fx := updatesFixture(t)
	fx.boxesEnforce(false)
	fx.putRecord(provision.Record{Schema: 1, Host: "a.example.com", App: "km", Account: "bab", Channel: "stable",
		Updates: release.UpdatesManual, Pin: "v1"})
	st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"updates": "manual", "pin": ""}, fx.member)
	if rec := fx.record("a.example.com"); st != http.StatusOK || rec.Pin != "" || rec.Updates != release.UpdatesManual {
		t.Fatalf("manual re-sent, pin cleared: %d %s, record %+v", st, out, rec)
	}
	fx.putRecord(provision.Record{Schema: 1, Host: "a.example.com", App: "km", Account: "bab", Channel: "stable",
		Updates: release.UpdatesManual, Pin: "v1"})
	st, out = sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"pin": "v1", "updates": "auto"}, fx.member)
	if rec := fx.record("a.example.com"); st != http.StatusOK || rec.Pin != "v1" || rec.Updates != release.UpdatesAuto {
		t.Fatalf("pin re-sent, manual turned off: %d %s, record %+v", st, out, rec)
	}
	two := 2
	fx.putRecord(provision.Record{Schema: 1, Host: "a.example.com", App: "km", Account: "bab", Channel: "stable",
		Updates: release.UpdatesManual, Major: &two})
	st, out = sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]any{"major": 2, "updates": "auto"}, fx.member)
	if rec := fx.record("a.example.com"); st != http.StatusOK || rec.Major == nil || *rec.Major != 2 || rec.Updates != release.UpdatesAuto {
		t.Fatalf("major re-sent, manual turned off: %d %s, record %+v", st, out, rec)
	}
	// A changed value is still an enable, and still waits.
	for _, body := range []map[string]any{{"major": 3}, {"pin": "v1", "updates": "auto"}, {"updates": "manual"}} {
		before := fx.record("a.example.com")
		st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, body, fx.member)
		if st != http.StatusConflict || !strings.Contains(out, "every box") {
			t.Errorf("%v before the fleet enforces: %d %s", body, st, out)
		}
		if after := fx.record("a.example.com"); after.Updates != before.Updates || after.Pin != before.Pin || !sameMajor(after.Major, before.Major) {
			t.Errorf("%v: a refused enable wrote the record: %+v -> %+v", body, before, after)
		}
	}
}

func TestPinMustHaveAPromotionRecord(t *testing.T) {
	fx := updatesFixture(t) // ships km v1 and v2 and promotes v1 to stable
	fx.boxesEnforce(true)
	st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"pin": "v2"}, fx.member)
	if st != http.StatusConflict || !strings.Contains(out, "promotion record") {
		t.Fatalf("pin of an unpromoted build: %d %s", st, out)
	}
	st, _ = sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"pin": "v1"}, fx.member)
	if st != http.StatusOK || fx.record("a.example.com").Pin != "v1" {
		t.Fatalf("pin of a promoted build: %d", st)
	}
}

// R7: a record that is there but cannot be verified is not "no record": it
// is a 502 that asks for a retry, and the pin is not written.
func TestPinCheckFailureIsNotNoRecord(t *testing.T) {
	fx := updatesFixture(t)
	fx.boxesEnforce(true)
	if _, err := fx.store.Put(context.Background(), release.PromotionRecordKey("bab", "km", "v2"), []byte(`{"payload":"x","sig":"AAAA"}`), ""); err != nil {
		t.Fatal(err)
	}
	st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"pin": "v2"}, fx.member)
	want := fmt.Sprintf(updatewords.Text("settings.console.pin-check-failed"), "v2")
	if st != http.StatusBadGateway || jsonErrorText(t, out) != want {
		t.Fatalf("pin with an unverifiable record: %d %s", st, out)
	}
	if fx.record("a.example.com").Pin != "" {
		t.Fatal("the pin was written")
	}
}

// Strict input: a value of the wrong type is refused, never read as a clear.
func TestUpdatesPutRefusesWrongTypes(t *testing.T) {
	fx := updatesFixture(t)
	fx.boxesEnforce(true)
	fx.putRecord(provision.Record{Schema: 1, Host: "a.example.com", App: "km", Account: "bab", Channel: "stable",
		Updates: release.UpdatesManual, Pin: "v1"})
	for _, c := range []struct {
		body string
		want string
	}{
		{`{"updates":5}`, updatewords.Text("settings.console.bad-updates")},
		{`{"updates":true}`, updatewords.Text("settings.console.bad-updates")},
		{`{"updates":"sometimes"}`, updatewords.Text("settings.console.bad-updates")},
		{`{"pin":true}`, fmt.Sprintf(updatewords.Text("settings.console.bad-pin"), "true")},
		{`{"pin":5}`, fmt.Sprintf(updatewords.Text("settings.console.bad-pin"), "5")},
		{`{"pin":"dev"}`, fmt.Sprintf(updatewords.Text("settings.console.bad-pin"), "dev")},
		{`{"pin":"../v1"}`, fmt.Sprintf(updatewords.Text("settings.console.bad-pin"), "../v1")},
		{`{"major":-1}`, updatewords.Text("settings.console.bad-major")},
		{`{"major":1.5}`, updatewords.Text("settings.console.bad-major")},
		{`{"major":"2"}`, updatewords.Text("settings.console.bad-major")},
		{`{"major":1e300}`, updatewords.Text("settings.console.bad-major")},
	} {
		st, _, out := rawReq(t, http.MethodPut, fx.ts.URL+updURL, fx.member, c.body)
		if st != http.StatusBadRequest || jsonErrorText(t, out) != c.want {
			t.Errorf("%s: %d %s, want 400 %q", c.body, st, out, c.want)
		}
	}
	if rec := fx.record("a.example.com"); rec.Updates != release.UpdatesManual || rec.Pin != "v1" || rec.Major != nil {
		t.Fatalf("a refused request changed the record: %+v", rec)
	}
	// null and "" clear.
	if st, _, out := rawReq(t, http.MethodPut, fx.ts.URL+updURL, fx.member, `{"updates":null,"pin":""}`); st != http.StatusOK {
		t.Fatalf("clearing with null and empty: %d %s", st, out)
	}
	if rec := fx.record("a.example.com"); rec.Updates != "" || rec.Pin != "" {
		t.Fatalf("null and empty did not clear: %+v", rec)
	}
}

func TestMajorOnlyOnStable(t *testing.T) {
	fx := updatesFixture(t)
	fx.boxesEnforce(true)
	fx.putRecord(provision.Record{Schema: 1, Host: "a.example.com", App: "km", Account: "bab", Channel: "beta"})
	st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]any{"major": 2}, fx.member)
	if st != http.StatusBadRequest || !strings.Contains(out, "stable") {
		t.Fatalf("major off stable: %d %s", st, out)
	}
}

// R4: a major left behind by a channel move is ignored by reconcile and shown
// as major_ignored; it neither blocks an unrelated change nor is cleared by it.
func TestStaleMajorOffStableIsLeftAlone(t *testing.T) {
	fx := updatesFixture(t)
	two := 2
	fx.putRecord(provision.Record{Schema: 1, Host: "a.example.com", App: "km", Account: "bab", Channel: "beta", Major: &two})
	st, out := getRaw(t, fx.ts.URL+updURL, fx.member)
	if st != http.StatusOK || !strings.Contains(out, `"major_ignored":true`) {
		t.Fatalf("GET of a stale major: %d %s", st, out)
	}
	st, out = sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"updates": "auto"}, fx.member)
	if st != http.StatusOK {
		t.Fatalf("an unrelated change on a record with a stale major: %d %s", st, out)
	}
	if rec := fx.record("a.example.com"); rec.Updates != release.UpdatesAuto || rec.Major == nil || *rec.Major != 2 {
		t.Fatalf("record after the change: %+v", rec)
	}
	// Clearing the stale major is allowed too.
	if st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]any{"major": nil}, fx.member); st != http.StatusOK || fx.record("a.example.com").Major != nil {
		t.Fatalf("clearing a stale major: %d %s", st, out)
	}
}

// Astra r1 #2: a client that sends its full state resends the stale major
// beside a clear. The unchanged major is not a new major off stable: the
// clear goes through, the major is kept (R4), and that holds while the fleet
// gate is closed too. A changed major off stable is still refused.
func TestFullStateClearBesideAStaleMajor(t *testing.T) {
	for _, enforced := range []bool{true, false} {
		t.Run(fmt.Sprintf("enforced=%v", enforced), func(t *testing.T) {
			fx := updatesFixture(t)
			fx.boxesEnforce(enforced)
			two := 2
			fx.putRecord(provision.Record{Schema: 1, Host: "a.example.com", App: "km", Account: "bab", Channel: "beta",
				Updates: release.UpdatesManual, Major: &two, Pin: "v1"})
			st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]any{"major": 2, "pin": ""}, fx.member)
			if rec := fx.record("a.example.com"); st != http.StatusOK || rec.Pin != "" || rec.Major == nil || *rec.Major != 2 {
				t.Fatalf("pin cleared beside the unchanged stale major: %d %s, record %+v", st, out, rec)
			}
			st, out = sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]any{"major": 2, "pin": "", "updates": "auto"}, fx.member)
			if rec := fx.record("a.example.com"); st != http.StatusOK || rec.Updates != release.UpdatesAuto || rec.Major == nil || *rec.Major != 2 {
				t.Fatalf("manual turned off beside the unchanged stale major: %d %s, record %+v", st, out, rec)
			}
			// A changed major off stable is still refused, before the gate.
			st, out = sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]any{"major": 3, "pin": ""}, fx.member)
			if st != http.StatusBadRequest || jsonErrorText(t, out) != fmt.Sprintf(updatewords.Text("settings.console.major-off-stable"), "a.example.com", "beta") {
				t.Fatalf("a changed major off stable: %d %s", st, out)
			}
			if rec := fx.record("a.example.com"); rec.Major == nil || *rec.Major != 2 {
				t.Fatalf("a refused major was written: %+v", rec)
			}
		})
	}
}

func TestMajorOnStableIsSetAndCleared(t *testing.T) {
	fx := updatesFixture(t)
	fx.boxesEnforce(true)
	st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]any{"major": 3}, fx.member)
	if rec := fx.record("a.example.com"); st != http.StatusOK || rec.Major == nil || *rec.Major != 3 {
		t.Fatalf("major on stable: %d %s", st, out)
	}
	if !strings.Contains(out, `"major":3`) || !strings.Contains(out, `"major_ignored":false`) {
		t.Fatalf("the view after the change: %s", out)
	}
	st, out = sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]any{"major": ""}, fx.member)
	if st != http.StatusOK || fx.record("a.example.com").Major != nil {
		t.Fatalf("clearing major with empty: %d %s", st, out)
	}
}

// A change bumps the serial once and leaves an activity line; a request that
// changes nothing does neither.
func TestUpdatesPutAnnouncesOnlyChanges(t *testing.T) {
	fx := updatesFixture(t)
	fx.boxesEnforce(true)
	before := serial(t, fx.consoleFixture)
	if st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{}, fx.member); st != http.StatusOK {
		t.Fatalf("empty PUT: %d %s", st, out)
	}
	if got := serial(t, fx.consoleFixture); got != before {
		t.Fatalf("an empty PUT bumped the serial: %d -> %d", before, got)
	}
	if st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"updates": "manual"}, fx.member); st != http.StatusOK {
		t.Fatalf("manual: %d %s", st, out)
	}
	if got := serial(t, fx.consoleFixture); got != before+1 {
		t.Fatalf("serial = %d, want one bump from %d", got, before)
	}
	acts, err := fx.st.Events(OpsAccountID, "km", 50)
	if err != nil {
		t.Fatal(err)
	}
	want := fmt.Sprintf(updatewords.Text("settings.console.audit-set"), "a.example.com", "updates manual")
	found := false
	for _, a := range acts {
		if a.Action == "instance-updates" && a.Detail == want && a.Address == "alice@keymail.dev" {
			found = true
		}
	}
	if !found {
		t.Fatalf("no activity line %q by alice in %+v", want, acts)
	}
}

func TestUpdatesDoorsRefuseNamedUnitsAndOtherKinds(t *testing.T) {
	fx := updatesFixture(t)
	fx.boxesEnforce(true)
	fx.putRecord(provision.Record{Schema: 1, Host: "a.example.com", App: "km", Account: "bab", Channel: "stable", Unit: "console.service", Addr: "127.0.0.1:8080"})
	st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"updates": "manual"}, fx.member)
	if st != http.StatusConflict || !strings.Contains(out, "systemd unit") {
		t.Fatalf("named unit: %d %s", st, out)
	}
	fx.putRecord(provision.Record{Schema: 1, Host: "a.example.com", App: "km", Account: "bab", Channel: "stable", Kind: "service", Addr: "127.0.0.1:8080"})
	st, out = sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"updates": "manual"}, fx.member)
	if st != http.StatusConflict || jsonErrorText(t, out) != fmt.Sprintf(updatewords.Text("settings.console.not-instance"), "a.example.com", "service") {
		t.Fatalf("service route: %d %s", st, out)
	}
	// Clearing is refused on these too: the door does not apply to them at all.
	if rec := fx.record("a.example.com"); rec.Updates != "" {
		t.Fatalf("a refused request wrote the record: %+v", rec)
	}
}

func TestUpdatesDoorsRefuseChannel(t *testing.T) {
	fx := updatesFixture(t)
	st, out := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"channel": "beta"}, fx.member)
	if st != http.StatusBadRequest || !strings.Contains(out, updatewords.Text("settings.console.channel-elsewhere")) {
		t.Fatalf("channel through /updates: %d %s", st, out)
	}
}

// An unknown host is the family's 404, for both doors.
func TestUpdatesDoorsUnknownHostIs404(t *testing.T) {
	fx := updatesFixture(t)
	u := fx.ts.URL + "/api/cli/apps/bab/km/instances/nope.example.com/updates"
	if st, out := getRaw(t, u, fx.member); st != http.StatusNotFound {
		t.Fatalf("GET of an unknown host: %d %s", st, out)
	}
	if st, out := sendJSON(t, http.MethodPut, u, map[string]string{"updates": "auto"}, fx.member); st != http.StatusNotFound {
		t.Fatalf("PUT of an unknown host: %d %s", st, out)
	}
}

// The instance-bound credential is #155 step 6: until then no service
// credential reaches any of the four doors.
func TestUpdatesDoorsRefuseAppWideCredentials(t *testing.T) {
	fx := updatesFixture(t)
	for _, c := range []struct{ method, url string }{
		{http.MethodGet, updURL}, {http.MethodPut, updURL},
		{http.MethodPost, updURL + "/install"}, {http.MethodPut, "/api/cli/apps/bab/km/updates"},
	} {
		st, _ := sendJSON(t, c.method, fx.ts.URL+c.url, map[string]string{}, fx.instanceToken)
		if st != http.StatusNotFound && st != http.StatusForbidden {
			t.Errorf("%s %s with an app-wide instance credential: %d", c.method, c.url, st)
		}
	}
}

func TestTheConsoleNeverChoosesABuild(t *testing.T) {
	fx := updatesFixture(t)
	fx.boxesEnforce(true)
	before := fx.record("a.example.com")
	if st, _ := sendJSON(t, http.MethodPut, fx.ts.URL+updURL, map[string]string{"updates": "manual"}, fx.member); st != http.StatusOK {
		t.Fatal(st)
	}
	after := fx.record("a.example.com")
	if after.Pin != before.Pin || after.Channel != before.Channel {
		t.Fatalf("a preference change moved a build: %+v -> %+v", before, after)
	}
	_ = context.Background()
}

func TestInstallBumpsTheRequestAndChoosesNoBuild(t *testing.T) {
	fx := updatesFixture(t)
	before := fx.record("a.example.com")
	serialBefore := serial(t, fx.consoleFixture)
	st, out := sendJSON(t, http.MethodPost, fx.ts.URL+updURL+"/install", map[string]any{}, fx.member)
	if st != http.StatusOK || !strings.Contains(out, `"request":1`) {
		t.Fatalf("install: %d %s", st, out)
	}
	rec := fx.record("a.example.com")
	if rec.InstallRequest == nil || rec.InstallRequest.ID != 1 || rec.InstallRequest.FastTrack ||
		rec.InstallRequest.By != "alice@keymail.dev" || rec.InstallRequest.At.IsZero() {
		t.Fatalf("record = %+v", rec)
	}
	// The console never names a build: the pin, channel and settings are as
	// they were, and only the request moved.
	if rec.Pin != before.Pin || rec.Channel != before.Channel || rec.Updates != before.Updates || !sameMajor(rec.Major, before.Major) {
		t.Fatalf("Update now moved a build or a setting: %+v -> %+v", before, rec)
	}
	if got := serial(t, fx.consoleFixture); got != serialBefore+1 {
		t.Fatalf("serial = %d, want one bump from %d", got, serialBefore)
	}
	acts, err := fx.st.Events(OpsAccountID, "km", 50)
	if err != nil {
		t.Fatal(err)
	}
	want := fmt.Sprintf(updatewords.Text("settings.console.audit-install"), "a.example.com", 1)
	found := false
	for _, a := range acts {
		if a.Action == "instance-update-now" && a.Detail == want && a.Address == "alice@keymail.dev" {
			found = true
		}
	}
	if !found {
		t.Fatalf("no activity line %q by alice in %+v", want, acts)
	}
	st, out = sendJSON(t, http.MethodPost, fx.ts.URL+updURL+"/install", map[string]any{}, fx.member)
	if st != http.StatusOK || !strings.Contains(out, `"request":2`) || fx.record("a.example.com").InstallRequest.ID != 2 {
		t.Fatalf("the second request did not increase the id: %d %s", st, out)
	}
}

// Update now is not one of the settings §4.4 holds until every box applies
// them: it is answered while the fleet does not enforce.
func TestInstallIsNotHeldForTheFleet(t *testing.T) {
	fx := updatesFixture(t)
	fx.boxesEnforce(false)
	if st, out := sendJSON(t, http.MethodPost, fx.ts.URL+updURL+"/install", map[string]any{}, fx.member); st != http.StatusOK {
		t.Fatalf("install before the fleet enforces: %d %s", st, out)
	}
}

// installRaceStore holds the first two reads of the instance record until
// both have arrived, so the two requests decide from the same etag and one
// of them must lose the write and retry.
type installRaceStore struct {
	release.Store
	key     string
	mu      sync.Mutex
	arrived int
	etags   []string
	both    chan struct{}
}

func (s *installRaceStore) Get(ctx context.Context, key string) ([]byte, string, error) {
	body, etag, err := s.Store.Get(ctx, key)
	if key != s.key {
		return body, etag, err
	}
	s.mu.Lock()
	if s.arrived >= 2 {
		s.mu.Unlock()
		return body, etag, err
	}
	s.arrived++
	s.etags = append(s.etags, etag)
	if s.arrived == 2 {
		close(s.both)
	}
	s.mu.Unlock()
	select {
	case <-s.both:
	case <-time.After(10 * time.Second):
	}
	return body, etag, err
}

// installNoFatal is one install request that reports rather than fails, for
// use off the test goroutine.
func installNoFatal(u, bearer string) (int, string, error) {
	req, err := http.NewRequest(http.MethodPost, u, strings.NewReader(`{}`))
	if err != nil {
		return 0, "", err
	}
	req.Header.Set("Content-Type", "application/json")
	req.Header.Set("Authorization", "Bearer "+bearer)
	res, err := http.DefaultClient.Do(req)
	if err != nil {
		return 0, "", err
	}
	defer res.Body.Close()
	out, err := io.ReadAll(res.Body)
	return res.StatusCode, string(out), err
}

// Review Focus 3: two requests that read the same etag both succeed, and the
// ids they leave are 1 then 2. Neither is lost and no id repeats.
func TestInstallRequestsRaceToIncreasingIDs(t *testing.T) {
	fx := updatesFixture(t)
	rs := &installRaceStore{Store: fx.rel, key: provision.RecordKey(release.OpsAccount, "km", "a.example.com"), both: make(chan struct{})}
	fx.srv.cfg.Releases = rs
	type result struct {
		st  int
		out string
		err error
	}
	done := make(chan result, 2)
	for i := 0; i < 2; i++ {
		go func() {
			st, out, err := installNoFatal(fx.ts.URL+updURL+"/install", fx.member)
			done <- result{st, out, err}
		}()
	}
	var outs []string
	for i := 0; i < 2; i++ {
		r := <-done
		if r.err != nil || r.st != http.StatusOK {
			t.Fatalf("a racing request failed: %d %s %v", r.st, r.out, r.err)
		}
		outs = append(outs, r.out)
	}
	rs.mu.Lock()
	etags := append([]string(nil), rs.etags...)
	rs.mu.Unlock()
	if len(etags) != 2 || etags[0] != etags[1] {
		t.Fatalf("the two requests did not race from one read: etags %q", etags)
	}
	if id := fx.record("a.example.com").InstallRequest.ID; id != 2 {
		t.Fatalf("after two racing requests the id is %d, want 2", id)
	}
	joined := strings.Join(outs, " ")
	if !strings.Contains(joined, `"request":1`) || !strings.Contains(joined, `"request":2`) {
		t.Fatalf("the two answers must be requests 1 and 2: %s", joined)
	}
}

// installCASStore loses every record write's race, as a store would whose
// record another writer keeps moving.
type installCASStore struct {
	release.Store
	key string
}

func (s installCASStore) Get(ctx context.Context, key string) ([]byte, string, error) {
	body, etag, err := s.Store.Get(ctx, key)
	if key == s.key && err == nil {
		// Each read answers a fresh etag, so the write's own read never
		// matches the one the request decided from.
		etag = fmt.Sprintf("%s-%d", etag, time.Now().UnixNano())
	}
	return body, etag, err
}

// R7: only a lost race retries, and five lost races are 409 changed; any
// other write failure is a 502 that does not leak the store's words.
func TestInstallGivesUpAfterFiveLostRaces(t *testing.T) {
	fx := updatesFixture(t)
	fx.srv.cfg.Releases = installCASStore{fx.rel, provision.RecordKey(release.OpsAccount, "km", "a.example.com")}
	st, out := sendJSON(t, http.MethodPost, fx.ts.URL+updURL+"/install", map[string]any{}, fx.member)
	if st != http.StatusConflict || jsonErrorText(t, out) != updatewords.Text("settings.console.changed") {
		t.Fatalf("install that always loses: %d %s", st, out)
	}
	if fx.record("a.example.com").InstallRequest != nil {
		t.Fatal("a lost request wrote the record")
	}
}

func TestInstallStoreFailureIsA502(t *testing.T) {
	fx := updatesFixture(t)
	fx.srv.cfg.Releases = unputtableStore{fx.rel}
	st, out := sendJSON(t, http.MethodPost, fx.ts.URL+updURL+"/install", map[string]any{}, fx.member)
	if st != http.StatusBadGateway || jsonErrorText(t, out) != updatewords.Text("settings.console.store-failed") {
		t.Fatalf("install with an unwritable store: %d %s", st, out)
	}
	if strings.Contains(out, brokenStoreErr) {
		t.Fatalf("the refusal leaks the store's error: %s", out)
	}
}

type unputtableStore struct{ release.Store }

func (u unputtableStore) Put(context.Context, string, []byte, string) (string, error) {
	return "", errors.New(brokenStoreErr)
}

func TestInstallIsRefusedOnAPinnedInstance(t *testing.T) {
	fx := updatesFixture(t)
	fx.putRecord(provision.Record{Schema: 1, Host: "a.example.com", App: "km", Account: "bab", Channel: "stable", Pin: "v1"})
	st, out := sendJSON(t, http.MethodPost, fx.ts.URL+updURL+"/install", map[string]any{}, fx.member)
	if st != http.StatusConflict || jsonErrorText(t, out) != fmt.Sprintf(updatewords.Text("settings.console.pinned"), "a.example.com", "v1") {
		t.Fatalf("install on a pinned instance: %d %s", st, out)
	}
	if fx.record("a.example.com").InstallRequest != nil {
		t.Fatal("a refused request wrote the record")
	}
}

func TestInstallRefusesNamedUnitsOtherKindsAndUnknownHosts(t *testing.T) {
	fx := updatesFixture(t)
	fx.putRecord(provision.Record{Schema: 1, Host: "a.example.com", App: "km", Account: "bab", Channel: "stable", Unit: "console.service", Addr: "127.0.0.1:8080"})
	st, out := sendJSON(t, http.MethodPost, fx.ts.URL+updURL+"/install", map[string]any{}, fx.member)
	if st != http.StatusConflict || jsonErrorText(t, out) != fmt.Sprintf(updatewords.Text("settings.console.named-unit"), "a.example.com") {
		t.Fatalf("named unit: %d %s", st, out)
	}
	fx.putRecord(provision.Record{Schema: 1, Host: "a.example.com", App: "km", Account: "bab", Channel: "stable", Kind: "service", Addr: "127.0.0.1:8080"})
	st, out = sendJSON(t, http.MethodPost, fx.ts.URL+updURL+"/install", map[string]any{}, fx.member)
	if st != http.StatusConflict || jsonErrorText(t, out) != fmt.Sprintf(updatewords.Text("settings.console.not-instance"), "a.example.com", "service") {
		t.Fatalf("service route: %d %s", st, out)
	}
	if fx.record("a.example.com").InstallRequest != nil {
		t.Fatal("a refused request wrote the record")
	}
	u := fx.ts.URL + "/api/cli/apps/bab/km/instances/nope.example.com/updates/install"
	if st, out := sendJSON(t, http.MethodPost, u, map[string]any{}, fx.member); st != http.StatusNotFound {
		t.Fatalf("install on an unknown host: %d %s", st, out)
	}
}

// R8: fast_track is an account owner's; the check is the role, made before
// the store is read.
func TestFastTrackInstallNeedsAnOwner(t *testing.T) {
	fx := updatesFixture(t) // fx.member is a plain member of bab; fx.owner an owner of bab
	st, out := sendJSON(t, http.MethodPost, fx.ts.URL+updURL+"/install", map[string]any{"fast_track": true}, fx.member)
	if st != http.StatusForbidden || jsonErrorText(t, out) != updatewords.Text("settings.console.fast-track-owner") {
		t.Fatalf("a member skipped bake: %d %s", st, out)
	}
	if fx.record("a.example.com").InstallRequest != nil {
		t.Fatal("a refused fast track wrote the record")
	}
	st, out = sendJSON(t, http.MethodPost, fx.ts.URL+updURL+"/install", map[string]any{"fast_track": true}, fx.owner)
	rec := fx.record("a.example.com")
	if st != http.StatusOK || rec.InstallRequest == nil || !rec.InstallRequest.FastTrack || rec.InstallRequest.By != "paul@keymail.dev" {
		t.Fatalf("an owner's fast-track request: %d %s, record %+v", st, out, rec)
	}
	// A plain member's ordinary request is still theirs to make, and clears
	// the fast track the next request does not ask for.
	st, out = sendJSON(t, http.MethodPost, fx.ts.URL+updURL+"/install", map[string]any{"fast_track": false}, fx.member)
	if rec := fx.record("a.example.com"); st != http.StatusOK || rec.InstallRequest.ID != 2 || rec.InstallRequest.FastTrack {
		t.Fatalf("a member's ordinary request after a fast track: %d %s, record %+v", st, out, rec)
	}
}

const policyURL = "/api/cli/apps/bab/km/updates"

func TestPolicyDoorSetsDefaults(t *testing.T) {
	fx := updatesFixture(t)
	fx.boxesEnforce(true)
	st, out := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL,
		map[string]any{"instance_control": []string{"updates"}, "default_updates": "manual"}, fx.member)
	if st != http.StatusOK || !strings.Contains(out, `"default_updates":"manual"`) {
		t.Fatalf("policy: %d %s", st, out)
	}
	if m := fx.manifest(); m.Updates == nil || m.Updates.DefaultUpdates != "manual" || m.Channel != "stable" {
		t.Fatalf("manifest = %+v", m)
	}
}

func TestPolicyDefaultsAreGatedLikeSettings(t *testing.T) {
	fx := updatesFixture(t)
	fx.boxesEnforce(false)
	st, _ := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"default_major": 2}, fx.member)
	if st != http.StatusConflict {
		t.Fatalf("a default major before every box enforces: %d", st)
	}
	st, _ = sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"instance_control": []string{"pin"}}, fx.member)
	if st != http.StatusOK {
		t.Fatalf("instance_control enables nothing by itself: %d", st)
	}
	st, _ = sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"instance_control": []string{"bake"}}, fx.member)
	if st != http.StatusBadRequest {
		t.Fatalf("an unknown control name: %d", st)
	}
}

// Spec rev 11 §3.2: there is no default pin.
func TestPolicyDoorHasNoDefaultPin(t *testing.T) {
	fx := updatesFixture(t)
	fx.boxesEnforce(true)
	st, out := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"default_pin": "v1"}, fx.member)
	if st != http.StatusBadRequest || !strings.Contains(out, "default_pin") {
		t.Fatalf("a default pin: %d %s", st, out)
	}
	if m := fx.manifest(); m.Updates != nil {
		t.Fatalf("the refused request wrote a policy: %+v", m.Updates)
	}
}

// Spec rev 11 §3.2: the channel default applies only when an instance is
// created; every record carries its channel from creation.
func TestDefaultChannelReachesOnlyNewInstances(t *testing.T) {
	fx := updatesFixture(t) // a.example.com exists on stable
	st, _ := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"default_channel": "beta"}, fx.member)
	if st != http.StatusOK {
		t.Fatal(st)
	}
	if ch := fx.record("a.example.com").Channel; ch != "stable" {
		t.Fatalf("an existing instance moved to %s", ch)
	}
	rec := fx.record("a.example.com")
	if u := provision.EffectiveUpdates(rec, fx.manifest().Updates); u.Channel != "stable" {
		t.Fatalf("effective channel %s", u.Channel)
	}
	fx.createInstance(t, "b.example.com") // through the console's create door, no channel given
	if ch := fx.record("b.example.com").Channel; ch != "beta" {
		t.Fatalf("a new instance got %s, want the default beta", ch)
	}
}

// Decision 7: the key check comes before any store read, so an unknown key
// is the 400 even for an app with no instances manifest.
func TestPolicyUnknownKeyIsRefusedBeforeTheStore(t *testing.T) {
	fx := updatesFixture(t)
	if err := fx.store.Delete(context.Background(), provision.ManifestKey(release.OpsAccount, "km")); err != nil {
		t.Fatal(err)
	}
	st, out := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"default_pin": "v1", "default_updates": "auto"}, fx.member)
	if st != http.StatusBadRequest || jsonErrorText(t, out) != fmt.Sprintf(updatewords.Text("settings.console.unknown-policy-key"), "default_pin") {
		t.Fatalf("an unknown key on an app with no manifest: %d %s", st, out)
	}
}

// Decision 1: only a change that turns a default ON waits for the fleet. A
// value re-sent unchanged beside a clear is not an enable, and clearing is
// never refused.
func TestPolicyClearingBesideAnUnchangedEnableIsNeverRefused(t *testing.T) {
	fx := updatesFixture(t)
	fx.boxesEnforce(false)
	two := 2
	policy := &provision.UpdatePolicy{InstanceControl: []string{"pin"}, DefaultUpdates: release.UpdatesManual, DefaultMajor: &two}
	fx.setManifest(provision.Manifest{Schema: 1, App: "km", Domain: "example.com", Channel: "stable", Updates: policy})
	st, out := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL,
		map[string]any{"default_updates": "manual", "default_major": 2, "instance_control": nil}, fx.member)
	if p := fx.manifest().Updates; st != http.StatusOK || p == nil || p.InstanceControl != nil ||
		p.DefaultUpdates != release.UpdatesManual || p.DefaultMajor == nil || *p.DefaultMajor != 2 {
		t.Fatalf("manual and major re-sent, control cleared: %d %s, policy %+v", st, out, p)
	}
	st, out = sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"default_major": 2, "default_updates": "auto"}, fx.member)
	if p := fx.manifest().Updates; st != http.StatusOK || p == nil || p.DefaultUpdates != release.UpdatesAuto || p.DefaultMajor == nil || *p.DefaultMajor != 2 {
		t.Fatalf("major re-sent, manual turned off: %d %s, policy %+v", st, out, p)
	}
	// instance_control and default_channel never enable.
	st, out = sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"instance_control": []string{"updates", "major"}, "default_channel": "beta"}, fx.member)
	if st != http.StatusOK {
		t.Fatalf("control and channel before the fleet enforces: %d %s", st, out)
	}
	// A changed value is still an enable, and still waits.
	for _, body := range []map[string]any{{"default_major": 3}, {"default_updates": "manual"}, {"default_major": 3, "default_updates": "auto"}} {
		before := fx.manifest()
		st, out := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, body, fx.member)
		if st != http.StatusConflict || jsonErrorText(t, out) != fmt.Sprintf(updatewords.Text("settings.console.not-enforced"), 1) {
			t.Errorf("%v before the fleet enforces: %d %s", body, st, out)
		}
		if strings.Contains(out, "ie-1") {
			t.Errorf("%v: the refusal names a box: %s", body, out)
		}
		after := fx.manifest()
		if after.Updates.DefaultUpdates != before.Updates.DefaultUpdates || !sameMajor(after.Updates.DefaultMajor, before.Updates.DefaultMajor) {
			t.Errorf("%v: a refused enable wrote the manifest: %+v -> %+v", body, before.Updates, after.Updates)
		}
	}
	// Clearing them is never refused.
	st, out = sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"default_major": nil, "default_updates": nil, "instance_control": []string{}}, fx.member)
	if m := fx.manifest(); st != http.StatusOK || m.Updates != nil || m.Channel != "beta" {
		t.Fatalf("clearing every default: %d %s, manifest %+v", st, out, m)
	}
}

// R3 at the policy door: an unreadable inventory refuses an enable with its
// own words, and a clear still goes through.
func TestPolicyEnableIsRefusedWhenEnforcementIsUnknown(t *testing.T) {
	fx := updatesFixture(t)
	fx.boxesEnforce(true)
	fx.srv.cfg.Releases = unlistableStore{fx.rel}
	st, out := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"default_updates": "manual"}, fx.member)
	if st != http.StatusBadGateway || jsonErrorText(t, out) != updatewords.Text("settings.console.enforcement-unknown") {
		t.Fatalf("enable with an unreadable inventory: %d %s", st, out)
	}
	if st, out := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"default_updates": "auto"}, fx.member); st != http.StatusOK {
		t.Fatalf("a non-enabling change with an unreadable inventory: %d %s", st, out)
	}
}

// Decision 2: strict input. A value of the wrong type is refused, never read
// as a clear, and a refused request writes nothing.
func TestPolicyDoorRefusesWrongTypes(t *testing.T) {
	fx := updatesFixture(t)
	fx.boxesEnforce(true)
	one := 1
	policy := &provision.UpdatePolicy{InstanceControl: []string{"pin"}, DefaultUpdates: release.UpdatesManual, DefaultMajor: &one}
	fx.setManifest(provision.Manifest{Schema: 1, App: "km", Domain: "example.com", Channel: "stable", Updates: policy})
	badControl := updatewords.Text("settings.console.bad-control")
	badUpdates := updatewords.Text("settings.console.bad-updates")
	badMajor := updatewords.Text("settings.console.bad-major")
	for _, c := range []struct{ body, want string }{
		{`{"instance_control":"updates"}`, badControl},
		{`{"instance_control":""}`, badControl},
		{`{"instance_control":5}`, badControl},
		{`{"instance_control":{"updates":true}}`, badControl},
		{`{"instance_control":[1]}`, badControl},
		{`{"instance_control":["updates",null]}`, badControl},
		{`{"instance_control":["updates","updates"]}`, badControl},
		{`{"instance_control":["bake"]}`, badControl},
		{`{"default_updates":5}`, badUpdates},
		{`{"default_updates":true}`, badUpdates},
		{`{"default_updates":"sometimes"}`, badUpdates},
		{`{"default_major":-1}`, badMajor},
		{`{"default_major":1.5}`, badMajor},
		{`{"default_major":"2"}`, badMajor},
		{`{"default_major":1e300}`, badMajor},
		{`{"default_major":true}`, badMajor},
		{`{"default_major":[2]}`, badMajor},
	} {
		st, _, out := rawReq(t, http.MethodPut, fx.ts.URL+policyURL, fx.member, c.body)
		if st != http.StatusBadRequest || jsonErrorText(t, out) != c.want {
			t.Errorf("%s: %d %s, want 400 %q", c.body, st, out, c.want)
		}
	}
	if p := fx.manifest().Updates; p == nil || len(p.InstanceControl) != 1 || p.DefaultUpdates != release.UpdatesManual || p.DefaultMajor == nil || *p.DefaultMajor != 1 {
		t.Fatalf("a refused request changed the policy: %+v", p)
	}
	// null and "" clear, for every key that clears.
	if st, _, out := rawReq(t, http.MethodPut, fx.ts.URL+policyURL, fx.member, `{"instance_control":null,"default_updates":"","default_major":""}`); st != http.StatusOK {
		t.Fatalf("clearing with null and empty: %d %s", st, out)
	}
	if m := fx.manifest(); m.Updates != nil || m.Channel != "stable" {
		t.Fatalf("null and empty did not clear: %+v", m)
	}
	fx.setManifest(provision.Manifest{Schema: 1, App: "km", Domain: "example.com", Channel: "stable", Updates: policy})
	if st, _, out := rawReq(t, http.MethodPut, fx.ts.URL+policyURL, fx.member, `{"default_updates":null,"default_major":null}`); st != http.StatusOK {
		t.Fatalf("clearing with null: %d %s", st, out)
	}
	if p := fx.manifest().Updates; p == nil || p.DefaultUpdates != "" || p.DefaultMajor != nil || len(p.InstanceControl) != 1 {
		t.Fatalf("null did not clear only what it named: %+v", p)
	}
}

// Decision 3: default_channel is checked as the instances-manifest door
// checks its channel, and the manifest's channel cannot be cleared here.
func TestDefaultChannelIsValidatedAndNeverCleared(t *testing.T) {
	fx := updatesFixture(t)
	for _, body := range []string{
		`{"default_channel":""}`, `{"default_channel":null}`, `{"default_channel":5}`,
		`{"default_channel":"../x"}`, `{"default_channel":"a/b/c"}`, `{"default_channel":"Beta Two"}`,
	} {
		st, _, out := rawReq(t, http.MethodPut, fx.ts.URL+policyURL, fx.member, body)
		if st != http.StatusBadRequest || jsonErrorText(t, out) != "invalid channel name" {
			t.Errorf("%s: %d %s, want 400 invalid channel name", body, st, out)
		}
	}
	if ch := fx.manifest().Channel; ch != "stable" {
		t.Fatalf("a refused channel changed the manifest: %s", ch)
	}
	if st, out := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"default_channel": "canary/x"}, fx.member); st != http.StatusOK || fx.manifest().Channel != "canary/x" {
		t.Fatalf("a two-part channel: %d %s", st, out)
	}
}

// policyFailingStore fails every read of one key with brokenStoreErr.
type policyFailingStore struct {
	release.Store
	key string
}

func (s policyFailingStore) Get(ctx context.Context, key string) ([]byte, string, error) {
	if key == s.key {
		return nil, "", errors.New(brokenStoreErr)
	}
	return s.Store.Get(ctx, key)
}

// Decision 4: no manifest is 409 no-manifest; a manifest that cannot be read
// is a 502 that does not leak the store's words.
func TestPolicyDoorManifestReadFailures(t *testing.T) {
	fx := updatesFixture(t)
	key := provision.ManifestKey(release.OpsAccount, "km")
	fx.srv.cfg.Releases = policyFailingStore{fx.rel, key}
	st, out := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"default_updates": "auto"}, fx.member)
	if st != http.StatusBadGateway || jsonErrorText(t, out) != updatewords.Text("settings.console.policy-read-failed") {
		t.Fatalf("an unreadable manifest: %d %s", st, out)
	}
	if strings.Contains(out, brokenStoreErr) {
		t.Fatalf("the refusal leaks the store's error: %s", out)
	}
	fx.srv.cfg.Releases = fx.rel
	if err := fx.store.Delete(context.Background(), key); err != nil {
		t.Fatal(err)
	}
	st, out = sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"default_updates": "auto"}, fx.member)
	if st != http.StatusConflict || jsonErrorText(t, out) != updatewords.Text("settings.console.no-manifest") {
		t.Fatalf("no manifest: %d %s", st, out)
	}
	if _, _, err := fx.store.Get(context.Background(), key); err == nil {
		t.Fatal("the refused request wrote a manifest")
	}
}

// Decision 5: a lost race is 409 changed; any other write failure is a 502
// that does not leak the store's words.
func TestPolicyDoorWriteFailures(t *testing.T) {
	fx := updatesFixture(t)
	key := provision.ManifestKey(release.OpsAccount, "km")
	fx.srv.cfg.Releases = installCASStore{fx.rel, key}
	st, out := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"default_channel": "beta"}, fx.member)
	if st != http.StatusConflict || jsonErrorText(t, out) != updatewords.Text("settings.console.changed") {
		t.Fatalf("a lost race: %d %s", st, out)
	}
	fx.srv.cfg.Releases = unputtableStore{fx.rel}
	st, out = sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, map[string]any{"default_channel": "beta"}, fx.member)
	if st != http.StatusBadGateway || jsonErrorText(t, out) != updatewords.Text("settings.console.store-failed") {
		t.Fatalf("an unwritable store: %d %s", st, out)
	}
	if strings.Contains(out, brokenStoreErr) {
		t.Fatalf("the refusal leaks the store's error: %s", out)
	}
	fx.srv.cfg.Releases = fx.rel
	if ch := fx.manifest().Channel; ch != "stable" {
		t.Fatalf("a failed write changed the manifest: %s", ch)
	}
}

// Decisions 6 and 8: a change bumps the serial once and leaves one activity
// line; a request that changes nothing writes, bumps and audits nothing, and
// answers the current policy. instance_control is [] when empty, never null.
func TestPolicyDoorAnnouncesOnlyChanges(t *testing.T) {
	fx := updatesFixture(t)
	fx.boxesEnforce(true)
	key := provision.ManifestKey(release.OpsAccount, "km")
	_, etag, err := fx.store.Get(context.Background(), key)
	if err != nil {
		t.Fatal(err)
	}
	before := serial(t, fx.consoleFixture)
	for _, body := range []map[string]any{{}, {"default_channel": "stable"}, {"default_updates": nil, "default_major": "", "instance_control": []string{}}} {
		st, out := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL, body, fx.member)
		want := `{"default_channel":"stable","default_major":null,"default_updates":"","instance_control":[]}`
		if st != http.StatusOK || strings.TrimSpace(out) != want {
			t.Fatalf("%v: %d %s, want 200 %s", body, st, out, want)
		}
	}
	if _, now, _ := fx.store.Get(context.Background(), key); now != etag {
		t.Fatal("a request that changed nothing wrote the manifest")
	}
	if got := serial(t, fx.consoleFixture); got != before {
		t.Fatalf("a request that changed nothing bumped the serial: %d -> %d", before, got)
	}
	st, out := sendJSON(t, http.MethodPut, fx.ts.URL+policyURL,
		map[string]any{"instance_control": []string{"updates", "pin"}, "default_major": 2, "default_channel": "beta"}, fx.member)
	want := `{"default_channel":"beta","default_major":2,"default_updates":"","instance_control":["updates","pin"]}`
	if st != http.StatusOK || strings.TrimSpace(out) != want {
		t.Fatalf("a change: %d %s, want %s", st, out, want)
	}
	if got := serial(t, fx.consoleFixture); got != before+1 {
		t.Fatalf("serial = %d, want one bump from %d", got, before)
	}
	acts, err := fx.st.Events(OpsAccountID, "km", 50)
	if err != nil {
		t.Fatal(err)
	}
	wantLine := fmt.Sprintf(updatewords.Text("settings.console.audit-policy"), "km", "instance_control updates,pin, default major 2, default channel beta")
	n := 0
	for _, a := range acts {
		if a.Action == "app-update-policy" {
			n++
			if a.Detail != wantLine || a.Address != "alice@keymail.dev" {
				t.Errorf("activity line %+v, want %q by alice", a, wantLine)
			}
		}
	}
	if n != 1 {
		t.Fatalf("%d policy activity lines, want 1: %+v", n, acts)
	}
}