package console

import (
	"encoding/json"
	"errors"
	"testing"
	"time"

	"github.com/carlosframework/platform/internal/hostops"
	"github.com/carlosframework/platform/internal/objstore"
	"github.com/carlosframework/platform/internal/release"
)

func putNameClaim(t *testing.T, s release.Store, kind string, c objstore.NameClaim) {
	t.Helper()
	body, err := json.Marshal(c)
	if err != nil {
		t.Fatal(err)
	}
	if _, err = s.Put(t.Context(), "objstore/name-claims/"+kind+"/"+c.Name+".json", body, ""); err != nil {
		t.Fatal(err)
	}
}

// Review P2-8: ownership comes only from the durable name claim in its exact
// deterministic form; app-writable store records prove nothing.
func TestResolveStoreRequiresProvenNameClaim(t *testing.T) {
	ctx := t.Context()
	data := release.NewDirStore(t.TempDir())
	d := objstore.Deployment{BucketPrefix: "cf-"}
	g := backendGuard{data: data, deployment: d}
	now := time.Date(2026, 10, 7, 12, 0, 0, 0, time.UTC)

	// Another tenant's unclaimed (legacy) bucket. v2 attributed it to any
	// permitted app whose own (app-writable) store record named it; there is
	// no record path any more, so no permit or record can reach it.
	for _, m := range []string{"EmptyBucket", "DeleteBucket", "EnsureBucket", "EnsureEnabled", "Scan", "EnsureUser:bucket"} {
		if _, err := g.resolveStore(ctx, "buckets", "legacy-victim", m); !errors.Is(err, errBackendUnproven) {
			t.Fatalf("%s on an unclaimed bucket: %v", m, err)
		}
	}
	if _, err := g.resolveStore(ctx, "users", "carlos-store-zed-web", "DeleteUser"); !errors.Is(err, errBackendUnproven) {
		t.Fatalf("unclaimed user: %v", err)
	}

	// Minted and claimed: owned by the claim holder.
	minted := objstore.MintedBucketIn(d, "bab", "demo", "")
	putNameClaim(t, data, "buckets", objstore.NameClaim{Schema: 1, Name: minted, Account: "bab", App: "demo", CreatedAt: now})
	scopes, err := g.resolveStore(ctx, "buckets", minted, "DeleteBucket")
	if err != nil || len(scopes) != 1 || scopes[0] != (hostops.AppScope{Account: "bab", App: "demo"}) {
		t.Fatalf("minted claimed bucket: %v %v", scopes, err)
	}

	// Adopted (non-minted) and claimed: only create-if-absent.
	putNameClaim(t, data, "buckets", objstore.NameClaim{Schema: 1, Name: "adopted-name", Account: "bab", App: "demo", CreatedAt: now})
	if _, err = g.resolveStore(ctx, "buckets", "adopted-name", "EnsureBucket"); err != nil {
		t.Fatalf("EnsureBucket on an adopted claimed bucket: %v", err)
	}
	for _, m := range []string{"EmptyBucket", "DeleteBucket", "EnsureEnabled", "Scan", "EnsureUser:bucket"} {
		if _, err = g.resolveStore(ctx, "buckets", "adopted-name", m); !errors.Is(err, errBackendUnproven) {
			t.Fatalf("%s on an unproven adopted bucket: %v", m, err)
		}
	}

	// A user claim whose name is not the holder's deterministic name.
	putNameClaim(t, data, "users", objstore.NameClaim{Schema: 1, Name: "carlos-store-zed-web", Account: "bab", App: "demo", CreatedAt: now})
	if _, err = g.resolveStore(ctx, "users", "carlos-store-zed-web", "DeleteUser"); !errors.Is(err, errBackendUnproven) {
		t.Fatalf("forged user claim: %v", err)
	}
}

// Review P2-8: a mail user name is never parsed back at "+s+" onto its
// parent's record; with no caller index of its own it is unproven.
func TestResolveMailUserNoReverseParse(t *testing.T) {
	ctx := t.Context()
	data := release.NewDirStore(t.TempDir())
	g := backendGuard{data: data}
	body, _ := json.Marshal(map[string]any{"schema": 1, "iam_user": "carlos-mail-bab-demo", "account": "bab", "app": "demo", "sender": "", "created_at": time.Now()})
	if _, err := data.Put(ctx, "email/callers/carlos-mail-bab-demo.json", body, ""); err != nil {
		t.Fatal(err)
	}
	if _, err := g.resolveMailUser(ctx, "carlos-mail-bab-demo+s+evil"); !errors.Is(err, errBackendUnproven) {
		t.Fatalf("standalone name resolved through its parent's record: %v", err)
	}
	scopes, err := g.resolveMailUser(ctx, "carlos-mail-bab-demo")
	if err != nil || len(scopes) != 1 || scopes[0] != (hostops.AppScope{Account: "bab", App: "demo"}) {
		t.Fatalf("exact caller index: %v %v", scopes, err)
	}
}