package edge

import (
	"bytes"
	"crypto/sha256"
	"encoding/hex"
	"log"
	"net"
	"net/http"
	"net/http/httptest"
	"os"
	"strings"
	"testing"
	"time"

	"github.com/carlosframework/platform/internal/registry"
)

// sha256Hex is the test-side mirror of what FleetChannelAuth stores and
// SetDynamicAuth consumes: the sha256 hex of a bearer token, never the
// plaintext.
func sha256Hex(s string) string {
	sum := sha256.Sum256([]byte(s))
	return hex.EncodeToString(sum[:])
}

// tunnelReq builds a request that is well-formed EXCEPT for the credentials
// under test: valid upgrade headers, so the auth cases below can only fail on
// auth. Pass an empty token to send no Authorization header at all.
func tunnelReq(name, token string) *http.Request {
	req := httptest.NewRequest("GET", "/register", nil)
	req.Header.Set("Connection", "Upgrade")
	req.Header.Set("Upgrade", tunnelUpgradeProto)
	req.Header.Set("Carlos-Tunnel-Name", name)
	if token != "" {
		req.Header.Set("Authorization", "Bearer "+token)
	}
	return req
}

func TestTunnelRegisterRejectsBadToken(t *testing.T) {
	// TWO clients on purpose: with only one configured, no test here can tell
	// "every token is bound to its own channel" apart from "any known token
	// admits any known channel" — an implementation looping over h.clients
	// would pass a single-client table unchanged.
	hub := NewTunnelHub("tunnel.test", map[string]string{"pi-box": "sekrit", "hq": "other"})
	for _, tc := range []struct{ desc, name, token string }{
		{"no auth", "", ""},
		{"wrong token", "pi-box", "nope"},
		{"unknown name", "nosuch", "sekrit"},
		{"empty name", "", "sekrit"},
		// The binding property itself: a valid token may only ever claim ITS
		// OWN channel name, in either direction.
		{"cross-name", "hq", "sekrit"},
		{"cross-name reversed", "pi-box", "other"},
	} {
		rec := httptest.NewRecorder()
		hub.ServeHTTP(rec, tunnelReq(tc.name, tc.token))
		if rec.Code != http.StatusUnauthorized {
			t.Errorf("%s (name=%q token=%q): got %d, want 401", tc.desc, tc.name, tc.token, rec.Code)
		}
	}
}

// Scheme-less credential: "Authorization: sekrit" must not authenticate even
// though "sekrit" is the correct configured token — TrimPrefix would have let
// this through unchanged (nothing to strip), which is the bug this pins.
func TestTunnelRegisterRejectsSchemelessAuthorization(t *testing.T) {
	hub := NewTunnelHub("tunnel.test", map[string]string{"pi-box": "sekrit"})
	req := tunnelReq("pi-box", "")
	req.Header.Set("Authorization", "sekrit") // no "Bearer " prefix
	rec := httptest.NewRecorder()
	hub.ServeHTTP(rec, req)
	if rec.Code != http.StatusUnauthorized {
		t.Fatalf("scheme-less Authorization: got %d, want 401", rec.Code)
	}
}

func TestTunnelRegisterAuthPrecedesUpgradeCheck(t *testing.T) {
	hub := NewTunnelHub("tunnel.test", map[string]string{"pi-box": "sekrit"})
	req := httptest.NewRequest("GET", "/register", nil) // no upgrade headers at all
	req.Header.Set("Authorization", "Bearer nope")
	req.Header.Set("Carlos-Tunnel-Name", "pi-box")
	rec := httptest.NewRecorder()
	hub.ServeHTTP(rec, req)
	if rec.Code != http.StatusUnauthorized {
		t.Fatalf("got %d, want 401 — an unauthenticated caller must not learn which upgrade protocols we speak", rec.Code)
	}
}

func TestTunnelRegisterRejectsWrongUpgrade(t *testing.T) {
	hub := NewTunnelHub("tunnel.test", map[string]string{"pi-box": "sekrit"})
	for _, tc := range []struct{ desc, conn, upgrade string }{
		{"no upgrade headers", "", ""},
		{"missing Upgrade", "Upgrade", ""},
		{"missing Connection", "", tunnelUpgradeProto},
		{"wrong version", "Upgrade", "carlos-tunnel/2"},
		{"other protocol", "Upgrade", "websocket"},
	} {
		req := httptest.NewRequest("GET", "/register", nil)
		req.Header.Set("Authorization", "Bearer sekrit")
		req.Header.Set("Carlos-Tunnel-Name", "pi-box")
		if tc.conn != "" {
			req.Header.Set("Connection", tc.conn)
		}
		if tc.upgrade != "" {
			req.Header.Set("Upgrade", tc.upgrade)
		}
		rec := httptest.NewRecorder()
		hub.ServeHTTP(rec, req)
		if rec.Code != http.StatusBadRequest {
			t.Errorf("%s: got %d, want 400", tc.desc, rec.Code)
			continue
		}
		// A future carlos-tunnel/2 host must get a diagnosable refusal.
		if !strings.Contains(rec.Body.String(), tunnelUpgradeProto) {
			t.Errorf("%s: body %q should name the expected protocol", tc.desc, rec.Body.String())
		}
	}
}

func TestTunnelRegisterAcceptsTokenWiseConnectionHeader(t *testing.T) {
	hub := NewTunnelHub("tunnel.test", map[string]string{"pi-box": "sekrit"})
	req := httptest.NewRequest("GET", "/register", nil)
	req.Header.Set("Authorization", "Bearer sekrit")
	req.Header.Set("Carlos-Tunnel-Name", "pi-box")
	req.Header.Set("Connection", "keep-alive, Upgrade") // token-wise, per RFC 7230
	req.Header.Set("Upgrade", "Carlos-Tunnel/1")        // protocol names are case-insensitive
	rec := httptest.NewRecorder()
	hub.ServeHTTP(rec, req)
	// This request passes auth AND the upgrade gate, then dies at the hijack,
	// which httptest.NewRecorder cannot do — so 500 (not 400) is how we know
	// the gate let it through. The real 101 is Task 10's e2e.
	if rec.Code != http.StatusInternalServerError {
		t.Fatalf("got %d, want 500 (past the upgrade gate, stopped at the hijack)", rec.Code)
	}
}

func TestTunnelRegisterRejectsUnknownPath(t *testing.T) {
	hub := NewTunnelHub("tunnel.test", map[string]string{"pi-box": "sekrit"})
	req := httptest.NewRequest("GET", "/anything-else", nil)
	rec := httptest.NewRecorder()
	hub.ServeHTTP(rec, req)
	if rec.Code != http.StatusNotFound {
		t.Fatalf("got %d, want 404", rec.Code)
	}
}

// TestTunnelRegisterAcceptsDynamicToken proves the second credential source:
// a channel name containing "/" (the "<fleet>/<label>" shape ValidTunnelName
// would refuse) authenticates against a token hash set via SetDynamicAuth,
// hashing the presented token and comparing against the stored hash rather
// than the plaintext.
func TestTunnelRegisterAcceptsDynamicToken(t *testing.T) {
	hub := NewTunnelHub("tunnel.test", nil)
	hub.SetDynamicAuth(map[string]string{"acme/pi-1": sha256Hex("tok")})
	rec := httptest.NewRecorder()
	hub.ServeHTTP(rec, tunnelReq("acme/pi-1", "tok"))
	// Same tell as TestTunnelRegisterAcceptsTokenWiseConnectionHeader: past
	// auth and the upgrade gate, stopped at the hijack httptest can't do.
	if rec.Code != http.StatusInternalServerError {
		t.Fatalf("got %d, want 500 (past auth, stopped at the hijack)", rec.Code)
	}
}

func TestTunnelRegisterRejectsWrongDynamicToken(t *testing.T) {
	hub := NewTunnelHub("tunnel.test", nil)
	hub.SetDynamicAuth(map[string]string{"acme/pi-1": sha256Hex("tok")})
	rec := httptest.NewRecorder()
	hub.ServeHTTP(rec, tunnelReq("acme/pi-1", "wrong"))
	if rec.Code != http.StatusUnauthorized {
		t.Fatalf("got %d, want 401", rec.Code)
	}
}

func TestTunnelRegisterRejectsUnknownDynamicChannel(t *testing.T) {
	hub := NewTunnelHub("tunnel.test", nil)
	hub.SetDynamicAuth(map[string]string{"acme/pi-1": sha256Hex("tok")})
	rec := httptest.NewRecorder()
	hub.ServeHTTP(rec, tunnelReq("acme/pi-2", "tok"))
	if rec.Code != http.StatusUnauthorized {
		t.Fatalf("got %d, want 401", rec.Code)
	}
}

// TestStaticClientStillAuthenticatesAlongsideDynamicSet is the regression: a
// static env client must keep authenticating unchanged even once a dynamic
// set is also configured on the same hub (tito hq's plaintext-compare path
// is untouched by fleet channels landing).
func TestStaticClientStillAuthenticatesAlongsideDynamicSet(t *testing.T) {
	hub := NewTunnelHub("tunnel.test", map[string]string{"hq": "sekrit"})
	hub.SetDynamicAuth(map[string]string{"acme/pi-1": sha256Hex("tok")})
	rec := httptest.NewRecorder()
	hub.ServeHTTP(rec, tunnelReq("hq", "sekrit"))
	if rec.Code != http.StatusInternalServerError {
		t.Fatalf("static client with a dynamic set also configured: got %d, want 500", rec.Code)
	}
}

// TestVerifyDynamic covers the extracted gate directly, without a handshake:
// VerifyDynamic is the one place that answers "does (name, token) authenticate
// as a fleet channel, and whose?" — ServeHTTP's dynamic branch is now just a
// caller, and later fleet-API surfaces (which have no ResponseWriter to 401
// with) need the same answer.
func TestVerifyDynamic(t *testing.T) {
	// The static client is configured on the SAME hub on purpose: a static
	// name must never authenticate through this gate, even presenting the
	// correct plaintext token h.clients holds for it. ServeHTTP's static
	// compare is the only path that may admit it.
	hub := NewTunnelHub("tunnel.test", map[string]string{"hq": "sekrit"})
	hub.SetDynamicAuth(map[string]string{"pi/box-a": sha256Hex("tok")})
	for _, tc := range []struct {
		desc, name, token string
		wantFleet         string
		wantOK            bool
	}{
		{desc: "static name with its own correct plaintext token", name: "hq", token: "sekrit"},
		{desc: "unknown dynamic name", name: "pi/box-z", token: "tok"},
		{desc: "right name, wrong token", name: "pi/box-a", token: "wrong"},
		{desc: "right name and token", name: "pi/box-a", token: "tok", wantFleet: "pi", wantOK: true},
	} {
		fleet, ok := hub.VerifyDynamic(tc.name, tc.token)
		if ok != tc.wantOK || fleet != tc.wantFleet {
			t.Errorf("%s: VerifyDynamic(%q, %q) = (%q, %v), want (%q, %v)",
				tc.desc, tc.name, tc.token, fleet, ok, tc.wantFleet, tc.wantOK)
		}
	}
	// A SetDynamicAuth swap that drops the name must refuse it the instant it
	// returns — the same whole-map-replace property detach relies on.
	hub.SetDynamicAuth(map[string]string{"pi/box-b": sha256Hex("tok")})
	if fleet, ok := hub.VerifyDynamic("pi/box-a", "tok"); ok || fleet != "" {
		t.Errorf("after a SetDynamicAuth swap dropping the name: got (%q, %v), want (\"\", false)", fleet, ok)
	}
}

// TestVerifyDynamicRefusesSlashlessNameInDynamicAuth is the one case only the
// "/" gate can refuse, and so the only test that actually pins it: the name is
// PRESENT in dynamicAuth under a hash that matches the presented token, so
// every other check in VerifyDynamic passes. Delete the gate and this test
// fails; the table above would not, because "hq" simply misses that map.
//
// It makes the doc comment's claim real: no slash-less name authenticates
// here, whatever dynamicAuth holds. Production never writes such a key
// (FleetChannelAuth emits "<fleet>/<label>" only) — the point is that a future
// writer that did could not silently turn a static channel name, or a name
// with no fleet at all, into a fleet-authenticated one.
func TestVerifyDynamicRefusesSlashlessNameInDynamicAuth(t *testing.T) {
	hub := NewTunnelHub("tunnel.test", map[string]string{"hq": "sekrit"})
	hub.SetDynamicAuth(map[string]string{
		"hq":      sha256Hex("sekrit"), // a static channel name, hash-correct
		"/box-a":  sha256Hex("tok"),    // empty fleet segment, hash-correct
		"noslash": sha256Hex("tok"),
	})
	for _, tc := range []struct{ desc, name, token string }{
		{"static name, hash-correct, present in dynamicAuth", "hq", "sekrit"},
		{"empty fleet segment", "/box-a", "tok"},
		{"bare name with no separator", "noslash", "tok"},
	} {
		if fleet, ok := hub.VerifyDynamic(tc.name, tc.token); ok || fleet != "" {
			t.Errorf("%s: VerifyDynamic(%q, %q) = (%q, %v), want (\"\", false)",
				tc.desc, tc.name, tc.token, fleet, ok)
		}
	}
}

// TestCloseChannelClosesAndRemovesLiveConn: CloseChannel is the detach/rotate
// primitive — force-close a live conn and drop it from the map. No real h2
// handshake needed: CloseChannel only ever touches .raw.
func TestCloseChannelClosesAndRemovesLiveConn(t *testing.T) {
	hub := NewTunnelHub("tunnel.test", nil)
	c1, c2 := net.Pipe()
	defer c2.Close()
	hub.mu.Lock()
	hub.conns["acme/pi-1"] = &tunnelConn{raw: c1}
	hub.mu.Unlock()

	hub.CloseChannel("acme/pi-1")

	hub.mu.Lock()
	_, stillThere := hub.conns["acme/pi-1"]
	hub.mu.Unlock()
	if stillThere {
		t.Fatal("CloseChannel left the channel registered")
	}
	if _, err := c1.Write([]byte("x")); err == nil {
		t.Fatal("CloseChannel did not close the raw conn")
	}
}

// TestCloseChannelOnUnknownNameIsNoop: closing a name with no live conn must
// not panic or otherwise misbehave (Reload calls this for every vanished
// registry entry, whether or not a channel was ever actually connected).
func TestCloseChannelOnUnknownNameIsNoop(t *testing.T) {
	hub := NewTunnelHub("tunnel.test", nil)
	hub.CloseChannel("nosuch/label")
}

// TestSetDynamicAuthRotationClosesVanishedChannelAndRefusesOldToken pins the
// brief's exact rotation contract: a token authenticates while its channel is
// in the dynamic set; once SetDynamicAuth is called WITHOUT that entry (the
// shape a rotate/detach registry poll produces), any live conn for it is
// force-closed and the old token is refused on the very next dial — not left
// to die on its own on the next failed ping.
func TestSetDynamicAuthRotationClosesVanishedChannelAndRefusesOldToken(t *testing.T) {
	hub := NewTunnelHub("tunnel.test", nil)
	hub.SetDynamicAuth(map[string]string{"acme/pi-1": sha256Hex("tok")})

	// Valid while present.
	rec := httptest.NewRecorder()
	hub.ServeHTTP(rec, tunnelReq("acme/pi-1", "tok"))
	if rec.Code != http.StatusInternalServerError {
		t.Fatalf("initial dynamic dial: got %d, want 500", rec.Code)
	}

	// A live established channel for that name.
	c1, c2 := net.Pipe()
	defer c2.Close()
	hub.mu.Lock()
	hub.conns["acme/pi-1"] = &tunnelConn{raw: c1}
	hub.mu.Unlock()

	// Rotate: the entry vanishes from the dynamic set entirely.
	hub.SetDynamicAuth(map[string]string{})

	hub.mu.Lock()
	_, stillThere := hub.conns["acme/pi-1"]
	hub.mu.Unlock()
	if stillThere {
		t.Fatal("SetDynamicAuth left the vanished channel's live conn registered")
	}
	if _, err := c1.Write([]byte("x")); err == nil {
		t.Fatal("SetDynamicAuth did not close the vanished channel's raw conn")
	}

	rec2 := httptest.NewRecorder()
	hub.ServeHTTP(rec2, tunnelReq("acme/pi-1", "tok"))
	if rec2.Code != http.StatusUnauthorized {
		t.Fatalf("old token after rotation: got %d, want 401", rec2.Code)
	}
}

func TestParseTunnelClients(t *testing.T) {
	got, err := parseTunnelClients("pi-box=sekrit,hq=other")
	if err != nil || got["pi-box"] != "sekrit" || got["hq"] != "other" {
		t.Fatalf("parse: %v %v", got, err)
	}
	if _, err := parseTunnelClients("malformed"); err == nil {
		t.Fatal("want error on entry without '='")
	}
}

// tunnelRoute upserts one route into a fresh registry (openReg, the package's
// one registry harness — edge_test.go) and returns the registry.
func tunnelRoute(t *testing.T, rt registry.Route) *registry.Registry {
	t.Helper()
	reg := openReg(t)
	if err := reg.Upsert(rt); err != nil {
		t.Fatalf("upsert: %v", err)
	}
	return reg
}

func TestReloadBuildsTunnelBackedRoute(t *testing.T) {
	reg := tunnelRoute(t, registry.Route{
		Host: "demo.example", Kind: "instance", Status: "ready", Tunnel: "pi-box",
	})
	e, err := New(reg, nil)
	if err != nil {
		t.Fatal(err)
	}
	// Before EnableTunnels the route has no backend at all: it must not be
	// served, and must not burn an ACME issuance either.
	if e.Allowed("demo.example") {
		t.Fatal("tunnel-backed route served with no hub configured")
	}
	hub := NewTunnelHub("tunnel.test", map[string]string{"pi-box": "sekrit"})
	e.EnableTunnels(hub)
	if err := e.Reload(); err != nil {
		t.Fatal(err)
	}
	if !e.Allowed("demo.example") {
		t.Fatal("tunnel-backed route not served after EnableTunnels+Reload")
	}
	if !e.Allowed("tunnel.test") {
		t.Fatal("reserved tunnel hostname must be Allowed (autocert HostPolicy)")
	}
	// Channel down -> 502, not a hang.
	req := httptest.NewRequest("GET", "http://demo.example/", nil)
	req.Host = "demo.example"
	rec := httptest.NewRecorder()
	e.ServeHTTP(rec, req)
	if rec.Code != http.StatusBadGateway {
		t.Fatalf("disconnected tunnel: got %d, want 502", rec.Code)
	}
}

// The reserved hostname is answered by the hub itself, ahead of the route
// table — so a registration attempt reaches the handshake (401 here, no
// credentials) instead of the unknown-host 404.
func TestEdgeInterceptsReservedTunnelHost(t *testing.T) {
	e, err := New(openReg(t), nil)
	if err != nil {
		t.Fatal(err)
	}
	e.EnableTunnels(NewTunnelHub("tunnel.test", map[string]string{"pi-box": "sekrit"}))
	if err := e.Reload(); err != nil {
		t.Fatal(err)
	}
	req := tunnelReq("pi-box", "nope")
	req.Host = "tunnel.test:443" // host:port must still match the reserved name
	rec := httptest.NewRecorder()
	e.ServeHTTP(rec, req)
	if rec.Code != http.StatusUnauthorized {
		t.Fatalf("got %d, want 401 — the reserved host must reach the hub, not the route table", rec.Code)
	}
}

// `carlos route -tunnel` is a narrow UPDATE: it does not clear the route's
// socket/addr. So a route can legitimately carry both, and which one wins is
// a real decision, not a moot one:
//   - hub configured  -> the tunnel wins (the newest, most explicit binding).
//   - no hub on this box -> the old addr keeps serving, rather than the host
//     dropping off the air on an edge that cannot honor the tunnel.
func TestTunnelBindingWinsOverAddrOnlyWhenHubConfigured(t *testing.T) {
	backend, _ := hostEchoBackend(t, "local addr backend")
	reg := tunnelRoute(t, registry.Route{
		Host: "both.example", Kind: "service", Status: "ready",
		Addr: backend.Listener.Addr().String(), Tunnel: "pi-box",
	})
	e, err := New(reg, nil)
	if err != nil {
		t.Fatal(err)
	}
	srv := httptest.NewServer(e)
	defer srv.Close()
	code, body := getHost(t, srv.URL, "both.example")
	if code != http.StatusOK || body != "local addr backend" {
		t.Fatalf("no hub configured: got %d %q, want the addr backend to keep serving", code, body)
	}
	e.EnableTunnels(NewTunnelHub("tunnel.test", map[string]string{"pi-box": "sekrit"}))
	if err := e.Reload(); err != nil {
		t.Fatal(err)
	}
	if code, _ := getHost(t, srv.URL, "both.example"); code != http.StatusBadGateway {
		t.Fatalf("hub configured: got %d, want 502 from the (disconnected) tunnel", code)
	}
}

// The env wiring is the only place a channel name enters the process from
// config, and a name `carlos route -tunnel` would refuse can never match a
// route — so it must stop the boot, not connect and carry nothing.
func TestEnableTunnelsFromEnv(t *testing.T) {
	newEdge := func() *Edge {
		e, err := New(openReg(t), nil)
		if err != nil {
			t.Fatal(err)
		}
		return e
	}
	t.Run("unset is not an error", func(t *testing.T) {
		e := newEdge()
		if err := enableTunnelsFromEnv(e); err != nil {
			t.Fatalf("no CARLOS_TUNNEL_HOST: %v", err)
		}
		if e.tunnels != nil {
			t.Fatal("hub armed with no CARLOS_TUNNEL_HOST")
		}
	})
	// A host with no STATIC clients is valid: fleet channels (SetDynamicAuth,
	// wired by Reload from the registry) can populate the hub with no static
	// env config at all — the hub still has to exist for those to land on.
	// I2 (final customer-fleets review): zero static clients is legitimate
	// (fleet-channels-only), but it's also exactly what a typo'd
	// CARLOS_TUNNEL_CLIENTS var name silently produces — an explicit warning
	// must land in the log so the two are distinguishable there, not just
	// inferable from a client count.
	t.Run("host with no static clients is valid but warns", func(t *testing.T) {
		t.Setenv("CARLOS_TUNNEL_HOST", "tunnel.test")
		t.Setenv("CARLOS_TUNNEL_CLIENTS", "")
		e := newEdge()
		var buf bytes.Buffer
		log.SetOutput(&buf)
		t.Cleanup(func() { log.SetOutput(os.Stderr) })
		if err := enableTunnelsFromEnv(e); err != nil {
			t.Fatalf("CARLOS_TUNNEL_HOST with no static clients: %v", err)
		}
		if e.tunnels == nil {
			t.Fatal("hub not armed with no static clients configured")
		}
		if !strings.Contains(buf.String(), "WARNING: no static tunnel clients configured") {
			t.Fatalf("log = %q, want a WARNING about no static tunnel clients", buf.String())
		}
	})
	t.Run("invalid channel name", func(t *testing.T) {
		t.Setenv("CARLOS_TUNNEL_HOST", "tunnel.test")
		t.Setenv("CARLOS_TUNNEL_CLIENTS", "pi-box=sekrit,Pi_Box=other")
		err := enableTunnelsFromEnv(newEdge())
		if err == nil || !strings.Contains(err.Error(), "Pi_Box") {
			t.Fatalf("got %v, want an error naming the bad entry", err)
		}
	})
	t.Run("armed", func(t *testing.T) {
		t.Setenv("CARLOS_TUNNEL_HOST", "tunnel.test")
		t.Setenv("CARLOS_TUNNEL_CLIENTS", "pi-box=sekrit")
		e := newEdge()
		if err := enableTunnelsFromEnv(e); err != nil {
			t.Fatal(err)
		}
		if e.tunnels == nil || e.tunnels.Host() != "tunnel.test" || !e.Allowed("tunnel.test") {
			t.Fatalf("hub not armed on the configured host")
		}
	})
}

// TestReloadWiresFleetChannelAuthIntoTunnelHub is Task 3's core integration
// point: Edge.Reload reads Registry.FleetChannelAuth (Task 1) and pushes it
// into the hub, with no new polling — the existing 2s Watch->Reload loop is
// the whole convergence path.
func TestReloadWiresFleetChannelAuthIntoTunnelHub(t *testing.T) {
	reg := openReg(t)
	if err := reg.UpsertFleet(registry.Fleet{Name: "acme", Account: "amadan", Bucket: "acme-data"}); err != nil {
		t.Fatal(err)
	}
	if err := reg.AddFleetBox(registry.FleetBox{Fleet: "acme", Label: "pi-1", TokenHash: sha256Hex("tok"), Status: "active"}); err != nil {
		t.Fatal(err)
	}
	e, err := New(reg, nil)
	if err != nil {
		t.Fatal(err)
	}
	e.EnableTunnels(NewTunnelHub("tunnel.test", nil))
	if err := e.Reload(); err != nil {
		t.Fatal(err)
	}
	rec := httptest.NewRecorder()
	e.tunnels.ServeHTTP(rec, tunnelReq("acme/pi-1", "tok"))
	if rec.Code != http.StatusInternalServerError {
		t.Fatalf("fleet channel auth not wired from the registry: got %d, want 500", rec.Code)
	}
}

// TestReloadWithNilTunnelHubIsSafe: most boxes run with no CARLOS_TUNNEL_HOST
// at all, so e.tunnels is nil on every Reload — the fleet-auth wiring must be
// guarded, not assume a hub exists.
func TestReloadWithNilTunnelHubIsSafe(t *testing.T) {
	e, err := New(openReg(t), nil)
	if err != nil {
		t.Fatal(err)
	}
	if err := e.Reload(); err != nil {
		t.Fatalf("Reload with no tunnel hub configured: %v", err)
	}
}

// TestReloadDetachedFleetBoxClosesLiveChannel proves the rotate/detach
// convergence bound end to end through Reload: a box detached in the
// registry has its live conn force-closed on the very next reload, the same
// poll Watch drives every ~2s.
func TestReloadDetachedFleetBoxClosesLiveChannel(t *testing.T) {
	reg := openReg(t)
	if err := reg.UpsertFleet(registry.Fleet{Name: "acme", Account: "amadan", Bucket: "acme-data"}); err != nil {
		t.Fatal(err)
	}
	if err := reg.AddFleetBox(registry.FleetBox{Fleet: "acme", Label: "pi-1", TokenHash: sha256Hex("tok"), Status: "active"}); err != nil {
		t.Fatal(err)
	}
	e, err := New(reg, nil)
	if err != nil {
		t.Fatal(err)
	}
	hub := NewTunnelHub("tunnel.test", nil)
	e.EnableTunnels(hub)
	if err := e.Reload(); err != nil {
		t.Fatal(err)
	}

	// A live channel, as if the box had already dialed in successfully.
	c1, c2 := net.Pipe()
	defer c2.Close()
	hub.mu.Lock()
	hub.conns["acme/pi-1"] = &tunnelConn{raw: c1}
	hub.mu.Unlock()

	if err := reg.SetFleetBoxStatus("acme", "pi-1", "detached"); err != nil {
		t.Fatal(err)
	}
	if err := e.Reload(); err != nil {
		t.Fatal(err)
	}

	hub.mu.Lock()
	_, stillThere := hub.conns["acme/pi-1"]
	hub.mu.Unlock()
	if stillThere {
		t.Fatal("Reload did not close the detached fleet box's live channel")
	}
}

// TestRotateVsDetachAsymmetry pins the deliberate difference between the two
// registry-driven revocation paths, through the real Reload wiring:
//
//   - Rotate (SetFleetBoxToken, same box still active): a NEW dial with the
//     OLD token is refused immediately, but an ALREADY-LIVE channel is left
//     alone — closing it would take the box's connection down for the gap
//     between the registry write and the box itself learning its new token.
//   - Detach (SetFleetBoxStatus "detached"): the hard revocation — an
//     ALREADY-LIVE channel is force-closed on the very next Reload.
func TestRotateVsDetachAsymmetry(t *testing.T) {
	reg := openReg(t)
	if err := reg.UpsertFleet(registry.Fleet{Name: "acme", Account: "amadan", Bucket: "acme-data"}); err != nil {
		t.Fatal(err)
	}
	oldHash := sha256Hex("old-tok")
	if err := reg.AddFleetBox(registry.FleetBox{Fleet: "acme", Label: "pi-1", TokenHash: oldHash, Status: "active"}); err != nil {
		t.Fatal(err)
	}
	e, err := New(reg, nil)
	if err != nil {
		t.Fatal(err)
	}
	hub := NewTunnelHub("tunnel.test", nil)
	e.EnableTunnels(hub)
	if err := e.Reload(); err != nil {
		t.Fatal(err)
	}

	// A live channel, as if pi-1 had already dialed in on the old token.
	c1, c2 := net.Pipe()
	defer c2.Close()
	hub.mu.Lock()
	hub.conns["acme/pi-1"] = &tunnelConn{raw: c1}
	hub.mu.Unlock()

	// --- Rotate ---
	newHash := sha256Hex("new-tok")
	if err := reg.SetFleetBoxToken("acme", "pi-1", newHash); err != nil {
		t.Fatal(err)
	}
	if err := e.Reload(); err != nil {
		t.Fatal(err)
	}

	// (a) A NEW dial with the OLD token is refused now.
	rec := httptest.NewRecorder()
	hub.ServeHTTP(rec, tunnelReq("acme/pi-1", "old-tok"))
	if rec.Code != http.StatusUnauthorized {
		t.Fatalf("rotate: new dial with old token: got %d, want 401", rec.Code)
	}
	// A NEW dial with the NEW token is accepted.
	rec2 := httptest.NewRecorder()
	hub.ServeHTTP(rec2, tunnelReq("acme/pi-1", "new-tok"))
	if rec2.Code != http.StatusInternalServerError {
		t.Fatalf("rotate: new dial with new token: got %d, want 500 (past auth)", rec2.Code)
	}
	// (b) The EXISTING live channel from before the rotation is untouched —
	// that's the designed asymmetry, not a bug.
	hub.mu.Lock()
	c, stillLive := hub.conns["acme/pi-1"]
	hub.mu.Unlock()
	if !stillLive || c.raw != c1 {
		t.Fatal("rotate: the pre-existing live channel was closed — rotation must not evict an established session")
	}

	// --- Detach ---
	if err := reg.SetFleetBoxStatus("acme", "pi-1", "detached"); err != nil {
		t.Fatal(err)
	}
	if err := e.Reload(); err != nil {
		t.Fatal(err)
	}
	hub.mu.Lock()
	_, stillThere := hub.conns["acme/pi-1"]
	hub.mu.Unlock()
	if stillThere {
		t.Fatal("detach: the live channel from before detach was not closed — detach must be a hard revocation")
	}
}

// A tunnel-served host is never activator-managed: the process lives on the
// far side of the channel, so a wake here would start a second, local copy.
// The retire pass must also drop it, killing the child a repointed route left
// behind.
func TestTunnelRouteIsNeverActivatorManaged(t *testing.T) {
	reg := tunnelRoute(t, registry.Route{
		Host: "moved.example", Kind: "instance", Status: "ready",
		Tunnel: "pi-box", Hibernate: true,
	})
	act := &fakeActivator{}
	e, err := New(reg, act)
	if err != nil {
		t.Fatal(err)
	}
	e.EnableTunnels(NewTunnelHub("tunnel.test", map[string]string{"pi-box": "sekrit"}))
	if err := e.Reload(); err != nil {
		t.Fatal(err)
	}
	if last := act.retired[len(act.retired)-1]; last["moved.example"] {
		t.Fatalf("tunnel-served host kept in the activator's managed set: %v", last)
	}
	req := httptest.NewRequest("GET", "http://moved.example/", nil)
	req.Host = "moved.example"
	e.ServeHTTP(httptest.NewRecorder(), req)
	if act.served != 0 {
		t.Fatalf("activator woke a local process for a tunnel-served host (%d call(s))", act.served)
	}
}

// TestPingCadence pins the cadence SELECTION rather than wall-clock ping
// timing: a fleet (dynamic) channel's reap bound is the customer-visible
// failover window, so it pings tighter, while the static platform channels
// keep the wider cadence they have always had. Asserting the selection is
// what lets this be a millisecond test instead of a 25-second one.
func TestPingCadence(t *testing.T) {
	if e, to := pingCadence(false); e != tunnelPingEvery || to != tunnelPingTimeout {
		t.Fatalf("static cadence changed: got %s/%s, want %s/%s", e, to, tunnelPingEvery, tunnelPingTimeout)
	}
	// The static numbers themselves, spelled out: a future edit that widened
	// or narrowed them would otherwise pass the comparison above unnoticed.
	if tunnelPingEvery != 15*time.Second || tunnelPingTimeout != 10*time.Second {
		t.Fatalf("static cadence constants moved: %s/%s, want 15s/10s", tunnelPingEvery, tunnelPingTimeout)
	}
	if e, to := pingCadence(true); e != fleetPingEvery || to != fleetPingTimeout {
		t.Fatalf("fleet cadence wrong: got %s/%s, want %s/%s", e, to, fleetPingEvery, fleetPingTimeout)
	}
	if fleetPingEvery != 5*time.Second || fleetPingTimeout != 5*time.Second {
		t.Fatalf("fleet cadence constants moved: %s/%s, want 5s/5s", fleetPingEvery, fleetPingTimeout)
	}
}

// TestDynamicChannelMarkedDynamic is the other half of the cadence: knowing
// WHICH cadence to use means the conn has to remember which credential source
// admitted it, and only a real handshake (httptest.NewRecorder cannot hijack)
// ever reaches the point where a conn is stored. Both kinds register against
// ONE hub, so this also re-proves the two credential sources coexist.
func TestDynamicChannelMarkedDynamic(t *testing.T) {
	hub := NewTunnelHub("unused.test", map[string]string{"hq": "sekrit"})
	hub.SetDynamicAuth(map[string]string{"pi/box-a": sha256Hex("tok")})
	// The hub answers registration directly here: no route, no edge, no
	// reserved-hostname routing — this test is about what ServeHTTP stores.
	srv := httptest.NewServer(hub)
	defer srv.Close()

	ok := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {})
	stopDyn := startFakeRemoteHost(t, srv.URL, "pi/box-a", "tok", ok)
	defer stopDyn()
	stopStatic := startFakeRemoteHost(t, srv.URL, "hq", "sekrit", ok)
	defer stopStatic()
	waitForTunnelState(t, hub, "pi/box-a", "connected", e2eReconnectBound)
	waitForTunnelState(t, hub, "hq", "connected", e2eReconnectBound)

	if !channelIsDynamic(t, hub, "pi/box-a") {
		t.Fatal("a channel admitted by the dynamic (fleet) credential source was not marked dynamic — it would ping at the static cadence and its fleet's failover window would be ~25s")
	}
	if channelIsDynamic(t, hub, "hq") {
		t.Fatal("a static env channel was marked dynamic — platform channels must keep the wider cadence")
	}
}

func channelIsDynamic(t *testing.T, hub *TunnelHub, name string) bool {
	t.Helper()
	hub.mu.Lock()
	defer hub.mu.Unlock()
	c := hub.conns[name]
	if c == nil {
		t.Fatalf("channel %q is not registered", name)
	}
	return c.dynamic
}