package host

import (
	"context"
	"errors"
	"os"
	"path/filepath"
	"strings"
	"testing"

	"github.com/carlosframework/platform/internal/activator"
	"github.com/carlosframework/platform/internal/provision"
	"github.com/carlosframework/platform/internal/registry"
)

func TestClaimFirstWakeCreatesAuthorizedInstanceDirectory(t *testing.T) {
	b := &activator.ExecBackend{DataDir: t.TempDir()}
	host := "first-claim.example"
	rt := registry.Route{Host: host, DBPath: provision.NestedDBPath(b.DataDir, host), Socket: provision.NestedSocket(host)}
	parent := filepath.Join(b.DataDir, "instances")
	if err := os.Mkdir(parent, 0700); err != nil {
		t.Fatal(err)
	}
	denied := errors.New("not authorized")
	if err := ensureClaimLaunchToken(t.Context(), b, rt, func(context.Context, func() error) error { return denied }); !errors.Is(err, denied) {
		t.Fatal("denial", err)
	}
	dir := provision.InstanceDir(b.DataDir, host)
	if _, err := os.Lstat(dir); !errors.Is(err, os.ErrNotExist) {
		t.Fatal("denial created directory", err)
	}
	authorize := func(_ context.Context, write func() error) error { return write() }
	if err := ensureClaimLaunchToken(t.Context(), b, rt, authorize); err != nil {
		t.Fatal("first claimed wake", err)
	}
	raw, err := os.ReadFile(filepath.Join(dir, host+".env"))
	if err != nil {
		t.Fatal(err)
	}
	if !strings.Contains(string(raw), "CARLOS_ADMIN_TOKEN=") || !strings.Contains(string(raw), "CARLOS_INSTANCE_KEY=") {
		t.Fatal("missing initialized launch credentials")
	}
	if err := os.RemoveAll(dir); err != nil {
		t.Fatal(err)
	}
	victim := t.TempDir()
	if err := os.Symlink(victim, dir); err != nil {
		t.Fatal(err)
	}
	if err := ensureClaimLaunchToken(t.Context(), b, rt, authorize); err == nil {
		t.Fatal("symlinked instance accepted")
	}
	entries, err := os.ReadDir(victim)
	if err != nil || len(entries) != 0 {
		t.Fatal("symlink target changed", entries, err)
	}
}