package host

import (
	"bytes"
	"encoding/base64"
	"os"
	"testing"

	"github.com/carlosframework/platform/internal/registry"
	"github.com/carlosframework/platform/internal/release"
	"github.com/carlosframework/platform/internal/rollout"
)

// Final review round 1, finding 2 (Astra): a real claims move launch (a
// moves probe or a landing) runs on a row the move holds ("landing",
// "restoring", movesprobeowners heldRoute), and Managed reads every held
// status as not managed. The declined box's restriction must not depend on
// that passing status: a held row the book restricts is refused at the
// claims move launch exactly as its ready row is, for a hold-down and for a
// hold-ran marker. Move authorization is the moves package's own check, and
// stays separate.
func TestDeclinedBoxGatesAClaimsMoveLaunchOfAHeldRow(t *testing.T) {
	for _, status := range []string{"landing", "restoring"} {
		for _, kind := range []string{"hold-down", "marker"} {
			t.Run(status+", "+kind, func(t *testing.T) {
				f := newAdminTokenFixture(t, "box-1")
				if err := os.WriteFile(f.envPath(), []byte("CARLOS_ADMIN_TOKEN=tok-0123456789abcdef0123456789abcdef\n"), 0o600); err != nil {
					t.Fatal(err)
				}
				t.Setenv("CARLOS_SECRETS_KEY", base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{7}, 32)))
				rt := f.rt
				rt.Kind, rt.Status, rt.HoldOp, rt.Channel, rt.Account, rt.App, rt.Hibernate, rt.Version = "instance", status, "op-1", "edge", "bab", "jam", true, "v1"
				acct := release.RouteAccount(rt)
				svc, reg, dd := rolloutFixture(t, false)
				var want string
				switch kind {
				case "hold-down":
					// v1 failed in hold mode on this instance: it stays down.
					rt.GoodVersion, rt.GoodDigest = "v0", "sha256:v0"
					writeFailureBook(t, dd, []rollout.FailureRecord{{Account: acct, App: "jam", Build: "v1", Host: rt.Host, Mode: "hold", HeldDown: []string{rt.Host}}}, nil)
					want = rollout.HeldDownRefusal("v1")
				case "marker":
					// A hold build v2 ran here: the good build v1, which the
					// launch would exec, is barred until a signed rollback.
					rt.GoodVersion, rt.GoodDigest = "v1", "sha256:v1"
					b, err := rollout.OpenFailureBook(dd)
					if err != nil {
						t.Fatal(err)
					}
					if err := b.MarkHoldRan(rt.Host, rollout.HoldRan{Account: acct, App: "jam", Build: "v2"}); err != nil {
						t.Fatal(err)
					}
					want = rollout.HeldDownRefusal("v2")
				}
				declineWithBook(t, svc, reg, dd)
				if _, _, err := claimMoveLaunchSource(f.backend)(t.Context(), rt); err == nil || err.Error() != want {
					t.Fatalf("move launch of a %s row = %v, want %q", status, err, want)
				}
			})
		}
	}
}

// Finding 2's second half (Task 10's deferred minor): a signed retry that
// arrives while the instance's row is held by a move ("moving") is applied,
// not consumed and dropped: the restart leg reads each request once.
func TestADeclinedBoxAppliesARetryWhileTheRowIsMoving(t *testing.T) {
	t.Setenv("CARLOS_OPT_DIR", t.TempDir())
	svc, reg, dd := rolloutFixture(t, false)
	const host = "h.example.com"
	rt := heldRouteIn(t, reg, host, "v2", "v1")
	acct := release.RouteAccount(rt)
	writeFailureBook(t, dd, []rollout.FailureRecord{{
		Account: acct, App: "blog", Build: "v2", Host: "sib.example.com", Mode: "hold", Reason: "health", HeldDown: []string{host},
	}}, nil)
	declineWithBook(t, svc, reg, dd)
	hr, ok := declinedHostReport(t, host)
	if !ok || hr.HeldBy != "v2" {
		t.Fatalf("published %+v (%v), want v2 holding %s", hr, ok, host)
	}
	if err := reg.SetHold(host, "moving", "op-1"); err != nil {
		t.Fatal(err)
	}
	moving, err := reg.Get(host)
	if err != nil || moving == nil || !registry.IsHold(moving.Status) {
		t.Fatalf("row %+v (%v): want it held by the move", moving, err)
	}
	if !heldHolds().retryHost(host, "v2", hr.HeldBook, hr.HeldEpoch) {
		t.Fatal("a grant that arrived while the row was moving cleared nothing")
	}
	if heldHolds().book.HeldDown(acct, "blog", "v2", host) {
		t.Fatal("the hold-down survived the grant")
	}
}