//go:build linux

package host

import (
	"bytes"
	"context"
	"encoding/json"
	"github.com/carlosframework/platform/internal/instancectl"
	"net/http"
	"net/http/httptest"
	"os"
	"path/filepath"
	"testing"

	"github.com/carlosframework/platform/internal/cgroup"
	"github.com/carlosframework/platform/internal/hostbox"
	"github.com/carlosframework/platform/internal/hostguard"
)

func TestPlan11Rev4JournalRefusesForeignContainment(t *testing.T) {
	oldRoot, oldInspect := claimContainmentAgentRoot, claimContainmentInspect
	t.Cleanup(func() { claimContainmentAgentRoot, claimContainmentInspect = oldRoot, oldInspect })
	claimContainmentAgentRoot = func(context.Context) (string, error) { return "/sys/fs/cgroup/system.slice/carlos-edge.service", nil }
	claimContainmentInspect = func(p string) (hostbox.LaunchGroup, error) {
		return hostbox.LaunchGroup{RelativePath: p, Device: 1, Inode: 2}, nil
	}

	for _, op := range []string{"create", "prelaunch", "reserve"} {
		for _, path := range []string{"system.slice/ssh.service", "system.slice/carlos-edge.service/carlos-exec@other.example", "derived"} {

			t.Run(op+"/"+path, func(t *testing.T) {
				f := newRecoveryFixture(t)
				f.recordPrelaunch = false
				c := f.controller("boot-1", "controller-1", 4101, "start-1")
				admitted := c.admit(t, f)
				target := recoveryTuple(admitted, c.local)
				target.Op = admitted.Claim.Op.ID
				positive := path == "derived" && op != "reserve"
				if path == "derived" {
					path = filepath.Join("system.slice/carlos-edge.service", cgroup.ExecName(claimContainmentName(target)))
				}
				service, err := hostbox.NewJournalService(f.journal)
				if err != nil {
					t.Fatal(err)
				}
				root := ClaimRootHTTP{Journals: service}
				root.Reconcile.Box, root.Reconcile.Enrollment = target.Box, target.Enrollment
				root.Stop.Coordinator.Evidence = f.claims
				client, _ := hostbox.RemoteJournals(func(ctx context.Context, q hostbox.JournalRequest) (hostbox.JournalResponse, error) {
					raw, _ := json.Marshal(q)
					w := httptest.NewRecorder()
					root.serveJournal(w, httptest.NewRequest(http.MethodPost, "/claim/journal", bytes.NewReader(raw)), f.peer)
					if w.Code != http.StatusOK {
						return hostbox.JournalResponse{V: 1, ID: q.ID, Error: "refused"}, nil
					}
					var out hostbox.JournalResponse
					err := json.Unmarshal(w.Body.Bytes(), &out)
					return out, err
				})
				in := hostbox.LaunchInventory{Target: target, ControllerPID: f.peer.PID, ProcessStart: f.peer.ProcessStart, NoState: true, Groups: []hostbox.LaunchGroup{{RelativePath: path, Device: 1, Inode: 2}}}
				switch op {
				case "create":
					err = client.Create(t.Context(), in)
				case "prelaunch":
					err = client.Prelaunch(t.Context(), in)
				case "reserve":
					if err = f.journal.Prelaunch(t.Context(), in); err != nil {
						t.Fatal(err)
					}
					err = client.Reserve(t.Context(), hostbox.LaunchReservation{ID: "x", Role: "main", InvocationID: "x", Inputs: "inputs", Target: target, Group: hostbox.LaunchGroup{RelativePath: path + "/role-x", Device: 1, Inode: 3, InvocationID: "x"}, Executable: hostbox.LaunchFile{Device: 1, Inode: 4}})
				}
				if positive {
					if err != nil {
						t.Fatalf("valid root intake refused: %v", err)
					}
					return
				}
				if err == nil {
					t.Fatal("root accepted unrelated containment or parentless reservation")
				}
			})
		}
	}
}

func TestPlan11Rev4RecoveryRefusesForgedPersistedGroups(t *testing.T) {
	for _, settled := range []bool{false, true} {
		t.Run(map[bool]string{false: "pending", true: "settled"}[settled], func(t *testing.T) {
			root, proc := t.TempDir(), t.TempDir()
			if err := os.MkdirAll(filepath.Join(proc, "sys/kernel/random"), 0700); err != nil {
				t.Fatal(err)
			}
			if err := os.WriteFile(filepath.Join(proc, "sys/kernel/random/boot_id"), []byte("new-boot"), 0600); err != nil {
				t.Fatal(err)
			}
			target := hostguard.FenceTarget{Host: "shop.example", Incarnation: "inc", Stamp: 1, Session: 1, Box: "box", Enrollment: "enroll", BootID: "old-boot", ControllerID: "controller", FenceID: "fence"}
			j := &rebootJournalFixture{j: hostbox.StopKernelJournal{V: 1, Target: target, ControllerPID: 42, ProcessStart: "42", Settled: settled, Cgroups: []hostbox.StopCgroupIdentity{{RelativePath: "system.slice/ssh.service", Device: 1, Inode: 2}}}}
			k := LinuxStopKernel{AgentCgroup: func(context.Context) (string, error) { return "/sys/fs/cgroup/system.slice/carlos-edge.service", nil }, Journal: j, CgroupRoot: root, ProcRoot: proc, ManagedRoots: map[string]string{"data": t.TempDir()}}
			_, _, err := k.recoverAfterReboot(t.Context(), target, StopInventory{Complete: true}, j.j, "new-boot", j)
			if err == nil {
				t.Fatal("recovery accepted unrelated persisted containment")
			}
		})
	}
}

func TestPlan11Rev4ContainmentCapturesOnlyDerivedParent(t *testing.T) {
	target := hostguard.FenceTarget{Host: "shop.example", Incarnation: "inc", Stamp: 1, Session: 1, Box: "box", Enrollment: "enroll", BootID: "boot", ControllerID: "controller"}
	parentPath, err := claimContainmentParent("/sys/fs/cgroup/system.slice/carlos-edge.service", target)
	if err != nil {
		t.Fatal(err)
	}
	parent := hostbox.LaunchGroup{RelativePath: parentPath, Device: 1, Inode: 2}
	child := hostbox.LaunchGroup{RelativePath: parentPath + "/role-one", Device: 1, Inode: 3, InvocationID: "one"}
	oldRoot, oldInspect := claimContainmentAgentRoot, claimContainmentInspect
	t.Cleanup(func() { claimContainmentAgentRoot, claimContainmentInspect = oldRoot, oldInspect })
	claimContainmentAgentRoot = func(context.Context) (string, error) { return "/sys/fs/cgroup/system.slice/carlos-edge.service", nil }
	claimContainmentInspect = func(p string) (hostbox.LaunchGroup, error) {
		if p == parent.RelativePath {
			return parent, nil
		}
		if p == child.RelativePath {
			g := child
			g.InvocationID = ""
			return g, nil
		}
		t.Fatalf("root tried to capture foreign containment: %s", p)
		return hostbox.LaunchGroup{}, nil
	}
	j, err := hostbox.OpenLaunchJournal(filepath.Join(t.TempDir(), "launch.db"))
	if err != nil {
		t.Fatal(err)
	}
	defer j.Close()
	in := hostbox.LaunchInventory{Target: target, ControllerPID: 42, ProcessStart: "42", NoState: true, Groups: []hostbox.LaunchGroup{parent}}
	for _, op := range []string{"create", "prelaunch"} {
		if err := validateClaimJournalContainment(t.Context(), hostbox.JournalRequest{Op: op, Launch: in}, j); err != nil {
			t.Fatal(err)
		}
		for _, foreign := range []string{"system.slice/ssh.service", "system.slice/carlos-edge.service/carlos-exec@other.example"} {
			forged := in
			forged.Groups = []hostbox.LaunchGroup{{RelativePath: foreign, Device: 1, Inode: 2}}
			if err := validateClaimJournalContainment(t.Context(), hostbox.JournalRequest{Op: op, Launch: forged}, j); err == nil {
				t.Fatal("foreign containment accepted with a valid capture provider")
			}
		}
		forged := in
		forged.Groups = append([]hostbox.LaunchGroup{}, in.Groups...)
		forged.Groups[0].Inode++
		if err := validateClaimJournalContainment(t.Context(), hostbox.JournalRequest{Op: op, Launch: forged}, j); err == nil {
			t.Fatal("forged kernel identity accepted")
		}
	}
	if err := j.Prelaunch(t.Context(), in); err != nil {
		t.Fatal(err)
	}
	r := hostbox.LaunchReservation{ID: "one", Role: "main", InvocationID: "one", Inputs: "inputs", Target: target, Parent: parent, Group: child, Executable: hostbox.LaunchFile{Device: 1, Inode: 4}}
	intended := r
	intended.Group.Device = 0
	intended.Group.Inode = 0
	if err := validateClaimJournalContainment(t.Context(), hostbox.JournalRequest{Op: "intend", Reservation: intended}, j); err != nil {
		t.Fatal(err)
	}
	if err := j.IntendRole(t.Context(), intended); err != nil {
		t.Fatal(err)
	}
	if err := validateClaimJournalContainment(t.Context(), hostbox.JournalRequest{Op: "reserve", Reservation: r}, j); err != nil {
		t.Fatal(err)
	}
	parentless := r
	parentless.Parent = hostbox.LaunchGroup{}
	if err := validateClaimJournalContainment(t.Context(), hostbox.JournalRequest{Op: "reserve", Reservation: parentless}, j); err == nil {
		t.Fatal("parentless reservation accepted")
	}
	if err := j.Reserve(t.Context(), r); err != nil {
		t.Fatal(err)
	}
	in, err = j.Read(t.Context(), target)
	if err != nil {
		t.Fatal(err)
	}
	in.Reservations = append(in.Reservations, hostbox.LaunchReservation{Target: target, State: hostbox.UnitIntended, Group: hostbox.LaunchGroup{RelativePath: instancectl.ClaimUnitControlGroup(target.Host)}})
	if err := validateClaimContainment(in, parentPath); err != nil {
		t.Fatal("root's exact isolated unit rejected", err)
	}
}

type containmentCountingUnits struct {
	*launchUnits
	calls int
}

func (u *containmentCountingUnits) Gone(ctx context.Context, host, inv string) error {
	u.calls++
	return u.launchUnits.Gone(ctx, host, inv)
}

func TestPlan11Rev4RecoveryValidatesWholeInventoryBeforeEffects(t *testing.T) {
	for _, kind := range []string{"unrelated-parent", "foreign-unit", "settled-foreign-unit", "parentless-role"} {
		t.Run(kind, func(t *testing.T) {
			f := newLaunchFixture(t, servingOp())
			in, err := f.journal.Read(t.Context(), f.target)
			if err != nil {
				t.Fatal(err)
			}
			if kind == "unrelated-parent" {
				in.Groups[0].RelativePath = "system.slice/ssh.service"
			}
			j, err := hostbox.OpenLaunchJournal(filepath.Join(t.TempDir(), "forged.db"))
			if err != nil {
				t.Fatal(err)
			}
			defer j.Close()
			if err = j.Create(t.Context(), in); err != nil {
				t.Fatal(err)
			}
			r := *f.req.Reservation
			if kind == "foreign-unit" || kind == "settled-foreign-unit" {
				r.Group.RelativePath = instancectl.ClaimUnitControlGroup("other.example")
			}
			if err = j.IntendUnit(t.Context(), r); err != nil {
				t.Fatal(err)
			}
			if kind == "settled-foreign-unit" {
				if err = j.SettleUnit(t.Context(), f.target, r.ID); err != nil {
					t.Fatal(err)
				}
			}
			if kind == "parentless-role" {
				role := hostbox.LaunchReservation{ID: "role", Role: "writer", InvocationID: "role", Inputs: "inputs", Target: f.target, Group: hostbox.LaunchGroup{RelativePath: in.Groups[0].RelativePath + "/role-x", Device: 1, Inode: 7, InvocationID: "role"}, Executable: hostbox.LaunchFile{Device: 1, Inode: 8}}
				if err = j.Reserve(t.Context(), role); err != nil {
					t.Fatal(err)
				}
			}
			units := &containmentCountingUnits{launchUnits: f.units}
			innerCalls := 0
			k := claimUnitStopKernel{Journal: j, Units: units, Inner: recoveryKernelFunc(func(context.Context, hostguard.FenceTarget, StopInventory) (StopKernelEvidence, DrainAcknowledgement, error) {
				innerCalls++
				return StopKernelEvidence{}, DrainAcknowledgement{}, nil
			})}
			if _, _, err = k.RecoverStopped(t.Context(), f.target, StopInventory{}); err == nil {
				t.Fatal("forged persisted inventory accepted")
			}
			if units.calls != 0 || innerCalls != 0 {
				t.Fatalf("privileged recovery reached before validation: Gone=%d inner=%d", units.calls, innerCalls)
			}
		})
	}
}

func TestPlan11Rev4LaunchAndStopRefuseForgedContainmentBeforeEffects(t *testing.T) {
	for _, op := range []string{hostbox.RoleLaunchStart, hostbox.RoleLaunchStop} {
		t.Run(op, func(t *testing.T) {
			f := newLaunchFixture(t, servingOp())
			in, err := f.journal.Read(t.Context(), f.target)
			if err != nil {
				t.Fatal(err)
			}
			in.Groups[0].RelativePath = "system.slice/ssh.service"
			j, err := hostbox.OpenLaunchJournal(filepath.Join(t.TempDir(), "forged.db"))
			if err != nil {
				t.Fatal(err)
			}
			defer j.Close()
			if err = j.Create(t.Context(), in); err != nil {
				t.Fatal(err)
			}
			f.root.Journal = j
			units := &containmentCountingUnits{launchUnits: f.units}
			// The reserved-launch extension is supplied by the original fixture.
			f.root.Units = units
			q := f.req
			if op == hostbox.RoleLaunchStop {
				q = hostbox.RoleLaunchRequest{V: hostbox.RoleLaunchV, Op: op, Reservation: f.req.Reservation}
			}
			if _, err = f.root.Serve(t.Context(), f.peer, q); err == nil {
				t.Fatal("forged launch inventory accepted")
			}
			starts, stops := f.units.counts()
			if starts != 0 || stops != 0 || units.calls != 0 {
				t.Fatalf("privileged actions before validation: starts=%d stops=%d gone=%d", starts, stops, units.calls)
			}
		})
	}
}

func TestPlan11Rev4StopCannotTombstoneForeignUnit(t *testing.T) {
	f := newLaunchFixture(t, servingOp())
	units := &containmentCountingUnits{launchUnits: f.units}
	f.root.Units = units
	r := *f.req.Reservation
	r.ID = "foreign-stop"
	r.Group.RelativePath = instancectl.ClaimUnitControlGroup("other.example")
	if _, err := f.root.Serve(t.Context(), f.peer, hostbox.RoleLaunchRequest{V: hostbox.RoleLaunchV, Op: hostbox.RoleLaunchStop, Reservation: &r}); err == nil {
		t.Fatal("foreign stop request accepted")
	}
	in, err := f.journal.Read(t.Context(), f.target)
	if err != nil {
		t.Fatal(err)
	}
	starts, stops := f.units.counts()
	if len(in.Reservations) != 0 || starts != 0 || stops != 0 || units.calls != 0 {
		t.Fatalf("foreign stop changed state: reservations=%d starts=%d stops=%d gone=%d", len(in.Reservations), starts, stops, units.calls)
	}
}