//go:build linux && rootrunner

package host

import (
	"context"
	"encoding/json"
	"errors"
	"os"
	"os/exec"
	"path/filepath"
	"testing"

	"github.com/carlosframework/platform/internal/release"
	"github.com/carlosframework/platform/internal/rootparticipation"
	"github.com/carlosframework/platform/internal/rootstate"
)

func TestPlan14LaunchVerifierRootRunner(t *testing.T) {
	dir := os.Getenv("PLAN14_E43_VERIFIER_CHILD")
	if dir == "" {
		dir = generationRootRunnerDir(t)
		binary, err := filepath.Abs(os.Args[0])
		if err != nil {
			t.Fatal(err)
		}
		cmd := exec.CommandContext(t.Context(), "unshare", "--mount", "--pid", "--fork", "--mount-proc", binary, "-test.run=^TestPlan14LaunchVerifierRootRunner$", "-test.v", "-test.timeout=2m")
		cmd.Dir = dir
		cmd.Env = append(os.Environ(), "PLAN14_E43_VERIFIER_CHILD="+dir)
		if out, err := cmd.CombinedOutput(); err != nil {
			t.Fatalf("root verifier: %v\n%s", err, out)
		}
		return
	}
	t.Setenv("CARLOS_OPT_DIR", dir)
	if err := os.MkdirAll(filepath.Join(dir, "versions"), 0755); err != nil {
		t.Fatal(err)
	}
	state, err := rootstate.Open(filepath.Join(dir, "participation"), true, false)
	if err != nil {
		t.Fatal(err)
	}
	defer state.Close()
	generations, err := rootstate.Open(filepath.Join(dir, "generations"), true, false)
	if err != nil {
		t.Fatal(err)
	}
	generations.Close()
	x := &release.ReleaseExclusion{Open: func() (rootstate.Store, error) { return rootstate.Open(filepath.Join(dir, "release"), true, false) }}
	l := rootparticipation.Ledger{State: state, ExcludeLaunches: x.With}
	c := rootparticipation.Census{Schema: 1, Box: "box", Enrollment: "en", Migration: 1, Revision: 1, LaunchRevision: 1, Complete: true}
	write := func() {
		raw, _ := json.Marshal(c)
		if err := state.Write("census.json", raw); err != nil {
			t.Fatal(err)
		}
	}
	write()
	v := rootLaunchVerifier{exclude: x, open: func() (rootstate.Store, error) {
		return rootstate.Open(filepath.Join(dir, "generations"), false, false)
	}, reconcile: generationReconciler{
		read: func(context.Context) (generationInventory, error) {
			c, err := l.RecoveryCensus()
			return generationInventory{Census: c}, err
		}, kernel: productionGenerationKernelCensus,
	}}
	l.VerifyLaunches = v.verify
	if err := rootparticipation.RegisterLaunchVerifier(v.verify, x.With); err != nil {
		t.Fatal(err)
	}
	if err := rootparticipation.RegisterLaunchVerifier(v.verify, x.With); !errors.Is(err, rootparticipation.ErrUnavailable) {
		t.Fatal("registered twice", err)
	}
	if err := l.Idle(t.Context()); !errors.Is(err, rootparticipation.ErrUnavailable) {
		t.Fatal("missing token", err)
	}
	if err := l.ActivationReady(t.Context()); !errors.Is(err, rootparticipation.ErrUnavailable) {
		t.Fatal("activation accepted missing token", err)
	}
	for _, name := range []string{"idle", "begin", "end", "recover", "activation"} {
		t.Run(name, func(t *testing.T) {
			if name == "recover" {
				c.Pending = "acquisition"
				write()
			}
			if err := x.With(t.Context(), func(ctx context.Context) error {
				switch name {
				case "idle":
					return l.Idle(ctx)
				case "begin":
					return l.BeginUpdate(ctx, "update")
				case "end":
					return l.EndUpdateWith(ctx, "update", nil)
				case "recover":
					return l.RecoverAcquisition(ctx)
				default:
					return l.ActivationReady(ctx)
				}
			}); err != nil {
				t.Fatal(err)
			}
		})
	}
	path := filepath.Join(dir, "versions", "unreserved")
	if err := os.WriteFile(path, []byte("unreserved staged object"), 0644); err != nil {
		t.Fatal(err)
	}
	file, err := os.Open(path)
	if err != nil {
		t.Fatal(err)
	}
	if err := x.With(t.Context(), l.Idle); err == nil {
		file.Close()
		t.Fatal("kernel reference escaped verifier")
	}
	file.Close()
	if err := x.With(t.Context(), l.Idle); err != nil {
		t.Fatal("released reference refused", err)
	}
}