package host

import (
	"context"
	"crypto/sha256"
	"encoding/hex"
	"fmt"
	"os"
	"path/filepath"
	"testing"
	"time"

	"github.com/carlosframework/platform/internal/registry"
	"github.com/carlosframework/platform/internal/release"
)

func mintAskerFixture(t *testing.T, activeFor time.Duration) (*mintAsker, *int, *time.Time, release.Store, string) {
	t.Helper()
	opt, etc := t.TempDir(), t.TempDir()
	liveTo(t, opt, observedHost, "v1")
	reg := restartTestRegistry(t)
	if err := reg.Upsert(registry.Route{Host: observedHost, Kind: "instance", App: "console",
		Channel: "canary/console", Unit: "console.service", Status: "ready"}); err != nil {
		t.Fatal(err)
	}
	policy := filepath.Join(etc, "proof-policy.json")
	if err := os.WriteFile(policy, []byte(provePolicy("/etc/carlos/proving.key")), 0o644); err != nil {
		t.Fatal(err)
	}
	t0 := time.Date(2026, 10, 6, 10, 0, 0, 0, time.UTC)
	clock := t0
	asked := 0
	store := release.NewDirStore(t.TempDir())
	a := &mintAsker{reg: reg, store: store, optDir: opt, policyPath: policy,
		sys: &fakeUnits{shows: []unitProps{{ActiveState: "active", InvocationID: "i1", MainPID: 7,
			ActiveEnterTimestamp: t0.Add(-activeFor)}}},
		request: func(string, string, error) { asked++ },
		now:     func() time.Time { return clock }}
	sha, err := release.FileSHA256(filepath.Join(opt, "versions", "v1", "console"))
	if err != nil {
		t.Fatal(err)
	}
	return a, &asked, &clock, store, sha
}

// Review focus 5: the relay can drop a request and a mint write can fail, so
// the agent asks every 2 minutes until it sees the proof, then stops.
func TestMintAskerReasksUntilTheProofAppears(t *testing.T) {
	t.Parallel()
	a, asked, clock, store, sha := mintAskerFixture(t, 20*time.Minute)
	ctx := context.Background()
	t0 := *clock
	at := func(d time.Duration) { *clock = t0.Add(d); a.tick(ctx) }
	at(0)
	if *asked != 1 {
		t.Fatalf("asked %d times at first sight, want 1", *asked)
	}
	at(time.Minute)
	if *asked != 1 {
		t.Fatalf("asked %d times inside 2 minutes, want 1", *asked)
	}
	at(2 * time.Minute)
	if *asked != 2 {
		t.Fatalf("asked %d times after 2 minutes, want 2", *asked)
	}
	seed, _, err := release.GenerateKey()
	if err != nil {
		t.Fatal(err)
	}
	key, err := release.ParseSigningKey(seed, "test")
	if err != nil {
		t.Fatal(err)
	}
	p, err := release.SignProof(key, release.Proof{App: "console", Platform: release.AdoptPlatform(), SHA256: sha,
		Version: "v1", Prover: "dev", ActiveSince: t0.Add(-20 * time.Minute), ProvenAt: t0})
	if err != nil {
		t.Fatal(err)
	}
	if err := release.PutProof(ctx, store, "bab", p); err != nil {
		t.Fatal(err)
	}
	at(4 * time.Minute)
	at(6 * time.Minute)
	if *asked != 2 {
		t.Fatalf("asked %d times after the proof appeared, want 2", *asked)
	}
	pend, err := release.GetProofPending(ctx, store, "bab", "console", sha, "dev")
	if err != nil || !pend.LiveSince.Equal(t0.Add(-20*time.Minute)) {
		t.Fatalf("pending = %+v, %v", pend, err)
	}
}

// putDevProof puts a valid-shaped dev proof for sha in store.
func putDevProof(t *testing.T, store release.Store, sha string, at time.Time) {
	t.Helper()
	seed, _, err := release.GenerateKey()
	if err != nil {
		t.Fatal(err)
	}
	key, err := release.ParseSigningKey(seed, "test")
	if err != nil {
		t.Fatal(err)
	}
	p, err := release.SignProof(key, release.Proof{App: "console", Platform: release.AdoptPlatform(), SHA256: sha,
		Version: "v1", Prover: "dev", ActiveSince: at.Add(-20 * time.Minute), ProvenAt: at})
	if err != nil {
		t.Fatal(err)
	}
	if err := release.PutProof(context.Background(), store, "bab", p); err != nil {
		t.Fatal(err)
	}
}

// Final review H5: dev proves v1, its staged copy is pruned, and the name v1
// is reused for other bytes at the same path. The asker hashes the new file,
// finds no proof for it, and asks root again, rather than answering from the
// old file's hash and the proof it found for that.
func TestMintAskerRehashesAReusedVersionPath(t *testing.T) {
	t.Parallel()
	a, asked, clock, store, sha := mintAskerFixture(t, 20*time.Minute)
	ctx := context.Background()
	t0 := *clock
	putDevProof(t, store, sha, t0)
	a.tick(ctx)
	if *asked != 0 {
		t.Fatalf("asked %d times for a proven build, want 0", *asked)
	}
	staged := filepath.Join(a.optDir, "versions", "v1", "console")
	if err := os.Remove(staged); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(staged, []byte("other bytes under the same name"), 0o755); err != nil {
		t.Fatal(err)
	}
	*clock = t0.Add(mintAskEvery)
	a.tick(ctx)
	if *asked != 1 {
		t.Fatalf("asked %d times after the path's bytes changed, want 1: the new bytes have no proof", *asked)
	}
	newSHA := sha256Hex("other bytes under the same name")
	if h := a.shaByPath[staged]; h.sha != newSHA {
		t.Fatalf("cached sha256 = %q, want the new file's %q", h.sha, newSHA)
	}
}

// The same bytes rewritten in place with a new mtime are hashed again too:
// size and mtime are part of the file's identity, not only its inode.
func TestMintAskerRehashesAFileRewrittenInPlace(t *testing.T) {
	t.Parallel()
	a, asked, clock, store, sha := mintAskerFixture(t, 20*time.Minute)
	ctx := context.Background()
	t0 := *clock
	putDevProof(t, store, sha, t0)
	a.tick(ctx)
	staged := filepath.Join(a.optDir, "versions", "v1", "console")
	// liveTo's build is one byte; another byte of the same size, in place.
	if err := os.WriteFile(staged, []byte("y"), 0o755); err != nil {
		t.Fatal(err)
	}
	later := time.Now().Add(time.Hour)
	if err := os.Chtimes(staged, later, later); err != nil {
		t.Fatal(err)
	}
	*clock = t0.Add(mintAskEvery)
	a.tick(ctx)
	if *asked != 1 {
		t.Fatalf("asked %d times after an in-place rewrite, want 1", *asked)
	}
}

// The proven cache is per proof object: a proof seen for one prover does not
// answer for another after the policy changes prover.
func TestMintAskerProvenCacheIsPerProver(t *testing.T) {
	t.Parallel()
	a, asked, clock, store, sha := mintAskerFixture(t, 20*time.Minute)
	ctx := context.Background()
	t0 := *clock
	putDevProof(t, store, sha, t0)
	a.tick(ctx)
	if *asked != 0 {
		t.Fatalf("asked %d times for a proven build, want 0", *asked)
	}
	if err := os.WriteFile(a.policyPath, []byte(`{"schema":1,"prove":{"apps":["console"],"prover":"staging","after":"15m","key_file":"/etc/carlos/proving.key"}}`), 0o644); err != nil {
		t.Fatal(err)
	}
	*clock = t0.Add(mintAskEvery)
	a.tick(ctx)
	if *asked != 1 {
		t.Fatalf("asked %d times once the prover is staging, want 1: dev's proof is not staging's", *asked)
	}
}

func TestMintAskerWaitsOutTheBake(t *testing.T) {
	t.Parallel()
	a, asked, _, store, sha := mintAskerFixture(t, 5*time.Minute)
	a.tick(context.Background())
	if *asked != 0 {
		t.Fatalf("asked %d times five minutes into a fifteen-minute bake", *asked)
	}
	if _, err := release.GetProofPending(context.Background(), store, "bab", "console", sha, "dev"); err != nil {
		t.Fatalf("no pending note for a baking build: %v", err)
	}
}

// Task 2's carry: a policy file that does not parse is closed. Root mints
// nothing until it parses, so the asker has nothing to ask for and stays
// quiet rather than reading the broken file as "no prove block" and guessing.
func TestMintAskerAsksNothingOnABrokenPolicy(t *testing.T) {
	t.Parallel()
	a, asked, _, store, sha := mintAskerFixture(t, 20*time.Minute)
	if err := os.WriteFile(a.policyPath, []byte(`{"schema":1,"prove":`), 0o644); err != nil {
		t.Fatal(err)
	}
	a.tick(context.Background())
	if *asked != 0 {
		t.Fatalf("asked %d times with a broken policy, want 0", *asked)
	}
	if _, err := release.GetProofPending(context.Background(), store, "bab", "console", sha, "dev"); err == nil {
		t.Fatal("pending note written under a broken policy")
	}
}

// Spec §4.5, codex 14: a non-canary listed route with a live version stays in
// the fast set while it waits (at the gate's 30 s cadence), and leaves once
// it adopts.
func TestFastMembersKeepsAWaitingRoute(t *testing.T) {
	t.Parallel()
	f := newFastFixture(t)
	ctx := context.Background()
	host := "edge.example.com"
	f.addRoute(t, host, "edge")
	f.stageLive(t, host, "v1")
	plat := release.AdoptPlatform()
	for ver, body := range map[string]string{"v1": "staged build", "v2": "build two"} {
		m := release.Manifest{App: "fastapp", Version: ver, Kind: "binary", Artifacts: map[string]release.Artifact{plat: {}}}
		if err := release.Ship(ctx, f.store, "bab", m, map[string][]byte{plat: []byte(body)}); err != nil {
			t.Fatalf("Ship %s: %v", ver, err)
		}
	}
	if err := release.Promote(ctx, f.store, f.priv, "bab", "fastapp", "edge", "v2"); err != nil {
		t.Fatal(err)
	}
	seed, pubB64, err := release.GenerateKey()
	if err != nil {
		t.Fatal(err)
	}
	prover, err := release.ParseSigningKey(seed, "test")
	if err != nil {
		t.Fatal(err)
	}
	policy := filepath.Join(t.TempDir(), "proof-policy.json")
	if err := os.WriteFile(policy, []byte(fmt.Sprintf(`{"schema":1,"require":[{"app":"fastapp","prover":"dev","key":%q}]}`, pubB64)), 0o644); err != nil {
		t.Fatal(err)
	}
	clock := time.Now()
	gate := release.NewProofGate(policy, f.dataDir).WithClock(func() time.Time { return clock })
	d := f.deps(nil)
	d.passOpts = append(d.passOpts, release.WithProofGate(gate))
	d.proof = gate

	if got := d.fastMembers(clock); len(got) != 0 {
		t.Fatalf("members = %v before anything waits", got)
	}
	// The serial-triggered full pass sees v2 and finds no proof.
	if err := release.Pass(ctx, f.reg, f.store, f.pub, f.optDir, d.restart, d.passOpts...); err != nil {
		t.Fatal(err)
	}
	if v, _ := release.LiveVersion(f.optDir, host); v != "v1" {
		t.Fatalf("live = %q, want v1 while unproven", v)
	}
	clock = clock.Add(31 * time.Second)
	if got := d.fastMembers(clock); len(got) != 1 || got[0] != host {
		t.Fatalf("members = %v, want the waiting non-canary route", got)
	}
	sum := sha256.Sum256([]byte("build two"))
	p, err := release.SignProof(prover, release.Proof{App: "fastapp", Platform: plat, SHA256: hex.EncodeToString(sum[:]),
		Version: "v2", Prover: "dev", ActiveSince: clock.Add(-time.Hour).UTC().Truncate(time.Second),
		ProvenAt: clock.UTC().Truncate(time.Second)})
	if err != nil {
		t.Fatal(err)
	}
	if err := release.PutProof(ctx, f.store, "bab", p); err != nil {
		t.Fatal(err)
	}
	fastTick(ctx, d, clock)
	if v, _ := release.LiveVersion(f.optDir, host); v != "v2" {
		t.Fatalf("live = %q, want v2 once proven", v)
	}
	clock = clock.Add(31 * time.Second)
	if got := d.fastMembers(clock); len(got) != 0 {
		t.Fatalf("members = %v after adopting, want none", got)
	}
}

// Spec §4.5 for a route with no live link: a new instance of a listed app
// whose head is unproven waits like a staged one, and rejoins the sweep each
// time its 30 s miss runs out. Its unstaged backoff must not stretch that.
func TestFastMembersKeepsAnUnstagedWaitingRouteAtTheMissCadence(t *testing.T) {
	t.Parallel()
	f := newFastFixture(t)
	ctx := context.Background()
	host := "new.example.com"
	f.addRoute(t, host, "edge")
	plat := release.AdoptPlatform()
	m := release.Manifest{App: "fastapp", Version: "v2", Kind: "binary", Artifacts: map[string]release.Artifact{plat: {}}}
	if err := release.Ship(ctx, f.store, "bab", m, map[string][]byte{plat: []byte("build two")}); err != nil {
		t.Fatal(err)
	}
	if err := release.Promote(ctx, f.store, f.priv, "bab", "fastapp", "edge", "v2"); err != nil {
		t.Fatal(err)
	}
	_, pubB64, err := release.GenerateKey()
	if err != nil {
		t.Fatal(err)
	}
	policy := filepath.Join(t.TempDir(), "proof-policy.json")
	if err := os.WriteFile(policy, []byte(fmt.Sprintf(`{"schema":1,"require":[{"app":"fastapp","prover":"dev","key":%q}]}`, pubB64)), 0o644); err != nil {
		t.Fatal(err)
	}
	clock := time.Now()
	gate := release.NewProofGate(policy, f.dataDir).WithClock(func() time.Time { return clock })
	d := f.deps(nil)
	d.passOpts = append(d.passOpts, release.WithProofGate(gate))
	d.proof = gate
	for i := 0; i < 8; i++ {
		if got := d.fastMembers(clock); len(got) != 1 || got[0] != host {
			t.Fatalf("cycle %d: members = %v, want the waiting unstaged route (step %v)", i, got, d.backoffFor(host))
		}
		fastTick(ctx, d, clock)
		if w := gate.Waits(); len(w) != 1 || w[0].Host != host {
			t.Fatalf("cycle %d: waits = %+v, want %s waiting", i, w, host)
		}
		if v, _ := release.LiveVersion(f.optDir, host); v != "" {
			t.Fatalf("cycle %d: live = %q, want nothing while unproven", i, v)
		}
		clock = clock.Add(release.ProofMissTTL + time.Second)
	}
}

// Ruling 5's purpose, seen from the fast loop: a wait the sweep neither
// renews nor clears (here the route moved to a channel with no pointer, so
// adoptHost returns before the gate) must not keep its host in the sweep
// every tick. It backs off like an unstaged route.
func TestFastMembersBacksOffAWaitTheSweepLeftStanding(t *testing.T) {
	t.Parallel()
	f := newFastFixture(t)
	ctx := context.Background()
	host := "edge.example.com"
	f.addRoute(t, host, "edge")
	f.stageLive(t, host, "v1")
	plat := release.AdoptPlatform()
	m := release.Manifest{App: "fastapp", Version: "v2", Kind: "binary", Artifacts: map[string]release.Artifact{plat: {}}}
	if err := release.Ship(ctx, f.store, "bab", m, map[string][]byte{plat: []byte("build two")}); err != nil {
		t.Fatal(err)
	}
	if err := release.Promote(ctx, f.store, f.priv, "bab", "fastapp", "edge", "v2"); err != nil {
		t.Fatal(err)
	}
	_, pubB64, err := release.GenerateKey()
	if err != nil {
		t.Fatal(err)
	}
	policy := filepath.Join(t.TempDir(), "proof-policy.json")
	if err := os.WriteFile(policy, []byte(fmt.Sprintf(`{"schema":1,"require":[{"app":"fastapp","prover":"dev","key":%q}]}`, pubB64)), 0o644); err != nil {
		t.Fatal(err)
	}
	clock := time.Now()
	gate := release.NewProofGate(policy, f.dataDir).WithClock(func() time.Time { return clock })
	d := f.deps(nil)
	d.passOpts = append(d.passOpts, release.WithProofGate(gate))
	d.proof = gate
	if err := release.Pass(ctx, f.reg, f.store, f.pub, f.optDir, d.restart, d.passOpts...); err != nil {
		t.Fatal(err)
	}
	f.addRoute(t, host, "nowhere") // no pointer: the pass never reaches the gate
	clock = clock.Add(31 * time.Second)
	if got := d.fastMembers(clock); len(got) != 1 {
		t.Fatalf("members = %v, want the waiting route", got)
	}
	fastTick(ctx, d, clock)
	if got := d.fastMembers(clock.Add(time.Second)); len(got) != 0 {
		t.Fatalf("members = %v a second after a sweep that left the wait standing, want none", got)
	}
	if d.backoffFor(host) == 0 {
		t.Fatal("no backoff recorded for the standing wait")
	}
}