//go:build linux

package hostbox

import (
	"context"
	"database/sql"
	"encoding/json"
	"errors"
	"fmt"
	"net/url"
	"os"
	"path/filepath"
	"strings"
	"testing"
	"time"

	"github.com/carlosframework/platform/internal/hostguard"
)

func plan9Fix1Inventory() RetirementInventory {
	return RetirementInventory{Host: "app.example", Captured: hostguard.Captured{Incarnation: "inc", Stamp: 7}, Ownership: "owner", Artifacts: []Artifact{{Kind: ArtifactRoute, Root: "registry", Name: "app.example", Owner: "owner", RowID: "route-1"}}}
}

// C-1: root must never follow a symlinked journal directory. The agent could
// otherwise point root's temp-file and rename writes at any directory.
func TestPlan9Fix1TypedRetirementRefusesSymlinkedJournalDir(t *testing.T) {
	base := t.TempDir()
	victim := filepath.Join(base, "victim")
	if err := os.Mkdir(victim, 0700); err != nil {
		t.Fatal(err)
	}
	link := filepath.Join(base, "retire")
	if err := os.Symlink(victim, link); err != nil {
		t.Fatal(err)
	}
	intent, err := NewRetirementJournal("fence", plan9Fix1Inventory())
	if err != nil {
		t.Fatal(err)
	}
	target := hostguard.FenceTarget{Host: "app.example", Incarnation: "inc", Stamp: 7}
	r := TypedRetirement{JournalDir: link, Authority: &cleanupAuthority{}, Filesystem: &rootParker{}, Rows: &rowRetirer{rows: map[string]bool{"route:route-1": true}}, Ack: func(context.Context, RetirementJournal) error { return nil }}
	if err = r.Run(t.Context(), target, intent); err == nil {
		t.Fatal("symlinked journal directory accepted")
	}
	entries, _ := os.ReadDir(victim)
	if len(entries) != 0 {
		t.Fatalf("root wrote through a symlinked journal directory: %v", entries)
	}
	// An ancestor symlink is refused too.
	nested := TypedRetirement{JournalDir: filepath.Join(link, "deeper"), Authority: r.Authority, Filesystem: r.Filesystem, Rows: r.Rows, Ack: r.Ack}
	if err = nested.Run(t.Context(), target, intent); err == nil {
		t.Fatal("symlinked journal ancestor accepted")
	}
	if entries, _ = os.ReadDir(victim); len(entries) != 0 {
		t.Fatalf("root created through a symlinked ancestor: %v", entries)
	}
}

// C-1: a journal directory another principal can write is not root's own.
func TestPlan9Fix1TypedRetirementRefusesSharedJournalDir(t *testing.T) {
	dir := filepath.Join(t.TempDir(), "retire")
	if err := os.Mkdir(dir, 0700); err != nil {
		t.Fatal(err)
	}
	if err := os.Chmod(dir, 0770); err != nil {
		t.Fatal(err)
	}
	intent, err := NewRetirementJournal("fence", plan9Fix1Inventory())
	if err != nil {
		t.Fatal(err)
	}
	r := TypedRetirement{JournalDir: dir, Authority: &cleanupAuthority{}, Filesystem: &rootParker{}, Rows: &rowRetirer{rows: map[string]bool{"route:route-1": true}}, Ack: func(context.Context, RetirementJournal) error { return nil }}
	if err = r.Run(t.Context(), hostguard.FenceTarget{Host: "app.example", Incarnation: "inc", Stamp: 7}, intent); err == nil {
		t.Fatal("group-writable journal directory accepted")
	}
	if entries, _ := os.ReadDir(dir); len(entries) != 0 {
		t.Fatalf("root wrote into a shared directory: %v", entries)
	}
}

// C-1: cold handover recovery reads only a trusted, unlinked directory.
func TestPlan9Fix1ColdRecoverRefusesSymlinkedJournalDir(t *testing.T) {
	base := t.TempDir()
	victim := filepath.Join(base, "victim")
	if err := os.Mkdir(victim, 0700); err != nil {
		t.Fatal(err)
	}
	link := filepath.Join(base, "cold")
	if err := os.Symlink(victim, link); err != nil {
		t.Fatal(err)
	}
	if err := (ColdHandover{JournalDir: link}).Recover(t.Context()); !errors.Is(err, ErrTypedJournal) {
		t.Fatalf("cold recovery followed a symlinked journal directory: %v", err)
	}
}

func plan9Fix1Legacy(t *testing.T, in LaunchInventory) string {
	t.Helper()
	legacy := t.TempDir()
	old, err := OpenLaunchJournal(filepath.Join(legacy, "launches.db"))
	if err != nil {
		t.Fatal(err)
	}
	if err = old.Create(t.Context(), in); err != nil {
		t.Fatal(err)
	}
	if err = old.Close(); err != nil {
		t.Fatal(err)
	}
	inventory, err := OpenStopInventoryDB(filepath.Join(legacy, "inventory.db"))
	if err != nil {
		t.Fatal(err)
	}
	if err = inventory.WriteStopInventory(t.Context(), StopInventory{Complete: true, Host: in.Target.Host, Incarnation: in.Target.Incarnation, InstallationStamp: in.Target.Stamp, Box: "box", Enrollment: "enrollment", DirectoryRevision: "1"}); err != nil {
		t.Fatal(err)
	}
	if err = inventory.Close(); err != nil {
		t.Fatal(err)
	}
	return legacy
}

func plan9Fix1RawLegacy(t *testing.T, legacy, stmt string, args ...any) {
	t.Helper()
	db, err := sql.Open("sqlite", "file:"+url.PathEscape(filepath.Join(legacy, "launches.db"))+"?_pragma=busy_timeout(5000)")
	if err != nil {
		t.Fatal(err)
	}
	defer db.Close()
	if _, err = db.Exec(stmt, args...); err != nil {
		t.Fatal(err)
	}
}

var plan9Fix1Freeze = func(context.Context) (func(), error) { return func() {}, nil }

func plan9Fix1Accept(context.Context, LaunchInventory, StopInventory, StopKernelJournal) error {
	return nil
}

// M3: rows a rolled-back binary writes to the legacy journal after the marker
// must not be silently ignored on roll forward.
func TestPlan9Fix1MigrationRefusesLegacyRowsWrittenAfterMarker(t *testing.T) {
	s, _, in := journalFixture(t)
	legacy := plan9Fix1Legacy(t, in)
	if err := s.MigrateLegacy(t.Context(), legacy, "box", "enrollment", plan9Fix1Freeze, plan9Fix1Accept); err != nil {
		t.Fatal(err)
	}
	// Unchanged legacy files: a restart needs neither quiescence nor proof.
	if err := s.MigrateLegacy(t.Context(), legacy, "box", "enrollment", nil, nil); err != nil {
		t.Fatalf("unchanged legacy refused: %v", err)
	}
	// The old binary runs again and journals another launch.
	old, err := OpenLaunchJournal(filepath.Join(legacy, "launches.db"))
	if err != nil {
		t.Fatal(err)
	}
	second := in
	second.Target.Session = 2
	if err = old.Create(t.Context(), second); err != nil {
		t.Fatal(err)
	}
	if err = old.Close(); err != nil {
		t.Fatal(err)
	}
	if err = s.MigrateLegacy(t.Context(), legacy, "box", "enrollment", plan9Fix1Freeze, plan9Fix1Accept); !errors.Is(err, ErrChanged) {
		t.Fatalf("legacy rows written after the marker were ignored: %v", err)
	}
	if _, err = s.Launches.Read(t.Context(), second.Target); !errors.Is(err, sql.ErrNoRows) {
		t.Fatalf("unproven post-marker row imported: %v", err)
	}
}

// M4: agent-supplied SQLite is opened with an untrusted schema, every imported
// field is validated, and only canonical re-marshalled bodies are stored.
func TestPlan9Fix1MigrationRejectsUntrustedSchemaAndFields(t *testing.T) {
	t.Run("trigger", func(t *testing.T) {
		s, _, in := journalFixture(t)
		legacy := plan9Fix1Legacy(t, in)
		plan9Fix1RawLegacy(t, legacy, "CREATE TRIGGER planted AFTER INSERT ON launches BEGIN SELECT 1; END")
		if err := s.MigrateLegacy(t.Context(), legacy, "box", "enrollment", plan9Fix1Freeze, plan9Fix1Accept); err == nil {
			t.Fatal("legacy schema with a trigger accepted")
		}
	})
	t.Run("unknown-field", func(t *testing.T) {
		s, _, in := journalFixture(t)
		legacy := plan9Fix1Legacy(t, in)
		raw, _ := json.Marshal(in)
		planted := strings.Replace(string(raw), "{", `{"Planted":true,`, 1)
		plan9Fix1RawLegacy(t, legacy, "UPDATE launches SET body=?", []byte(planted))
		if err := s.MigrateLegacy(t.Context(), legacy, "box", "enrollment", plan9Fix1Freeze, plan9Fix1Accept); err == nil {
			t.Fatal("legacy body with an unknown field accepted")
		}
	})
	t.Run("invalid-group", func(t *testing.T) {
		s, _, in := journalFixture(t)
		bad := in
		bad.Groups = []LaunchGroup{{RelativePath: "../../etc", Device: 1, Inode: 2}}
		legacy := plan9Fix1Legacy(t, in)
		raw, _ := json.Marshal(bad)
		plan9Fix1RawLegacy(t, legacy, "UPDATE launches SET body=?", raw)
		if err := s.MigrateLegacy(t.Context(), legacy, "box", "enrollment", plan9Fix1Freeze, plan9Fix1Accept); err == nil {
			t.Fatal("legacy launch naming an escaping cgroup accepted")
		}
	})
	t.Run("canonical", func(t *testing.T) {
		s, _, in := journalFixture(t)
		legacy := plan9Fix1Legacy(t, in)
		raw, _ := json.MarshalIndent(in, "", "  ")
		plan9Fix1RawLegacy(t, legacy, "UPDATE launches SET body=?", raw)
		if err := s.MigrateLegacy(t.Context(), legacy, "box", "enrollment", plan9Fix1Freeze, plan9Fix1Accept); err != nil {
			t.Fatal(err)
		}
		var stored []byte
		if err := s.Launches.db.QueryRow("SELECT body FROM launches").Scan(&stored); err != nil {
			t.Fatal(err)
		}
		want, _ := json.Marshal(in)
		if string(stored) != string(want) {
			t.Fatalf("raw legacy body imported verbatim:\n%s", stored)
		}
	})
}

// M6: two distinct calls with identical payloads are distinct requests, and
// an uncertain request keeps its identity for an explicit replay.
func TestPlan9Fix1JournalDistinctCallsDoNotMerge(t *testing.T) {
	var ids []string
	client, _ := RemoteJournals(func(_ context.Context, q JournalRequest) (JournalResponse, error) {
		ids = append(ids, q.ID)
		return JournalResponse{V: 1, ID: q.ID}, nil
	})
	target := hostguard.FenceTarget{Host: "app.example", Incarnation: "inc", Stamp: 1, Session: 1, Box: "box", Enrollment: "enrollment", BootID: "boot", ControllerID: "controller"}
	for i := 0; i < 2; i++ {
		if err := client.RecordProducer(t.Context(), target, "p"); err != nil {
			t.Fatal(err)
		}
	}
	if len(ids) != 2 || ids[0] == ids[1] {
		t.Fatalf("distinct calls merged into one request: %v", ids)
	}
}

func TestPlan9Fix1JournalReceiptsPruneAndExpiredRequestsStayUncertain(t *testing.T) {
	s, _, in := journalFixture(t)
	now := time.Now()
	s.Now = func() time.Time { return now }
	call := func(ctx context.Context, q JournalRequest) (JournalResponse, error) { return s.Execute(ctx, "peer", q) }
	client, _ := RemoteJournals(call)
	if err := client.Create(t.Context(), in); err != nil {
		t.Fatal(err)
	}
	count := func() int {
		var n int
		if err := s.Launches.db.QueryRow("SELECT count(*) FROM journal_requests").Scan(&n); err != nil {
			t.Fatal(err)
		}
		return n
	}
	if count() != 1 {
		t.Fatal("mutation receipt missing")
	}
	// Past retention, the next mutation prunes the settled receipt.
	now = now.Add(JournalReceiptRetention + time.Minute)
	if err := client.RecordProducer(t.Context(), in.Target, "p1"); !errors.Is(err, ErrJournalUncertain) {
		// The client's own clock issued this request; root's clock is ahead
		// by more than the execution window, so root refuses to execute it.
		t.Fatalf("request outside root's execution window executed: %v", err)
	}
	q := JournalRequest{Op: "producer", Target: in.Target, Producer: "p1"}
	q, err := journalPrepare(q, now)
	if err != nil {
		t.Fatal(err)
	}
	if _, err := s.Execute(t.Context(), "peer", q); err != nil {
		t.Fatal(err)
	}
	if n := count(); n != 1 {
		t.Fatalf("settled receipts were not pruned: %d", n)
	}
	// A request older than the execution window never executes fresh.
	stale, err := journalPrepare(JournalRequest{Op: "producer", Target: in.Target, Producer: "p2"}, now.Add(-JournalRequestWindow-time.Minute))
	if err != nil {
		t.Fatal(err)
	}
	out, err := s.Execute(t.Context(), "peer", stale)
	if !errors.Is(err, ErrJournalUncertain) {
		t.Fatalf("expired request executed: %+v %v", out, err)
	}
	got, err := s.Launches.Read(t.Context(), in.Target)
	if err != nil || fmt.Sprint(got.ProducerIDs) != "[p1]" {
		t.Fatalf("expired request changed the journal: %+v %v", got, err)
	}
}

// M11: a nil journal refuses instead of panicking.
func TestPlan9Fix1NilJournalsRefuse(t *testing.T) {
	var j *LaunchJournal
	var inv *StopInventoryDB
	target := hostguard.FenceTarget{Host: "app.example", Incarnation: "inc", Stamp: 1}
	calls := map[string]func() error{
		"HasHost":                func() error { _, err := j.HasHost(t.Context(), "app.example"); return err },
		"HasInstallationEffects": func() error { _, err := j.HasInstallationEffects(t.Context(), "app.example", "inc", 1); return err },
		"IntendRole":             func() error { return j.IntendRole(t.Context(), LaunchReservation{}) },
		"Create":                 func() error { return j.Create(t.Context(), LaunchInventory{}) },
		"Prelaunch":              func() error { return j.Prelaunch(t.Context(), LaunchInventory{}) },
		"SessionLaunches":        func() error { _, err := j.SessionLaunches(t.Context(), "a", "b", 1, 1, "c", "d"); return err },
		"Read":                   func() error { _, err := j.Read(t.Context(), target); return err },
		"Reserve":                func() error { return j.Reserve(t.Context(), LaunchReservation{}) },
		"Started":                func() error { return j.Started(t.Context(), LaunchReservation{}, 1, "1") },
		"Settled":                func() error { return j.Settled(t.Context(), LaunchReservation{}) },
		"RecordFile":             func() error { return j.RecordFile(t.Context(), target, LaunchFile{Device: 1, Inode: 1}) },
		"RecordProducer":         func() error { return j.RecordProducer(t.Context(), target, "p") },
		"CompleteProducer":       func() error { _, err := j.CompleteProducer(t.Context(), target, "p", ProducerCompletion{}); return err },
		"Close":                  func() error { return j.Close() },
		"WriteStopInventory":     func() error { return inv.WriteStopInventory(t.Context(), StopInventory{}) },
		"ReadStopInventory":      func() error { _, err := inv.ReadStopInventory(t.Context(), "app.example"); return err },
		"ReadExactStopInventory": func() error { _, err := inv.ReadExactStopInventory(t.Context(), target); return err },
		"InventoryClose":         func() error { return inv.Close() },
	}
	for name, call := range calls {
		t.Run(name, func(t *testing.T) {
			defer func() {
				if r := recover(); r != nil {
					t.Fatalf("nil journal panicked: %v", r)
				}
			}()
			if err := call(); name != "Close" && name != "InventoryClose" && !errors.Is(err, ErrUnsupported) {
				t.Fatalf("nil journal did not refuse: %v", err)
			}
		})
	}
}

// M12: the inventory database waits for a concurrent writer from its first
// statement instead of failing with SQLITE_BUSY.
func TestPlan9Fix1StopInventoryOpenWaitsForBusyDatabase(t *testing.T) {
	path := filepath.Join(t.TempDir(), "inventory.db")
	holder, err := sql.Open("sqlite", "file:"+url.PathEscape(path))
	if err != nil {
		t.Fatal(err)
	}
	defer holder.Close()
	conn, err := holder.Conn(t.Context())
	if err != nil {
		t.Fatal(err)
	}
	defer conn.Close()
	if _, err = conn.ExecContext(t.Context(), "BEGIN EXCLUSIVE"); err != nil {
		t.Fatal(err)
	}
	if _, err = conn.ExecContext(t.Context(), "CREATE TABLE held(x)"); err != nil {
		t.Fatal(err)
	}
	released := make(chan error, 1)
	go func() {
		time.Sleep(300 * time.Millisecond)
		_, err := conn.ExecContext(context.Background(), "COMMIT")
		released <- err
	}()
	inventory, err := OpenStopInventoryDB(path)
	if err != nil {
		t.Fatalf("open did not wait for the busy database: %v", err)
	}
	inventory.Close()
	if err = <-released; err != nil {
		t.Fatal(err)
	}
}