//go:build unix

package hostbox

import (
	"context"
	"database/sql"
	"errors"
	"os"
	"path/filepath"
	"testing"

	"github.com/carlosframework/platform/internal/hostclaim"
	"github.com/carlosframework/platform/internal/hostguard"
	"github.com/carlosframework/platform/internal/registry"
)

// sourceRows is relocationReconciler with Task 10b's production hooks: the
// host guard's admission fence (AdmissionFenceClosed) and the registry
// hold write (RegistryHoldRow), over a registry holding the source's ready
// row, owned by the installation the guard has active.
func sourceRows(t *testing.T) (Reconciler, RecordSelection, *registry.Registry, hostguard.Guard) {
	t.Helper()
	r, selected, _, guard := relocationReconciler(t)
	reg, err := registry.Open(filepath.Join(t.TempDir(), "registry.db"))
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { reg.Close() })
	captured, err := hostguard.Capture(guard.DataDir, selected.Host)
	if err != nil {
		t.Fatal(err)
	}
	owner := registry.ClaimOwnership{ClaimIncarnation: captured.Incarnation, ClaimStamp: captured.Stamp, ClaimOwner: "owner-1", ClaimRowID: "row-1"}
	if err := reg.Upsert(registry.Route{Host: selected.Host, Status: "ready", Socket: "/run/shop.sock", ClaimOwnership: owner}); err != nil {
		t.Fatal(err)
	}
	r.FenceClosed, r.HoldRow = AdmissionFenceClosed(guard), RegistryHoldRow(reg)
	return r, selected, reg, guard
}

// closeSourceFence is root beginning the source's stop for the op: the
// durable admission fence in the guard record (BeginFence).
func closeSourceFence(t *testing.T, r Reconciler, selected RecordSelection, guard hostguard.Guard) {
	t.Helper()
	ctx := context.Background()
	captured, err := hostguard.Capture(guard.DataDir, selected.Host)
	if err != nil {
		t.Fatal(err)
	}
	obs, err := hostclaim.Read(ctx, r.Claims, selected.Host)
	if err != nil {
		t.Fatal(err)
	}
	target := hostguard.FenceTarget{FenceID: "fence-1", Host: selected.Host, Incarnation: captured.Incarnation, Stamp: captured.Stamp, Session: obs.Claim.Holder.Session,
		Op: "rel-1", Phase: hostclaim.PhaseReleasing, Box: "box", Enrollment: "enrollment-1", BootID: "boot", ControllerID: "ctl", ClaimETag: obs.ETag, DirectoryRevision: "4"}
	if _, err := guard.BeginFence(ctx, target); err != nil {
		t.Fatal(err)
	}
}

func rowOf(t *testing.T, reg *registry.Registry, host string) *registry.Route {
	t.Helper()
	row, err := reg.Get(host)
	if err != nil {
		t.Fatal(err)
	}
	return row
}

// Task 10b test 1 (R5-3): during releasing the source's row is unchanged
// until this box's admission fence for the host closes; reconcile then
// holds it for the op in "relocating", a status the edge never serves,
// with every other column as it was, its claim ownership included. A dry
// run writes nothing, an unreadable fence is an error with the row left
// as it was, never "open", and with no hold-only local check (CheckHeld)
// nothing is held.
func TestReconcileHoldsTheSourcesRowAtItsFencesClose(t *testing.T) {
	r, selected, reg, guard := sourceRows(t)
	ctx := context.Background()
	obs := relocate(t, r, selected.Host, hostclaim.PhaseReleasing)
	before := *rowOf(t, reg, selected.Host)
	writes := 0
	for _, dry := range []bool{true, false} {
		sel := selected
		sel.DryRun = dry
		if err := r.Install(ctx, sel, func() error { writes++; return nil }); !errors.Is(err, ErrChanged) {
			t.Fatalf("the source before its fence closed (dry run %v): %v", dry, err)
		}
	}
	if got := rowOf(t, reg, selected.Host); writes != 0 || *got != before {
		t.Fatalf("before the fence closed: writes %d row %+v (want %+v)", writes, got, before)
	}
	if now, err := hostclaim.Read(ctx, r.Claims, selected.Host); err != nil || now.ETag != obs.ETag {
		t.Fatalf("the claim was written before the fence closed: %v", err)
	}
	// An unreadable fence is an error, never "open": the row stays.
	record := filepath.Join(guard.DataDir, "hostguard", selected.Host+".json")
	if err := os.Rename(record, record+".away"); err != nil {
		t.Fatal(err)
	}
	if err := r.Install(ctx, selected, func() error { writes++; return nil }); err == nil || errors.Is(err, ErrChanged) {
		t.Fatalf("an unreadable fence: %v (want the read's error)", err)
	}
	if err := os.Rename(record+".away", record); err != nil {
		t.Fatal(err)
	}
	if got := rowOf(t, reg, selected.Host); writes != 0 || *got != before {
		t.Fatalf("an unreadable fence changed the row: %+v", got)
	}
	closeSourceFence(t, r, selected, guard)
	dry := selected
	dry.DryRun = true
	if err := r.Install(ctx, dry, func() error { writes++; return nil }); err != nil {
		t.Fatalf("the fenced source's dry run: %v", err)
	}
	if got := rowOf(t, reg, selected.Host); *got != before {
		t.Fatalf("a dry run held the row: %+v", got)
	}
	// The hold-only path's local check is required: without it nothing
	// is held.
	checkHeld := r.CheckHeld
	r.CheckHeld = nil
	if err := r.Install(ctx, selected, func() error { writes++; return nil }); !errors.Is(err, ErrUnsupported) {
		t.Fatalf("no hold-only check: %v", err)
	}
	if got := rowOf(t, reg, selected.Host); *got != before {
		t.Fatalf("a hold without its local check: %+v", got)
	}
	r.CheckHeld = checkHeld
	if err := r.Install(ctx, selected, func() error { writes++; return nil }); err != nil {
		t.Fatalf("the fenced source's hold: %v", err)
	}
	got := rowOf(t, reg, selected.Host)
	if writes != 0 || got.Status != "relocating" || got.HoldOp != "rel-1" || !registry.IsHold(got.Status) {
		t.Fatalf("after the fence closed: writes %d row %+v", writes, got)
	}
	unheld := *got
	unheld.Status, unheld.HoldOp = before.Status, before.HoldOp
	if unheld != before {
		t.Fatalf("the hold changed more than status and hold_op: %+v (was %+v)", got, before)
	}
}

// Task 10b test 2: the hold write never takes a row another op holds, a
// replay changes nothing, a missing row is not minted, and an unreadable
// row is an error, never "held". Through the reconciler, a fenced source
// whose row another op holds is refused with the row as it was.
func TestReconcileSourceHoldNeverTakesAnotherOpsRow(t *testing.T) {
	r, selected, reg, guard := sourceRows(t)
	ctx := context.Background()
	hold := RegistryHoldRow(reg)
	relocate(t, r, selected.Host, hostclaim.PhaseReleasing)
	closeSourceFence(t, r, selected, guard)

	if ok, err := reg.SetHoldIf(selected.Host, "moving", "mv-9", ""); err != nil || !ok {
		t.Fatalf("another op's hold: %v %v", ok, err)
	}
	other := *rowOf(t, reg, selected.Host)
	if err := hold(ctx, selected.Host, "rel-1"); !errors.Is(err, ErrChanged) {
		t.Fatalf("another op's row: %v", err)
	}
	if err := r.Install(ctx, selected, func() error { return nil }); !errors.Is(err, ErrChanged) {
		t.Fatalf("reconcile over another op's row: %v", err)
	}
	if got := rowOf(t, reg, selected.Host); *got != other {
		t.Fatalf("another op's row was taken: %+v (was %+v)", got, other)
	}
	if ok, err := reg.ReleaseHold(selected.Host, "mv-9"); err != nil || !ok {
		t.Fatalf("release the other op's hold: %v %v", ok, err)
	}

	if err := r.Install(ctx, selected, func() error { return nil }); err != nil {
		t.Fatalf("the hold: %v", err)
	}
	held := *rowOf(t, reg, selected.Host)
	for i := 0; i < 2; i++ {
		if err := hold(ctx, selected.Host, "rel-1"); err != nil {
			t.Fatalf("a replay of the write: %v", err)
		}
		if err := r.Install(ctx, selected, func() error { return nil }); err != nil {
			t.Fatalf("a replay through reconcile: %v", err)
		}
		if got := rowOf(t, reg, selected.Host); *got != held {
			t.Fatalf("a replay changed the row: %+v (was %+v)", got, held)
		}
	}

	if err := hold(ctx, "absent.example", "rel-1"); !errors.Is(err, ErrChanged) {
		t.Fatalf("no row: %v", err)
	}
	if got := rowOf(t, reg, "absent.example"); got != nil {
		t.Fatalf("the hold minted a row: %+v", got)
	}
	if err := reg.Close(); err != nil {
		t.Fatal(err)
	}
	if err := hold(ctx, selected.Host, "rel-1"); err == nil || errors.Is(err, ErrChanged) {
		t.Fatalf("an unreadable row: %v (want the read's error)", err)
	}
}

// RegistryHoldRow reads the row unheld, but another op holds it before
// the conditional write lands: SetHoldIf matches nothing and answers
// false. That is never a hold: the write is ErrChanged, the other op's
// hold is left as it is, and the next attempt, judging afresh, refuses
// the other op's row too. The concurrent writer is a trigger on the
// registry's own database that holds the row for "mv-9" as the hold
// write starts and abandons that write (RAISE(IGNORE)), so the write
// touches nothing and counts no change.
func TestRegistryHoldRowRefusesARowHeldBetweenTheReadAndTheWrite(t *testing.T) {
	ctx := context.Background()
	path := filepath.Join(t.TempDir(), "registry.db")
	reg, err := registry.Open(path)
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { reg.Close() })
	owner := registry.ClaimOwnership{ClaimIncarnation: "inc-1", ClaimStamp: 7, ClaimOwner: "owner-1", ClaimRowID: "row-1"}
	if err := reg.Upsert(registry.Route{Host: "shop.example", Status: "ready", Socket: "/run/shop.sock", ClaimOwnership: owner}); err != nil {
		t.Fatal(err)
	}
	before := *rowOf(t, reg, "shop.example")
	db, err := sql.Open("sqlite", path)
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { db.Close() })
	if _, err := db.Exec(`CREATE TRIGGER concurrent_hold BEFORE UPDATE OF status, hold_op ON routes
		WHEN NEW.status = 'relocating' AND OLD.hold_op = ''
		BEGIN
			UPDATE routes SET status = 'moving', hold_op = 'mv-9' WHERE host = OLD.host;
			SELECT RAISE(IGNORE);
		END`); err != nil {
		t.Fatal(err)
	}
	hold := RegistryHoldRow(reg)
	if err := hold(ctx, "shop.example", "rel-1"); !errors.Is(err, ErrChanged) {
		t.Fatalf("a row held between the read and the write: %v (want ErrChanged)", err)
	}
	got := rowOf(t, reg, "shop.example")
	other := before
	other.Status, other.HoldOp = "moving", "mv-9"
	if got == nil || *got != other {
		t.Fatalf("after the refused write: %+v (want the other op's hold %+v)", got, other)
	}
	if _, err := db.Exec(`DROP TRIGGER concurrent_hold`); err != nil {
		t.Fatal(err)
	}
	if err := hold(ctx, "shop.example", "rel-1"); !errors.Is(err, ErrChanged) {
		t.Fatalf("the next attempt over the other op's row: %v (want ErrChanged)", err)
	}
	if got := rowOf(t, reg, "shop.example"); got == nil || *got != other {
		t.Fatalf("the next attempt took the other op's row: %+v", got)
	}
}