package objstore

import (
	"context"
	"errors"
	"os"
	"strings"
	"testing"
	"time"

	"github.com/carlosframework/platform/internal/release"
)

// enableScanning marks a provisioned store as scanned, the way the operator
// grant door does.
func enableScanning(t *testing.T, s release.Store, acct, app string) {
	t.Helper()
	ctx := context.Background()
	rec, etag, err := Get(ctx, s, acct, app)
	if err != nil || rec == nil {
		t.Fatalf("re-read %s/%s: %+v, %v", acct, app, rec, err)
	}
	rec.Scanning = &ScanBlock{
		Requested: &ScanRequested{At: time.Now().UTC(), By: "m@example.com"},
		Enabled:   &ScanEnabled{Engine: "clamav", At: time.Now().UTC(), By: "op@example.com"},
	}
	if _, err := Put(ctx, s, acct, app, rec, etag); err != nil {
		t.Fatal(err)
	}
	// The DEPLOYMENT switch too. Absent record = not enabled, and every
	// fixture that arms a scanner and expects a sweep needs both halves.
	if av, _, err := release.GetAntivirus(ctx, s); err != nil {
		t.Fatal(err)
	} else if av == nil {
		if _, err := release.PutAntivirus(ctx, s, &release.AntivirusSettings{
			Enabled: true, Engine: "clamav", At: time.Now().UTC(), By: "test",
		}, ""); err != nil {
			t.Fatal(err)
		}
	}
}

// The scanner is released BEFORE the bucket goes, while the record naming it
// still exists. A plan that outlives its bucket counts against a
// non-adjustable per-region quota with nothing left pointing at it.
func TestTeardownDisablesScannerBeforeDeletingBucket(t *testing.T) {
	ctx := context.Background()
	s := release.NewDirStore(t.TempDir())
	_, pub := testSealKeypair(t)
	p := NewMemProvisioner("eu-west-1")
	rec := teardownFixture(t, s, pub, p)
	bucket := rec.Provisioned.Bucket

	sc := NewMemScanner()
	if err := sc.EnsureEnabled(ctx, bucket); err != nil {
		t.Fatal(err)
	}
	enableScanning(t, s, "bab", "titogo")

	if err := Teardown(ctx, s, p, sc, "bab", "titogo"); err != nil {
		t.Fatal(err)
	}
	if sc.IsEnabled(bucket) {
		t.Fatal("teardown left the scanning engine enabled on a destroyed bucket")
	}
}

// A teardown that cannot reach the engine must NOT go on to delete the record
// — the record is the only thing naming what it failed to release. Same
// posture as the nil-provisioner refusal.
func TestTeardownRefusesNilScannerWhenEnabled(t *testing.T) {
	ctx := context.Background()
	s := release.NewDirStore(t.TempDir())
	_, pub := testSealKeypair(t)
	p := NewMemProvisioner("eu-west-1")
	teardownFixture(t, s, pub, p)
	enableScanning(t, s, "bab", "titogo")

	err := Teardown(ctx, s, p, nil, "bab", "titogo")
	if err == nil {
		t.Fatal("teardown with a nil scanner over an enabled record must refuse")
	}
	if !strings.Contains(err.Error(), "CARLOS_STORE_SCANNER") {
		t.Fatalf("the refusal must name the variable an operator can act on: %v", err)
	}
	// The refusal owes the record intact.
	if rec, _, gerr := Get(ctx, s, "bab", "titogo"); gerr != nil || rec == nil {
		t.Fatalf("a refused teardown destroyed the record: %+v, %v", rec, gerr)
	}
}

// A store that never used scanning tears down with no scanner at all — which
// is every store on a deployment that has not opted in.
func TestTeardownAllowsNilScannerWhenNotEnabled(t *testing.T) {
	ctx := context.Background()
	s := release.NewDirStore(t.TempDir())
	_, pub := testSealKeypair(t)
	p := NewMemProvisioner("eu-west-1")
	teardownFixture(t, s, pub, p)

	if err := Teardown(ctx, s, p, nil, "bab", "titogo"); err != nil {
		t.Fatalf("teardown of an unscanned store: %v", err)
	}
}

// The sidecar goes with everything else. An orphan under a purged app's prefix
// makes the app NAME unusable: the claim gate refuses a name whose prefix still
// holds any key, and the box-side auto-purge never reaches it because the
// tombstone is written last.
func TestTeardownDeletesScanSidecar(t *testing.T) {
	ctx := context.Background()
	s := release.NewDirStore(t.TempDir())
	_, pub := testSealKeypair(t)
	p := NewMemProvisioner("eu-west-1")
	teardownFixture(t, s, pub, p)

	if _, err := PutSidecar(ctx, s, "bab", "titogo",
		&ScanSidecar{LastComplete: &Sweep{Objects: 3, Scanned: 3, Engine: "clamav"}}, ""); err != nil {
		t.Fatal(err)
	}
	if err := Teardown(ctx, s, p, NewMemScanner(), "bab", "titogo"); err != nil {
		t.Fatal(err)
	}
	if _, _, err := s.Get(ctx, ScanKey("bab", "titogo")); !errors.Is(err, os.ErrNotExist) {
		t.Fatalf("scan.json survived teardown: %v", err)
	}
}