package release

import (
	"context"
	"crypto/ed25519"
	"errors"
	"os"
	"path/filepath"
	"strings"
	"testing"

	"github.com/carlosframework/platform/internal/registry"
)

func heldAuthRoute(host string) registry.Route {
	return registry.Route{Host: host, Account: "bab", App: "km", HoldOp: "op-1"}
}

// nr is a fresh, unarmed ratchet: today's admission.
func nr(t *testing.T) *DigestRatchet { return NewDigestRatchet(t.TempDir(), nil, false) }

// Astra I1 #2: a pointer the box's ratchet refuses is not held-stage evidence.
func TestHeldStageAppliesTheDigestRatchet(t *testing.T) {
	s := NewDirStore(t.TempDir())
	ctx := context.Background()
	priv, pub := testKeys(t)
	opt := t.TempDir()
	shipRelease(t, s, "bab", "km", "v1", adoptPlatform, []byte("v1"))
	if err := Promote(ctx, s, priv, "bab", "km", "canary/x", "v1"); err != nil { // a legacy, digestless pointer
		t.Fatal(err)
	}
	if err := s.Delete(ctx, PromotionRecordKey("bab", "km", "v1")); err != nil { // so the pointer is the only evidence
		t.Fatal(err)
	}
	armed := NewDigestRatchet(t.TempDir(), nil, false)
	if err := armed.Admit("bab", &ChannelPointer{App: "km", Channel: "canary/x", Version: "v0", Digest: ManifestDigest([]byte("m"))}); err != nil {
		t.Fatal(err) // this box has seen canary/x with digests
	}
	if _, err := StageHeld(ctx, s, pub, armed, opt, heldAuthRoute("a.example.com"), "v1"); !errors.Is(err, ErrHeldNotAuthorized) {
		t.Fatalf("a ratcheted channel's legacy pointer authorized a held stage: %v", err)
	}
	required := NewDigestRatchet(t.TempDir(), nil, true)
	if _, err := StageHeld(ctx, s, pub, required, opt, heldAuthRoute("a.example.com"), "v1"); !errors.Is(err, ErrHeldNotAuthorized) {
		t.Fatalf("CARLOS_REQUIRE_POINTER_DIGEST did not apply to a held stage: %v", err)
	}
	if _, err := StageHeld(ctx, s, pub, nil, opt, heldAuthRoute("a.example.com"), "v1"); !errors.Is(err, ErrHeldNotAuthorized) {
		t.Fatalf("a nil ratchet admitted pointer evidence: %v", err)
	}
}

func TestHeldStageRefusesABuildNothingAuthorizes(t *testing.T) {
	s := NewDirStore(t.TempDir())
	ctx := context.Background()
	_, pub := testKeys(t)
	opt := t.TempDir()
	shipRelease(t, s, "bab", "km", "v1", adoptPlatform, []byte("shipped, never promoted"))
	if _, err := StageHeld(ctx, s, pub, nr(t), opt, heldAuthRoute("a.example.com"), "v1"); !errors.Is(err, ErrHeldNotAuthorized) {
		t.Fatalf("StageHeld = %v; want ErrHeldNotAuthorized", err)
	}
	if _, err := os.Stat(VersionPath(opt, "bab", "v1", "km")); err == nil {
		t.Fatal("an unauthorized build was staged")
	}
}

func TestHeldStageAcceptsARecordedBuildOutOfHistory(t *testing.T) {
	s := NewDirStore(t.TempDir())
	ctx := context.Background()
	priv, pub := testKeys(t)
	opt := t.TempDir()
	for i := 0; i < historyMax+2; i++ {
		v := "v" + string(rune('a'+i))
		shipRelease(t, s, "bab", "km", v, adoptPlatform, []byte(v))
		if err := Promote(ctx, s, priv, "bab", "km", "canary/x", v); err != nil {
			t.Fatal(err)
		}
	}
	if _, err := StageHeld(ctx, s, pub, nr(t), opt, heldAuthRoute("a.example.com"), "va"); err != nil {
		t.Fatalf("a recorded build out of the pointer's history: %v", err)
	}
}

func TestHeldStageAcceptsAPointerNamedBuildWithoutARecord(t *testing.T) {
	s := NewDirStore(t.TempDir())
	ctx := context.Background()
	priv, pub := testKeys(t)
	opt := t.TempDir()
	shipRelease(t, s, "bab", "km", "v1", adoptPlatform, []byte("v1"))
	if err := Promote(ctx, s, priv, "bab", "km", "canary/x", "v1"); err != nil {
		t.Fatal(err)
	}
	if err := s.Delete(ctx, PromotionRecordKey("bab", "km", "v1")); err != nil { // promoted before records
		t.Fatal(err)
	}
	if _, err := StageHeld(ctx, s, pub, nr(t), opt, heldAuthRoute("a.example.com"), "v1"); err != nil {
		t.Fatalf("a build the signed pointer names: %v", err)
	}
}

func TestHeldStageBindsTheRecordDigest(t *testing.T) {
	s := NewDirStore(t.TempDir())
	ctx := context.Background()
	priv, pub := testKeys(t)
	opt := t.TempDir()
	shipRelease(t, s, "bab", "km", "v1", adoptPlatform, []byte("promoted"))
	if err := Promote(ctx, s, priv, "bab", "km", "canary/x", "v1"); err != nil {
		t.Fatal(err)
	}
	saved, _, _ := s.Get(ctx, PromotionRecordKey("bab", "km", "v1"))
	for i := 0; i <= historyMax; i++ { // push v1 out of the pointer, so the record is the only evidence
		v := "w" + string(rune('a'+i))
		shipRelease(t, s, "bab", "km", v, adoptPlatform, []byte(v))
		if err := Promote(ctx, s, priv, "bab", "km", "canary/x", v); err != nil {
			t.Fatal(err)
		}
	}
	if err := DeleteVersion(ctx, s, "bab", "km", "v1"); err != nil {
		t.Fatal(err)
	}
	shipRelease(t, s, "bab", "km", "v1", adoptPlatform, []byte("nobody promoted these"))
	if _, err := s.Put(ctx, PromotionRecordKey("bab", "km", "v1"), saved, ""); err != nil {
		t.Fatal(err)
	}
	if _, err := StageHeld(ctx, s, pub, nr(t), opt, heldAuthRoute("a.example.com"), "v1"); !errors.Is(err, ErrManifestDigest) {
		t.Fatalf("a reused name under a replayed record = %v; want ErrManifestDigest", err)
	}
	if _, err := os.Stat(VersionPath(opt, "bab", "v1", "km")); err == nil {
		t.Fatal("the reused name's bytes were staged")
	}
}

// Under a promotion record the held stage binds the record's digest (spec
// §4.6): a copy staged while the canonical manifest cannot be read is
// refused at staging, never published and never overwritten, where pointer
// trust would have used it as staged and left it to D3's bind.
func TestHeldStageRecordRefusesAStaleCopyItCannotCheck(t *testing.T) {
	ctx, s, opt := heldFixture(t)
	stale := []byte("not the shipped bytes")
	down := stageStaleCopyKept(t, ctx, s, opt, "bab", "console", "v1", stale)
	_, err := MaterializeHeld(ctx, down, heldPub, nr(t), opt, heldRoute(), "v1", offGate(t), openGuard)
	if err == nil || errors.Is(err, ErrStageBlocked) {
		t.Fatalf("MaterializeHeld = %v; want the record-bound stage to refuse the copy", err)
	}
	gone(t, LiveLink(opt, heldTestHost))
	if b, rerr := os.ReadFile(VersionPath(opt, "bab", "v1", "console")); rerr != nil || string(b) != string(stale) {
		t.Fatalf("staged v1 = %q, %v; want it untouched", b, rerr)
	}
}

// §4.1 refusals are final: the root relay removes a request for a build
// nothing authorizes, or whose manifest does not hash to the digest its
// record signs, writes no ack and never repoints live/<host>.
func TestServeHeldStageRequestsDropsUnauthorizedBuilds(t *testing.T) {
	for name, setup := range map[string]func(t *testing.T, ctx context.Context, s Store) string{
		"nothing authorizes it": func(t *testing.T, _ context.Context, s Store) string {
			shipRelease(t, s, "bab", "console", "v3", adoptPlatform, []byte("shipped, never promoted"))
			return "v3"
		},
		"its manifest is not the recorded one": func(t *testing.T, ctx context.Context, s Store) string {
			raw, etag, err := s.Get(ctx, ManifestKey("bab", "console", "v1"))
			if err != nil {
				t.Fatal(err)
			}
			if _, err := s.Put(ctx, ManifestKey("bab", "console", "v1"), append(raw, '\n'), etag); err != nil {
				t.Fatal(err)
			}
			return "v1"
		},
	} {
		t.Run(name, func(t *testing.T) {
			ctx, s, opt := heldFixture(t)
			req := goodHeldRequest()
			req.Version = setup(t, ctx, s)
			dd := t.TempDir()
			path := writeHeldRequest(t, dd, req.Host+".json", req)
			if err := ServeHeldStageRequests(ctx, s, heldPub, nr(t), opt, dd, offGate(t), passAuth(nil)); err != nil {
				t.Fatal(err)
			}
			gone(t, path)
			gone(t, LiveLink(opt, heldTestHost))
			gone(t, filepath.Join(HeldStagedDir(dd), heldTestHost+".json"))
			if _, err := os.Stat(VersionPath(opt, "bab", req.Version, "console")); err == nil {
				t.Fatalf("%s was staged", req.Version)
			}
		})
	}
}

// pointerOnly ships v1 of bab/km, promotes it to each channel in turn (a
// channel listed in digested is promoted after the digest marker is written,
// so its pointer signs v1's digest), and deletes v1's promotion record, so
// the pointers are the only evidence.
func pointerOnly(t *testing.T, s Store, priv ed25519.PrivateKey, legacy, digested []string) {
	t.Helper()
	ctx := context.Background()
	shipRelease(t, s, "bab", "km", "v1", adoptPlatform, []byte("v1"))
	for _, c := range legacy {
		if err := Promote(ctx, s, priv, "bab", "km", c, "v1"); err != nil {
			t.Fatal(err)
		}
	}
	if len(digested) > 0 {
		if err := WriteDigestMarker(ctx, s, RootSigner(priv), "bab", "test"); err != nil {
			t.Fatal(err)
		}
	}
	for _, c := range digested {
		if err := Promote(ctx, s, priv, "bab", "km", c, "v1"); err != nil {
			t.Fatal(err)
		}
	}
	if err := s.Delete(ctx, PromotionRecordKey("bab", "km", "v1")); err != nil {
		t.Fatal(err)
	}
}

// Fix round 1, I1: a held stage that cannot read the pointer that may name
// its build cannot tell, so it is not ErrHeldNotAuthorized (a final refusal)
// but an error the root relay keeps the request for.
func TestHeldStageRetriesAPointerItCannotRead(t *testing.T) {
	base := NewDirStore(t.TempDir())
	ctx := context.Background()
	priv, pub := testKeys(t)
	opt := t.TempDir()
	pointerOnly(t, base, priv, []string{"canary/x"}, nil)
	s := failingGetStore{Store: base, key: ChannelKey("bab", "km", "canary/x")}
	_, err := StageHeld(ctx, s, pub, nr(t), opt, heldAuthRoute("a.example.com"), "v1")
	if err == nil || errors.Is(err, ErrHeldNotAuthorized) || !errors.Is(err, errTransient) {
		t.Fatalf("StageHeld over an unreadable pointer = %v; want the read error, not ErrHeldNotAuthorized", err)
	}
	if _, err := os.Stat(VersionPath(opt, "bab", "v1", "km")); err == nil {
		t.Fatal("a build nothing could vouch for was staged")
	}
}

// The root relay keeps a request whose authority it could not read.
func TestServeHeldStageRequestsKeepsARequestItCannotAuthorizeYet(t *testing.T) {
	ctx, base, opt := heldFixture(t)
	if err := base.Delete(ctx, PromotionRecordKey("bab", "console", "v1")); err != nil {
		t.Fatal(err) // canary/x's pointer is v1's only evidence
	}
	s := failingGetStore{Store: base, key: ChannelKey("bab", "console", "canary/x")}
	req := goodHeldRequest()
	dd := t.TempDir()
	path := writeHeldRequest(t, dd, req.Host+".json", req)
	if err := ServeHeldStageRequests(ctx, s, heldPub, nr(t), opt, dd, offGate(t), passAuth(nil)); err != nil {
		t.Fatal(err)
	}
	if _, err := os.Stat(path); err != nil {
		t.Fatalf("the request was dropped on a transient read error: %v", err)
	}
	gone(t, LiveLink(opt, heldTestHost))
	gone(t, filepath.Join(HeldStagedDir(dd), heldTestHost+".json"))
}

// A ratchet that cannot tell (it could not persist the mark for a pointer
// with digests, or could not read the mark for one without) is retried, not
// taken for a refusal.
func TestHeldStageRetriesARatchetThatCannotTell(t *testing.T) {
	t.Run("the mark could not be persisted", func(t *testing.T) {
		if os.Geteuid() == 0 {
			t.Skip("root can write a 0555 directory")
		}
		s := NewDirStore(t.TempDir())
		priv, pub := testKeys(t)
		pointerOnly(t, s, priv, nil, []string{"canary/x"})
		ro := filepath.Join(t.TempDir(), "ro")
		if err := os.MkdirAll(ro, 0o555); err != nil {
			t.Fatal(err)
		}
		_, err := HeldAuthorized(context.Background(), s, pub, NewDigestRatchet(ro, nil, false), "bab", "km", "v1")
		if errors.Is(err, ErrHeldNotAuthorized) || !errors.Is(err, ErrRatchetUnpersisted) {
			t.Fatalf("HeldAuthorized = %v; want ErrRatchetUnpersisted, not ErrHeldNotAuthorized", err)
		}
	})
	t.Run("the mark could not be read", func(t *testing.T) {
		s := NewDirStore(t.TempDir())
		priv, pub := testKeys(t)
		pointerOnly(t, s, priv, []string{"canary/x"}, nil)
		dir := t.TempDir()
		if err := os.MkdirAll(markPath(dir, "bab", "km", "canary/x"), 0o755); err != nil {
			t.Fatal(err) // a directory where the mark belongs: Admit cannot tell
		}
		_, err := HeldAuthorized(context.Background(), s, pub, NewDigestRatchet(dir, nil, false), "bab", "km", "v1")
		if err == nil || errors.Is(err, ErrHeldNotAuthorized) {
			t.Fatalf("HeldAuthorized = %v; want a retryable error, not ErrHeldNotAuthorized", err)
		}
	})
}

// Among pointers that name the build, the one that signs its digest wins,
// whichever channel lists first: binding to "" when a signed digest exists
// would throw away the stronger evidence.
func TestHeldAuthorizedPrefersASignedDigest(t *testing.T) {
	for name, chans := range map[string][2][]string{
		"the digestless channel lists first": {{"a"}, {"b"}},
		"the digested channel lists first":   {{"b"}, {"a"}},
	} {
		t.Run(name, func(t *testing.T) {
			s := NewDirStore(t.TempDir())
			ctx := context.Background()
			priv, pub := testKeys(t)
			pointerOnly(t, s, priv, chans[0], chans[1])
			raw, _, err := s.Get(ctx, ManifestKey("bab", "km", "v1"))
			if err != nil {
				t.Fatal(err)
			}
			want, err := HeldAuthorized(ctx, s, pub, nr(t), "bab", "km", "v1")
			if err != nil || want != ManifestDigest(raw) {
				t.Fatalf("HeldAuthorized = %q, %v; want the signed digest %q", want, err, ManifestDigest(raw))
			}
		})
	}
}

// Every verified pointer a held stage reads goes through the ratchet (spec
// §4.6, "once verified"; ruling R15): one that does not name the build is not
// evidence, but its digests still mark its channel. Its ratchet outcome never
// changes the answer, so a mark that cannot be written does not hold up a
// build another pointer authorizes.
func TestHeldAuthorizedAdmitsOnlyNamingPointers(t *testing.T) {
	s := NewDirStore(t.TempDir())
	ctx := context.Background()
	priv, pub := testKeys(t)
	shipRelease(t, s, "bab", "km", "v0", adoptPlatform, []byte("v0"))
	pointerOnly(t, s, priv, []string{"b"}, nil)
	if err := WriteDigestMarker(ctx, s, RootSigner(priv), "bab", "test"); err != nil {
		t.Fatal(err)
	}
	if err := Promote(ctx, s, priv, "bab", "km", "a", "v0"); err != nil {
		t.Fatal(err) // channel a carries digests and does not name v1
	}
	dir := t.TempDir()
	if want, err := HeldAuthorized(ctx, s, pub, NewDigestRatchet(dir, nil, false), "bab", "km", "v1"); err != nil || want != "" {
		t.Fatalf("HeldAuthorized = %q, %v; want channel b's pointer trust", want, err)
	}
	if _, err := os.Stat(markPath(dir, "bab", "km", "a")); err != nil {
		t.Fatalf("channel a's verified digests left no mark: %v", err)
	}
	if os.Geteuid() != 0 {
		ro := filepath.Join(t.TempDir(), "ro")
		if err := os.MkdirAll(ro, 0o555); err != nil {
			t.Fatal(err)
		}
		if want, err := HeldAuthorized(ctx, s, pub, NewDigestRatchet(ro, nil, false), "bab", "km", "v1"); err != nil || want != "" {
			t.Fatalf("HeldAuthorized with channel a's mark unwritable = %q, %v; want channel b's pointer trust", want, err)
		}
	}
}

// heldNothingDownloaded fails the test if the held stage read any of
// version's release objects or left anything in the version store.
func heldNothingDownloaded(t *testing.T, rec *heldRecordingStore, opt, version string) {
	t.Helper()
	rel := ReleasesPrefix("bab", "km") + version + "/"
	rec.mu.Lock()
	defer rec.mu.Unlock()
	for _, c := range rec.calls {
		if strings.HasPrefix(c, "get "+rel) {
			t.Fatalf("the held stage downloaded %s", strings.TrimPrefix(c, "get "))
		}
	}
	if _, err := os.Stat(VersionPath(opt, "bab", version, "km")); err == nil {
		t.Fatalf("%s was staged", version)
	}
}

// heldSubstitute replaces version's shipped bytes under the same name.
func heldSubstitute(t *testing.T, s Store, version string) {
	t.Helper()
	if err := DeleteVersion(context.Background(), s, "bab", "km", version); err != nil {
		t.Fatal(err)
	}
	shipRelease(t, s, "bab", "km", version, adoptPlatform, []byte("nobody promoted these"))
}

// Astra final A1, ruling R16: a pointer whose head signs a digest, naming a
// legacy history entry that signs none, is no evidence for that entry ("never
// a rollback target once its channel has any digest", spec §4.6). With no
// record, its replaced bytes are refused with the flag off and on, and
// nothing is downloaded.
func TestHeldStageRefusesADigestlessEntryOnADigestedChannel(t *testing.T) {
	for name, require := range map[string]bool{"flag off": false, "flag on": true} {
		t.Run(name, func(t *testing.T) {
			s := NewDirStore(t.TempDir())
			ctx := context.Background()
			priv, pub := testKeys(t)
			opt := t.TempDir()
			pointerOnly(t, s, priv, []string{"canary/x"}, nil) // v1, digestless
			if err := WriteDigestMarker(ctx, s, RootSigner(priv), "bab", "test"); err != nil {
				t.Fatal(err)
			}
			shipRelease(t, s, "bab", "km", "v2", adoptPlatform, []byte("v2"))
			if err := Promote(ctx, s, priv, "bab", "km", "canary/x", "v2"); err != nil {
				t.Fatal(err)
			}
			p, err := Channel(ctx, s, pub, "bab", "km", "canary/x")
			if err != nil {
				t.Fatal(err)
			}
			if p.Version != "v2" || p.Digest == "" || len(p.History) != 1 || p.History[0] != "v1" || p.DigestOf("v1") != "" {
				t.Fatalf("pointer = %+v; want a digested head v2 over a digestless history v1", p)
			}
			heldSubstitute(t, s, "v1")
			rec := &heldRecordingStore{Store: s}
			if _, err := StageHeld(ctx, rec, pub, NewDigestRatchet(t.TempDir(), nil, require), opt, heldAuthRoute("a.example.com"), "v1"); !errors.Is(err, ErrHeldNotAuthorized) {
				t.Fatalf("StageHeld of a digestless entry on a digested channel = %v; want ErrHeldNotAuthorized", err)
			}
			heldNothingDownloaded(t, rec, opt, "v1")
		})
	}
}

// Astra final A2, ruling R15: a held stage remembers every verified pointer
// with digests it reads, naming the build or not. Pass 1 stages v1 on channel
// b's word while channel a's pointer signs digests for v2; pass 2, on the
// same ratchet, is a saved digestless pointer of channel a replayed over
// substituted v2 bytes, and is refused.
func TestHeldStageRemembersEveryVerifiedPointer(t *testing.T) {
	s := NewDirStore(t.TempDir())
	ctx := context.Background()
	priv, pub := testKeys(t)
	opt := t.TempDir()
	shipRelease(t, s, "bab", "km", "v1", adoptPlatform, []byte("v1"))
	shipRelease(t, s, "bab", "km", "v2", adoptPlatform, []byte("v2"))
	_, v2raw, err := GetManifestRaw(ctx, s, "bab", "km", "v2")
	if err != nil {
		t.Fatal(err)
	}
	sign := func(p *ChannelPointer) []byte {
		t.Helper()
		w, err := signPointer(RootSigner(priv), p)
		if err != nil {
			t.Fatal(err)
		}
		return w
	}
	saved := sign(&ChannelPointer{Account: "bab", App: "km", Channel: "a", Version: "v2"}) // signed before digests
	put := func(channel string, w []byte) {
		t.Helper()
		_, etag, err := s.Get(ctx, ChannelKey("bab", "km", channel))
		if err != nil && !errors.Is(err, os.ErrNotExist) {
			t.Fatal(err)
		}
		if _, err := s.Put(ctx, ChannelKey("bab", "km", channel), w, etag); err != nil {
			t.Fatal(err)
		}
	}
	put("a", sign(&ChannelPointer{Account: "bab", App: "km", Channel: "a", Version: "v2", Digest: ManifestDigest(v2raw)}))
	put("b", sign(&ChannelPointer{Account: "bab", App: "km", Channel: "b", Version: "v1"}))
	ratchet := NewDigestRatchet(t.TempDir(), nil, false)
	if _, err := StageHeld(ctx, s, pub, ratchet, opt, heldAuthRoute("a.example.com"), "v1"); err != nil {
		t.Fatalf("pass 1, v1 on channel b's word: %v", err)
	}
	put("a", saved)
	heldSubstitute(t, s, "v2")
	rec := &heldRecordingStore{Store: s}
	if _, err := StageHeld(ctx, rec, pub, ratchet, opt, heldAuthRoute("a.example.com"), "v2"); !errors.Is(err, ErrHeldNotAuthorized) {
		t.Fatalf("pass 2, a replayed digestless pointer over substituted v2 = %v; want ErrHeldNotAuthorized", err)
	}
	heldNothingDownloaded(t, rec, opt, "v2")
}