package release

import (
	"bytes"
	"github.com/carlosframework/platform/internal/rootstate"
	"os"
	"strings"
	"testing"
	"time"
)

func TestPlan14HistoryRetainsRecoveryOutcomes(t *testing.T) {
	for _, state := range []string{"failed", "pending", "ambiguous", "verified"} {
		t.Run(state, func(t *testing.T) {
			h, s, b := rootHistoryFixture(t)
			outcome := HistoryRecovery{Binding: b, Attempt: HistoryAttempt{ID: "attempt-one", Version: "v2", Source: "canonical", SHA256: "digest", Platform: AdoptPlatform(), Started: time.Now().UTC(), PromotedAt: time.Now().UTC()}, Settled: state != "pending", Failed: state == "failed", Verified: state == "verified"}
			if err := h.RetainRecovery(outcome); err != nil {
				t.Fatal(err)
			}
			h = &RootHistory{Store: s}
			refs, err := h.Refusals(b)
			switch state {
			case "pending", "ambiguous":
				if err == nil {
					t.Fatal("ambiguous outcome granted permission")
				}
			case "failed":
				if err != nil || len(refs) != 1 || refs[0].SHA256 != "digest" {
					t.Fatalf("failed digest lost: %+v %v", refs, err)
				}
			case "verified":
				if err != nil || len(refs) != 0 {
					t.Fatalf("verified outcome: %+v %v", refs, err)
				}
			}
			view, err := h.MigrationStatus(b, func(HistoryBinding) (string, error) { return "canonical", nil })
			if err != nil || len(view.Hosts) != 1 || len(view.Hosts[0].Recoveries) != 1 {
				t.Fatalf("outcome not projected: %+v %v", view, err)
			}
			later := outcome
			later.Attempt.ID = "attempt-two"
			later.Settled, later.Verified, later.Failed = true, true, false
			if err := h.RetainRecovery(later); err != nil {
				t.Fatal(err)
			}
			refs, err = h.Refusals(b)
			if (state == "pending" || state == "ambiguous") && err == nil {
				t.Fatal("later success erased ambiguity")
			}
			if state == "failed" && (err != nil || len(refs) != 1) {
				t.Fatal("later success erased failed digest")
			}
		})
	}
}

func TestPlan14HistoryRecoveryCannotWeaken(t *testing.T) {
	h, s, b := rootHistoryFixture(t)
	outcome := HistoryRecovery{Binding: b, Attempt: HistoryAttempt{ID: "attempt", Version: "v2", Source: "canonical", SHA256: "digest", Platform: AdoptPlatform(), Started: time.Now().UTC(), PromotedAt: time.Now().UTC()}, Settled: true, Failed: true}
	if err := h.RetainRecovery(outcome); err != nil {
		t.Fatal(err)
	}
	outcome.Failed, outcome.Verified = false, true
	if err := h.RetainRecovery(outcome); err != nil {
		t.Fatal(err)
	}
	if refs, err := h.Refusals(b); err != nil || len(refs) != 1 {
		t.Fatalf("replay erased denial: %+v %v", refs, err)
	}
	outcome.Attempt.SHA256 = "another"
	if err := h.RetainRecovery(outcome); err == nil {
		t.Fatal("identity reused for different bytes")
	}
	s.fail = 1
	if _, err := h.Refusals(b); err == nil {
		t.Fatal("failed sync granted history")
	}
	s.fail = 0
	if refs, err := h.Refusals(b); err != nil || len(refs) != 1 {
		t.Fatalf("retry lost denial: %+v %v", refs, err)
	}
	if err := s.Write(historyRecoveryKey(outcome), []byte("{")); err != nil {
		t.Fatal(err)
	}
	if _, err := h.Refusals(b); err == nil {
		t.Fatal("malformed outcome granted history")
	}
}

func TestPlan14HistoryReconstructionKeepsRecovery(t *testing.T) {
	for _, state := range []string{"failed", "ambiguous"} {
		t.Run(state, func(t *testing.T) {
			h, _, b, pub, wire, now := reconstructionCrashFixture(t)
			outcome := HistoryRecovery{Binding: b, Attempt: HistoryAttempt{ID: "recovery", Version: "failed-version", Source: "canonical", SHA256: "failed-digest", Platform: AdoptPlatform(), Started: now, PromotedAt: now}, Settled: true, Failed: state == "failed"}
			if err := h.RetainRecovery(outcome); err != nil {
				t.Fatal(err)
			}
			if err := h.Reconstruct(pub, wire, b.Account, b.App, now, func(HistoryBinding) (string, error) { return "canonical", nil }); err != nil {
				t.Fatal(err)
			}
			refs, err := h.Refusals(b)
			if state == "ambiguous" {
				if err == nil {
					t.Fatal("reconstruction cleared ambiguous recovery")
				}
				return
			}
			if err != nil {
				t.Fatal(err)
			}
			found := false
			for _, ref := range refs {
				found = found || ref.SHA256 == "failed-digest"
			}
			if !found {
				t.Fatal("reconstruction erased failed digest")
			}
		})
	}
}

type outcomeSyncStore struct {
	rootstate.Store
	fail bool
}

func (s *outcomeSyncStore) Write(name string, raw []byte) error {
	if err := s.Store.Write(name, raw); err != nil {
		return err
	}
	if s.fail && strings.HasSuffix(name, ".outcome") {
		return os.ErrPermission
	}
	return nil
}
func TestPlan14HistoryRecoveryVisibleSync(t *testing.T) {
	h, s, b := rootHistoryFixture(t)
	fault := &outcomeSyncStore{Store: s, fail: true}
	h.Store = fault
	now := time.Now().UTC()
	r := HistoryRecovery{Binding: b, Attempt: HistoryAttempt{ID: "attempt", Source: "canonical", Version: "v2", SHA256: "digest", Platform: AdoptPlatform(), Started: now, PromotedAt: now}, Settled: true, Verified: true}
	if err := h.RetainRecovery(r); err == nil {
		t.Fatal("visible unsynced outcome reported durable")
	}
	raw, err := s.Read(historyRecoveryKey(r))
	if err != nil {
		t.Fatal(err)
	}
	if _, err := h.Refusals(b); err == nil {
		t.Fatal("visible unsynced outcome granted permission")
	}
	fault.fail = false
	if refs, err := h.Refusals(b); err != nil || len(refs) != 0 {
		t.Fatalf("durable retry: %+v %v", refs, err)
	}
	after, err := s.Read(historyRecoveryKey(r))
	if err != nil || !bytes.Equal(raw, after) {
		t.Fatal("retry changed evidence", err)
	}
}