package release

import (
	"context"
	"fmt"
	"os"
	"path/filepath"
	"testing"
	"time"

	"github.com/carlosframework/platform/internal/registry"
)

func TestPlan14RootHistoryMissingManifest(t *testing.T) {
	h, _, b := rootHistoryFixture(t)
	seedRootBake(t, h, b, time.Now().UTC().Add(-time.Hour))
	st := NewDirStore(t.TempDir())
	priv, pub := testKeys(t)
	ctx := t.Context()
	opt := t.TempDir()
	reg := testRegistry(t)
	addRoute(t, reg, b.Host, b.App, "canary/x", false)
	shipRelease(t, st, b.Account, b.App, "new", adoptPlatform, []byte("new"))
	if err := Promote(ctx, st, priv, b.Account, b.App, "canary/x", "new"); err != nil {
		t.Fatal(err)
	}
	if err := StageArtifact(opt, b.Account, "new", b.App, []byte("new")); err != nil {
		t.Fatal(err)
	}
	if err := st.Delete(ctx, ManifestKey(b.Account, b.App, "new")); err != nil {
		t.Fatal(err)
	}
	deps := &RootHistoryPass{History: h, Resolve: func(context.Context, registry.Route) (HistoryBinding, string, error) { return b, "record", nil }, Installed: func(context.Context, registry.Route, string) (string, error) { return "", nil }}
	effects := 0
	if err := Pass(ctx, reg, st, pub, opt, func(string) error { effects++; return nil }, WithRootHistory(deps)); err == nil || effects != 0 {
		t.Fatalf("missing manifest: %v, effects=%d", err, effects)
	}
	if live, _ := LiveVersion(opt, b.Host); live != "" {
		t.Fatal("missing manifest changed live link")
	}
	if a, err := h.Pending(b); err != nil || a != nil {
		t.Fatalf("unprepared attempt: %+v %v", a, err)
	}
}

func TestPlan14RootHistoryPassRefusesUnknown(t *testing.T) {
	for _, state := range []string{"missing", "programs", "refusals", "pending", "sync", "binding"} {
		t.Run(state, func(t *testing.T) {
			h, disk, b := rootHistoryFixture(t)
			st := NewDirStore(t.TempDir())
			priv, pub := testKeys(t)
			opt, legacy := t.TempDir(), t.TempDir()
			reg := testRegistry(t)
			addRoute(t, reg, b.Host, b.App, "canary/x", false)
			shipRelease(t, st, b.Account, b.App, "new", adoptPlatform, []byte("new"))
			if err := Promote(context.Background(), st, priv, b.Account, b.App, "canary/x", "new"); err != nil {
				t.Fatal(err)
			}
			r, err := h.read(b)
			if err != nil {
				t.Fatal(err)
			}
			switch state {
			case "programs":
				r.Programs.Complete = false
			case "refusals":
				r.Refusals.Complete = false
			case "pending":
				r.Attempt = &HistoryAttempt{ID: "pending", Version: "new", Source: "record", Started: time.Now()}
			}
			if err := h.write(r); err != nil {
				t.Fatal(err)
			}
			if state == "missing" {
				if err := os.Remove(filepath.Join(disk.dir, historyKey(b))); err != nil {
					t.Fatal(err)
				}
			}
			if state == "sync" {
				disk.fail = 1
			}
			effects := 0
			deps := &RootHistoryPass{History: h, Installed: func(context.Context, registry.Route, string) (string, error) { return "", nil }, Resolve: func(context.Context, registry.Route) (HistoryBinding, string, error) {
				if state == "binding" {
					return b, "", os.ErrPermission
				}
				return b, "record", nil
			}}
			err = Pass(context.Background(), reg, st, pub, opt, func(string) error { effects++; return nil }, BakeDir(legacy), WithRootHistory(deps))
			if err == nil || effects != 0 {
				t.Fatalf("unknown %s: err=%v effects=%d", state, err, effects)
			}
			if v, _ := LiveVersion(opt, b.Host); v != "" {
				t.Fatalf("unknown history moved link to %s", v)
			}
		})
	}
}

func TestPlan14RootHistoryPassRetainsRefusal(t *testing.T) {
	for _, attack := range []string{"delete", "rename", "recovered", "signed-retry"} {
		t.Run(attack, func(t *testing.T) {
			h, _, b := rootHistoryFixture(t)
			seedRootBake(t, h, b, time.Now().UTC().Add(-time.Hour))
			st := NewDirStore(t.TempDir())
			priv, pub := testKeys(t)
			opt, legacy := t.TempDir(), t.TempDir()
			reg := testRegistry(t)
			addRoute(t, reg, b.Host, b.App, "canary/x", false)
			shipRelease(t, st, b.Account, b.App, "new", adoptPlatform, []byte("new"))
			at := time.Now().UTC().Truncate(time.Second)
			writeBackdatedPointer(t, st, priv, b.Account, b.App, "canary/x", "new", at)
			ref := Refusal{Host: b.Host, App: b.App, Version: "new", PointerPromotedAt: at, RefusedAt: at, Reason: "failed"}
			if err := h.AddRefusal(b, ref); err != nil {
				t.Fatal(err)
			}
			if err := WriteRefusal(legacy, ref); err != nil {
				t.Fatal(err)
			}
			switch attack {
			case "rename":
				if err := os.Rename(RefusalDir(legacy), filepath.Join(legacy, "replaced")); err != nil {
					t.Fatal(err)
				}
			case "recovered":
				ref.Recovered, ref.Version = true, "old"
				if err := WriteRefusal(legacy, ref); err != nil {
					t.Fatal(err)
				}
			case "delete", "signed-retry":
				if err := ClearRefusal(legacy, b.Host); err != nil {
					t.Fatal(err)
				}
			}
			if attack == "signed-retry" {
				if err := st.Delete(context.Background(), ChannelKey(b.Account, b.App, "canary/x")); err != nil {
					t.Fatal(err)
				}
				writeBackdatedPointer(t, st, priv, b.Account, b.App, "canary/x", "new", at.Add(time.Second))
			}
			effects := 0
			deps := &RootHistoryPass{History: h,
				Resolve:   func(context.Context, registry.Route) (HistoryBinding, string, error) { return b, "record", nil },
				Installed: func(context.Context, registry.Route, string) (string, error) { return "", nil },
			}
			err := Pass(context.Background(), reg, st, pub, opt, func(string) error {
				r, err := h.read(b)
				if err != nil || r.Attempt == nil {
					t.Fatal("restart without durable intent", err)
				}
				effects++
				return nil
			}, BakeDir(legacy), WithRootHistory(deps))
			if attack == "signed-retry" {
				if err != nil || effects != 1 {
					t.Fatalf("signed retry refused: %v, %d", err, effects)
				}
				if v, _ := LiveVersion(opt, b.Host); v != "new" {
					t.Fatal("retry did not adopt")
				}
			} else if effects != 0 {
				t.Fatalf("%s retried failed promotion", attack)
			}
			refs, readErr := h.Refusals(b)
			want := 1
			if attack == "signed-retry" {
				want = 0
			}
			if readErr != nil || len(refs) != want {
				t.Fatalf("lost retained refusal: %v, %v", refs, readErr)
			}
		})
	}
}

func TestPlan14RootHistoryPassRejectsProgramForgery(t *testing.T) {
	good, bad := tinyProgram(t, "old/program"), tinyProgram(t, "foreign/program")
	for _, attack := range []string{"foreign-history", "empty-root", "same-program", "failed-observation", "changed-binding"} {
		t.Run(attack, func(t *testing.T) {
			h, _, b := rootHistoryFixture(t)
			seedRootBake(t, h, b, time.Now().UTC().Add(-time.Hour))
			st := NewDirStore(t.TempDir())
			priv, pub := testKeys(t)
			opt, legacy := t.TempDir(), t.TempDir()
			reg := testRegistry(t)
			addRoute(t, reg, b.Host, b.App, "canary/x", false)
			if err := StageArtifact(opt, b.Account, "old", b.App, good); err != nil {
				t.Fatal(err)
			}
			if err := PointLive(opt, b.Host, b.Account, "old", b.App); err != nil {
				t.Fatal(err)
			}
			binary := bad
			if attack == "same-program" || attack == "failed-observation" || attack == "changed-binding" {
				binary = good
			}
			shipRelease(t, st, b.Account, b.App, "new", adoptPlatform, binary)
			if err := Promote(context.Background(), st, priv, b.Account, b.App, "canary/x", "new"); err != nil {
				t.Fatal(err)
			}
			if err := RecordProgram(legacy, b.Host, "foreign/program"); err != nil {
				t.Fatal(err)
			}
			if attack == "empty-root" {
				r, err := h.read(b)
				if err != nil {
					t.Fatal(err)
				}
				r.Programs.Values = nil
				if err := h.write(r); err != nil {
					t.Fatal(err)
				}
			}
			reads, effects := 0, 0
			deps := &RootHistoryPass{History: h,
				Resolve: func(context.Context, registry.Route) (HistoryBinding, string, error) {
					reads++
					if attack == "changed-binding" && reads >= 3 {
						return b, "changed-record", nil
					}
					return b, "record", nil
				},
				Installed: func(context.Context, registry.Route, string) (string, error) {
					if attack == "failed-observation" {
						return "", os.ErrPermission
					}
					return "old/program", nil
				},
			}
			err := Pass(context.Background(), reg, st, pub, opt, func(string) error { effects++; return nil }, BakeDir(legacy), WithRootHistory(deps))
			v, _ := LiveVersion(opt, b.Host)
			switch attack {
			case "same-program":
				if err != nil || v != "new" || effects != 1 {
					t.Fatalf("valid adoption failed: %s %d %v", v, effects, err)
				}
			case "failed-observation":
				if err == nil {
					t.Fatal("unobserved install reported success")
				}
				if _, err := h.Refusals(b); err == nil {
					t.Fatal("unverified attempt settled")
				}
			default:
				if v != "old" || effects != 0 {
					t.Fatalf("%s adopted: %s %d %v", attack, v, effects, err)
				}
			}
		})
	}
}

func TestPlan14RootHistoryProgramChangeNeedsSignedManifest(t *testing.T) {
	binary := tinyProgram(t, "foreign/program")
	for _, signed := range []bool{false, true} {
		t.Run(fmt.Sprint(signed), func(t *testing.T) {
			h, _, b := rootHistoryFixture(t)
			seedRootBake(t, h, b, time.Now().UTC().Add(-time.Hour))
			st := NewDirStore(t.TempDir())
			priv, pub := testKeys(t)
			ctx := context.Background()
			opt, legacy := t.TempDir(), t.TempDir()
			reg := testRegistry(t)
			addRoute(t, reg, b.Host, b.App, "canary/x", false)
			m := Manifest{App: b.App, Version: "new", Kind: "binary", ProgramChange: true, Artifacts: map[string]Artifact{adoptPlatform: {}}}
			if err := Ship(ctx, st, b.Account, m, map[string][]byte{adoptPlatform: binary}); err != nil {
				t.Fatal(err)
			}
			if signed {
				if err := WriteDigestMarker(ctx, st, RootSigner(priv), b.Account, "test"); err != nil {
					t.Fatal(err)
				}
			}
			if err := Promote(ctx, st, priv, b.Account, b.App, "canary/x", "new"); err != nil {
				t.Fatal(err)
			}
			deps := &RootHistoryPass{History: h, Resolve: func(context.Context, registry.Route) (HistoryBinding, string, error) { return b, "record", nil }, Installed: func(context.Context, registry.Route, string) (string, error) { return "foreign/program", nil }}
			effects := 0
			err := Pass(ctx, reg, st, pub, opt, func(string) error { effects++; return nil }, BakeDir(legacy), WithRootHistory(deps))
			if signed && (err != nil || effects != 1) {
				t.Fatalf("signed consent refused: %v %d", err, effects)
			}
			if !signed && effects != 0 {
				t.Fatal("unsigned manifest field granted program change")
			}
		})
	}
}

func TestPlan14RootHistoryPassRetainsBake(t *testing.T) {
	for _, elapsed := range []bool{false, true} {
		t.Run(fmt.Sprint(elapsed), func(t *testing.T) {
			h, _, b := rootHistoryFixture(t)
			start := time.Now().UTC().Add(-time.Minute)
			if elapsed {
				start = start.Add(-121 * time.Hour)
			}
			seedRootBake(t, h, b, start)
			clock, err := h.LoadBake([]HistoryBinding{b}, start)
			if err != nil {
				t.Fatal(err)
			}
			clock.Observe(b.Account, b.App, "stable", "new", start)
			clock.Production = map[string]*prodMemory{prodKey(b.Account, b.App): {WasProduction: true}}
			clock.Holds = map[string]*holdMemory{channelClockKey(b.Account, b.App, "stable"): {Window: 96 * time.Hour, SetAt: start}}
			if err := clock.Save(); err != nil {
				t.Fatal(err)
			}
			st := NewDirStore(t.TempDir())
			priv, pub := testKeys(t)
			opt, legacy := t.TempDir(), t.TempDir()
			reg := testRegistry(t)
			addRoute(t, reg, b.Host, b.App, "stable", false)
			shipRelease(t, st, b.Account, b.App, "new", adoptPlatform, []byte("new"))
			writeBackdatedPointer(t, st, priv, b.Account, b.App, "stable", "new", start)
			forged := LoadFirstSeen(FirstSeenPath(legacy))
			forged.Observe(b.Account, b.App, "stable", "new", start.Add(-1000*time.Hour))
			if err := forged.Save(); err != nil {
				t.Fatal(err)
			}
			deps := &RootHistoryPass{History: h, Resolve: func(context.Context, registry.Route) (HistoryBinding, string, error) { return b, "record", nil }, Installed: func(context.Context, registry.Route, string) (string, error) { return "", nil }}
			effects := 0
			err = Pass(context.Background(), reg, st, pub, opt, func(string) error { effects++; return nil }, BakeDir(legacy), WithRootHistory(deps))
			if err != nil {
				t.Fatal(err)
			}
			if elapsed && effects != 1 {
				t.Fatal("root-observed interval never admitted adoption")
			}
			if !elapsed && effects != 0 {
				t.Fatal("legacy clock shortened root hold")
			}
		})
	}
}