package release

import (
	"errors"
	"os"
	"path/filepath"
	"sync"
	"testing"
)

func ptr(ch string, digest string) *ChannelPointer {
	return &ChannelPointer{App: "km", Channel: ch, Version: "v1", Digest: digest}
}

func TestRatchetArmsPerChannel(t *testing.T) {
	r := NewDigestRatchet(t.TempDir(), nil, false)
	if err := r.Admit("bab", ptr("stable", "")); err != nil {
		t.Fatalf("a fresh box refused a legacy pointer: %v", err)
	}
	if err := r.Admit("bab", ptr("stable", dA)); err != nil {
		t.Fatal(err)
	}
	if err := r.Admit("bab", ptr("stable", "")); !errors.Is(err, ErrPointerWithoutDigests) {
		t.Fatalf("after digests: %v, want ErrPointerWithoutDigests", err)
	}
	if err := r.Admit("bab", ptr("beta", "")); err != nil {
		t.Fatalf("another channel is not ratcheted: %v", err)
	}
	if err := r.Admit("cdf", ptr("stable", "")); err != nil {
		t.Fatalf("another account is not ratcheted: %v", err)
	}
}

func TestRatchetSurvivesARestart(t *testing.T) {
	dir := t.TempDir()
	if err := NewDigestRatchet(dir, nil, false).Admit("bab", ptr("stable", dA)); err != nil {
		t.Fatal(err)
	}
	if err := NewDigestRatchet(dir, nil, false).Admit("bab", ptr("stable", "")); !errors.Is(err, ErrPointerWithoutDigests) {
		t.Fatalf("a new process forgot the mark: %v", err)
	}
}

func TestRequireRefusesEveryPointerWithoutDigests(t *testing.T) {
	r := NewDigestRatchet(t.TempDir(), nil, true)
	if err := r.Admit("bab", ptr("never-seen", "")); !errors.Is(err, ErrPointerWithoutDigests) {
		t.Fatalf("require on, fresh channel: %v", err)
	}
	if err := r.Admit("bab", ptr("never-seen", dA)); err != nil {
		t.Fatal(err)
	}
}

func TestRequirePointerDigestReadsTheFlag(t *testing.T) {
	for v, want := range map[string]bool{"": false, "0": false, "off": false, "1": true, "true": true, "ON": true, "yes": true} {
		got := RequirePointerDigest(func(k string) string {
			if k == RequirePointerDigestEnv {
				return v
			}
			return ""
		})
		if got != want {
			t.Errorf("%q: %v, want %v", v, got, want)
		}
	}
}

// Review Focus 3.
func TestRatchetMarksNestedAndFlatChannels(t *testing.T) {
	r := NewDigestRatchet(t.TempDir(), nil, false)
	if err := r.Admit("bab", ptr("canary", dA)); err != nil {
		t.Fatal(err)
	}
	if err := r.Admit("bab", ptr("canary/x", "")); err != nil {
		t.Fatalf("marking canary refused canary/x: %v", err)
	}
	if err := r.Admit("bab", ptr("canary/x", dA)); err != nil {
		t.Fatalf("canary/x could not be marked beside canary: %v", err)
	}
	if err := r.Admit("bab", ptr("canary/x", "")); !errors.Is(err, ErrPointerWithoutDigests) {
		t.Fatalf("canary/x not ratcheted: %v", err)
	}
}

// Review Focus 4, Astra I1 #4: a mark that cannot be persisted fails closed.
// The pointer that carried digests is refused (nothing installs or extracts
// on it), the process remembers the channel at once, and a mark another
// process wrote is still honoured.
func TestRatchetFailsClosedWhenTheMarkCannotBePersisted(t *testing.T) {
	ro := filepath.Join(t.TempDir(), "ro")
	if err := os.MkdirAll(ro, 0o555); err != nil {
		t.Fatal(err)
	}
	if os.Geteuid() == 0 {
		t.Skip("root can write a 0555 directory")
	}
	other := t.TempDir()
	if err := NewDigestRatchet(other, nil, false).Admit("bab", ptr("stable", dA)); err != nil {
		t.Fatal(err)
	}
	r := NewDigestRatchet(ro, []string{other}, false)
	if err := r.Admit("bab", ptr("beta", dA)); !errors.Is(err, ErrRatchetUnpersisted) {
		t.Fatalf("an unpersisted mark admitted the pointer: %v", err)
	}
	if err := r.Admit("bab", ptr("beta", "")); !errors.Is(err, ErrPointerWithoutDigests) {
		t.Fatalf("the same process forgot the channel it just saw with digests: %v", err)
	}
	if err := r.Admit("bab", ptr("stable", "")); !errors.Is(err, ErrPointerWithoutDigests) {
		t.Fatalf("the other process's mark was not honoured: %v", err)
	}
}

func TestANilRatchetAdmitsEverything(t *testing.T) {
	var r *DigestRatchet
	if err := r.Admit("bab", ptr("stable", "")); err != nil {
		t.Fatal(err)
	}
}

func TestRatchetDirs(t *testing.T) {
	if RootRatchetDir("/opt/carlos") != "/opt/carlos/pointer-digests" || EdgeRatchetDir("/data") != "/data/pointer-digests" {
		t.Fatal("ratchet dirs moved")
	}
}

func TestSharedRatchetIsOnePerDirectory(t *testing.T) {
	d := t.TempDir()
	if SharedDigestRatchet(d, nil, false) != SharedDigestRatchet(d, nil, false) {
		t.Fatal("two calls for the same directory built two ratchets")
	}
}

// Astra I3 #7: lookups that widen require race with Admit's read on the one
// shared object. Run under -race; with a plain bool field the detector fails it.
func TestSharedRatchetLookupAndAdmitAreRaceFree(t *testing.T) {
	d := t.TempDir()
	legacy := &ChannelPointer{App: "km", Channel: "stable", Version: "v1"}
	var wg sync.WaitGroup
	for i := 0; i < 16; i++ {
		wg.Add(1)
		go func(i int) {
			defer wg.Done()
			for j := 0; j < 200; j++ {
				r := SharedDigestRatchet(d, nil, i%2 == 0)
				_ = r.Admit("bab", legacy)
			}
		}(i)
	}
	wg.Wait()
	if err := SharedDigestRatchet(d, nil, false).Admit("bab", legacy); !errors.Is(err, ErrPointerWithoutDigests) {
		t.Fatalf("require, widened by a lookup, was lost: %v", err)
	}
}

// Astra r1 #5: "foo" and "foo.digests/bar" are both valid channel names; with
// a suffix only on the last segment the first one's mark file is the path the
// second needs as a directory. The flat, escaped mark gives each its own file,
// in either order.
func TestRatchetMarksCollidingChannelNamesInEitherOrder(t *testing.T) {
	for _, order := range [][2]string{{"foo", "foo.digests/bar"}, {"foo.digests/bar", "foo"}} {
		if !ValidChannel(order[0]) || !ValidChannel(order[1]) {
			t.Fatalf("%q or %q is not a valid channel", order[0], order[1])
		}
		dir := t.TempDir()
		r := NewDigestRatchet(dir, nil, false)
		if err := r.Admit("bab", ptr(order[0], dA)); err != nil {
			t.Fatalf("%v: marking %q: %v", order, order[0], err)
		}
		if err := NewDigestRatchet(dir, nil, false).Admit("bab", ptr(order[1], "")); err != nil {
			t.Fatalf("%v: marking %q made %q read as marked: %v", order, order[0], order[1], err)
		}
		if err := r.Admit("bab", ptr(order[1], dA)); err != nil {
			t.Fatalf("%v: %q could not be marked beside %q: %v", order, order[1], order[0], err)
		}
		for _, ch := range order {
			if err := NewDigestRatchet(dir, nil, false).Admit("bab", ptr(ch, "")); !errors.Is(err, ErrPointerWithoutDigests) {
				t.Fatalf("%v: %q not ratcheted after a restart: %v", order, ch, err)
			}
		}
	}
}

// A mark must be a regular file: a directory where the mark belongs is not a
// mark, and not an absence either. Writing the mark over it fails, so the
// pointer with digests is refused as unpersisted rather than taking the
// directory for a durable mark.
func TestRatchetRefusesWhenTheMarkIsADirectory(t *testing.T) {
	dir := t.TempDir()
	if err := os.MkdirAll(markPath(dir, "bab", "km", "stable"), 0o755); err != nil {
		t.Fatal(err)
	}
	err := NewDigestRatchet(dir, nil, false).Admit("bab", ptr("stable", ""))
	if !errors.Is(err, ErrPointerWithoutDigests) {
		t.Fatalf("a directory at the mark path admitted a legacy pointer: %v", err)
	}
	if err := NewDigestRatchet(dir, nil, false).Admit("bab", ptr("stable", dA)); !errors.Is(err, ErrRatchetUnpersisted) {
		t.Fatalf("a directory at the mark path was taken for a durable mark: %v", err)
	}
}

func TestRatchetMarkPathIsFlatAndEscaped(t *testing.T) {
	got := markPath("/d", "bab", "km", "canary/x")
	if want := filepath.Join("/d", "bab", "km", "canary%2Fx.digests"); got != want {
		t.Fatalf("markPath = %q, want %q", got, want)
	}
}

// Astra r1 #1: a mark directory this process cannot read is not "no mark".
// A fresh ratchet (a restarted process, nothing in memory) must refuse a
// legacy pointer whether the unreadable directory is its own or another
// process's.
func TestRatchetFailsClosedWhenAMarkDirCannotBeRead(t *testing.T) {
	if os.Geteuid() == 0 {
		t.Skip("root reads a 0000 directory")
	}
	for _, which := range []string{"own", "also"} {
		t.Run(which, func(t *testing.T) {
			locked, open := t.TempDir(), t.TempDir()
			if err := NewDigestRatchet(locked, nil, false).Admit("bab", ptr("stable", dA)); err != nil {
				t.Fatal(err)
			}
			acctDir := filepath.Join(locked, "bab")
			if err := os.Chmod(acctDir, 0); err != nil {
				t.Fatal(err)
			}
			t.Cleanup(func() { _ = os.Chmod(acctDir, 0o755) })
			var r *DigestRatchet
			if which == "own" {
				r = NewDigestRatchet(locked, []string{open}, false)
			} else {
				r = NewDigestRatchet(open, []string{locked}, false)
			}
			if err := r.Admit("bab", ptr("stable", "")); !errors.Is(err, ErrPointerWithoutDigests) {
				t.Fatalf("an unreadable %s mark dir admitted a legacy pointer: %v", which, err)
			}
			// Control: with the directory readable again, the same answer
			// comes from the mark itself, and an unmarked channel elsewhere
			// is still admitted.
			if err := os.Chmod(acctDir, 0o755); err != nil {
				t.Fatal(err)
			}
			if err := NewDigestRatchet(open, nil, false).Admit("bab", ptr("stable", "")); err != nil {
				t.Fatalf("control: an empty readable dir refused a legacy pointer: %v", err)
			}
		})
	}
}