package release

import (
	"context"
	"errors"
	"fmt"
	"os"
	"path/filepath"
	"strings"
	"testing"
	"time"
)

func TestPutIfNoneMatchConflict(t *testing.T) {
	s := NewDirStore(t.TempDir())
	ctx := context.Background()
	if _, err := s.Put(ctx, "a/b.json", []byte("one"), ""); err != nil {
		t.Fatalf("create: %v", err)
	}
	// A second create-only Put of an existing key must lose.
	if _, err := s.Put(ctx, "a/b.json", []byte("two"), ""); !errors.Is(err, ErrCASConflict) {
		t.Fatalf("create over existing: err = %v, want ErrCASConflict", err)
	}
	// The loser changed nothing.
	body, _, err := s.Get(ctx, "a/b.json")
	if err != nil || string(body) != "one" {
		t.Fatalf("Get = %q, %v; want %q", body, err, "one")
	}
}

func TestPutIfMatchStaleEtagFails(t *testing.T) {
	s := NewDirStore(t.TempDir())
	ctx := context.Background()
	etag1, err := s.Put(ctx, "k", []byte("one"), "")
	if err != nil {
		t.Fatalf("create: %v", err)
	}
	etag2, err := s.Put(ctx, "k", []byte("two"), etag1)
	if err != nil {
		t.Fatalf("CAS replace: %v", err)
	}
	if etag2 == etag1 {
		t.Fatalf("etag didn't change on replace")
	}
	// Replaying the old etag must lose.
	if _, err := s.Put(ctx, "k", []byte("three"), etag1); !errors.Is(err, ErrCASConflict) {
		t.Fatalf("stale etag: err = %v, want ErrCASConflict", err)
	}
	// And a CAS write against a key that doesn't exist must lose too.
	if _, err := s.Put(ctx, "missing", []byte("x"), etag1); !errors.Is(err, ErrCASConflict) {
		t.Fatalf("CAS on missing key: err = %v, want ErrCASConflict", err)
	}
	body, _, _ := s.Get(ctx, "k")
	if string(body) != "two" {
		t.Fatalf("Get = %q, want %q", body, "two")
	}
}

func TestGetNotFoundWrapsErrNotExist(t *testing.T) {
	s := NewDirStore(t.TempDir())
	if _, _, err := s.Get(context.Background(), "no/such/key"); !errors.Is(err, os.ErrNotExist) {
		t.Fatalf("err = %v, want os.ErrNotExist-wrapped", err)
	}
}

func TestListPrefix(t *testing.T) {
	s := NewDirStore(t.TempDir())
	ctx := context.Background()
	for _, k := range []string{"apps/x/releases/v1/manifest.json", "apps/x/releases/v1/bin", "apps/x/channels/stable.json", "apps/y/one"} {
		if _, err := s.Put(ctx, k, []byte(k), ""); err != nil {
			t.Fatalf("put %s: %v", k, err)
		}
	}
	keys, err := s.List(ctx, "apps/x/releases/v1/")
	if err != nil {
		t.Fatalf("list: %v", err)
	}
	want := []string{"apps/x/releases/v1/bin", "apps/x/releases/v1/manifest.json"}
	if len(keys) != len(want) || keys[0] != want[0] || keys[1] != want[1] {
		t.Fatalf("List = %v, want %v", keys, want)
	}
	// An empty store (or unmatched prefix) lists empty, like an empty bucket.
	keys, err = s.List(ctx, "nothing/")
	if err != nil || len(keys) != 0 {
		t.Fatalf("List(nothing/) = %v, %v; want empty", keys, err)
	}
}

func TestDirStoreRejectsTraversal(t *testing.T) {
	s := NewDirStore(t.TempDir())
	ctx := context.Background()
	for _, k := range []string{"../evil", "a/../../evil", "/abs", "a//b", ""} {
		if _, err := s.Put(ctx, k, []byte("x"), ""); err == nil {
			t.Fatalf("Put(%q) accepted a traversal key", k)
		}
	}
}

func TestDirStoreDelete(t *testing.T) {
	s := NewDirStore(t.TempDir())
	ctx := context.Background()
	if _, err := s.Put(ctx, "metrics/boxes/b/raw/2026-08-01-10.json", []byte(`{}`), ""); err != nil {
		t.Fatal(err)
	}
	if err := s.Delete(ctx, "metrics/boxes/b/raw/2026-08-01-10.json"); err != nil {
		t.Fatalf("Delete: %v", err)
	}
	if _, _, err := s.Get(ctx, "metrics/boxes/b/raw/2026-08-01-10.json"); !errors.Is(err, os.ErrNotExist) {
		t.Fatalf("Get after Delete = %v, want ErrNotExist", err)
	}
	// Idempotent: deleting a key that isn't there is fine.
	if err := s.Delete(ctx, "metrics/boxes/b/raw/2026-08-01-10.json"); err != nil {
		t.Fatalf("second Delete: %v", err)
	}
}

// TestDirStoreListDirs: the delimiter-aware listing returns the immediate
// child prefixes and nothing else — not the objects beneath them (which is
// the whole point: cost bounded by the number of children, not by their
// histories), and not the FILES sitting at the same level, which is what
// keeps a ledger's ledgers.json out of its own list of ledgers.
func TestDirStoreListDirs(t *testing.T) {
	s := NewDirStore(t.TempDir())
	ctx := context.Background()
	for _, k := range []string{
		"ledgers/bab/titogo/carbon/HEAD.json",
		"ledgers/bab/titogo/carbon/entries/20260803T000000Z-aaaaaaaaaaaa.json",
		"ledgers/bab/titogo/carbon/entries/20260803T000001Z-bbbbbbbbbbbb.json",
		"ledgers/bab/titogo/carbon/blobs/deadbeef",
		"ledgers/bab/titogo/prompts/HEAD.json",
		"ledgers/bab/titogo/ledgers.json", // a FILE at this level
		"ledgers/bab/otherapp/elsewhere/HEAD.json",
	} {
		if _, err := s.Put(ctx, k, []byte(`{}`), ""); err != nil {
			t.Fatal(err)
		}
	}

	got, err := s.ListDirs(ctx, "ledgers/bab/titogo/")
	if err != nil {
		t.Fatalf("ListDirs: %v", err)
	}
	want := []string{"ledgers/bab/titogo/carbon/", "ledgers/bab/titogo/prompts/"}
	if len(got) != len(want) {
		t.Fatalf("ListDirs = %v, want %v (no files, no grandchildren)", got, want)
	}
	for i := range want {
		if got[i] != want[i] {
			t.Fatalf("ListDirs = %v, want %v", got, want)
		}
	}
	// A prefix without the trailing slash answers identically — the two
	// implementations must not disagree about that.
	bare, err := s.ListDirs(ctx, "ledgers/bab/titogo")
	if err != nil || len(bare) != len(want) || bare[0] != want[0] {
		t.Fatalf("ListDirs without a trailing slash = %v, %v; want %v", bare, err, want)
	}
	// One level up sees the apps, not the chains under them.
	up, err := s.ListDirs(ctx, "ledgers/bab/")
	if err != nil || len(up) != 2 || up[0] != "ledgers/bab/otherapp/" || up[1] != "ledgers/bab/titogo/" {
		t.Fatalf("ListDirs one level up = %v, %v", up, err)
	}
	// A prefix with nothing under it lists empty, like an empty bucket
	// prefix — not an error.
	empty, err := s.ListDirs(ctx, "ledgers/nosuch/")
	if err != nil || len(empty) != 0 {
		t.Fatalf("ListDirs of a missing prefix = %v, %v; want empty and no error", empty, err)
	}
	// The root lists the top-level prefixes.
	root, err := s.ListDirs(ctx, "")
	if err != nil || len(root) != 1 || root[0] != "ledgers/" {
		t.Fatalf("ListDirs of the root = %v, %v; want [ledgers/]", root, err)
	}
}

// TestDirStoreListMod: the mod-time-aware listing answers exactly like List
// — same keys, same order, same prefix filter — with each key's mtime
// alongside, so a caller can rank by recency without reading a single body.
func TestDirStoreListMod(t *testing.T) {
	dir := t.TempDir()
	s := NewDirStore(dir)
	ctx := context.Background()
	older := time.Date(2026, 7, 1, 10, 0, 0, 0, time.UTC)
	newer := time.Date(2026, 8, 2, 10, 0, 0, 0, time.UTC)
	for k, mod := range map[string]time.Time{
		"apps/bab/kass/releases/v1/manifest.json": older,
		"apps/bab/kass/releases/v2/manifest.json": newer,
		"apps/bab/kass/channels/stable.json":      newer, // outside the prefix
	} {
		if _, err := s.Put(ctx, k, []byte(`{}`), ""); err != nil {
			t.Fatal(err)
		}
		if err := os.Chtimes(filepath.Join(dir, filepath.FromSlash(k)), mod, mod); err != nil {
			t.Fatal(err)
		}
	}
	got, err := s.ListMod(ctx, "apps/bab/kass/releases/")
	if err != nil {
		t.Fatalf("ListMod: %v", err)
	}
	want := []KeyMod{
		{Key: "apps/bab/kass/releases/v1/manifest.json", Mod: older},
		{Key: "apps/bab/kass/releases/v2/manifest.json", Mod: newer},
	}
	if len(got) != len(want) {
		t.Fatalf("ListMod = %+v, want %+v", got, want)
	}
	for i := range want {
		if got[i].Key != want[i].Key || !got[i].Mod.Equal(want[i].Mod) {
			t.Fatalf("ListMod[%d] = %+v, want %+v", i, got[i], want[i])
		}
	}
	// A missing prefix lists empty like an empty bucket, not an error.
	empty, err := s.ListMod(ctx, "apps/nosuch/")
	if err != nil || len(empty) != 0 {
		t.Fatalf("ListMod of a missing prefix = %v, %v; want empty and no error", empty, err)
	}
}

func TestDirStoreListSizes(t *testing.T) {
	s := NewDirStore(t.TempDir())
	ctx := context.Background()
	if _, err := s.Put(ctx, "apps/bab/hello/one.bin", []byte("12345"), ""); err != nil {
		t.Fatal(err)
	}
	if _, err := s.Put(ctx, "apps/bab/hello/two.bin", []byte("1234567890"), ""); err != nil {
		t.Fatal(err)
	}
	if _, err := s.Put(ctx, "apps/other/x.bin", []byte("1"), ""); err != nil {
		t.Fatal(err)
	}
	sizes, err := s.ListSizes(ctx, "apps/bab/")
	if err != nil {
		t.Fatal(err)
	}
	total := int64(0)
	for _, ks := range sizes {
		total += ks.Size
	}
	if len(sizes) != 2 || total != 15 {
		t.Fatalf("sizes = %+v", sizes)
	}
	var _ SizeLister = s // interface satisfaction
}

// TestS3StoreLive exercises the production store against a real bucket —
// only when CARLOS_TEST_S3_BUCKET is set; the type otherwise just compiles.
func TestS3StoreLive(t *testing.T) {
	bucket := os.Getenv("CARLOS_TEST_S3_BUCKET")
	if bucket == "" {
		t.Skip("CARLOS_TEST_S3_BUCKET not set — skipping live S3Store test")
	}
	ctx := context.Background()
	s, err := NewS3Store(ctx, bucket)
	if err != nil {
		t.Fatalf("NewS3Store: %v", err)
	}
	key := fmt.Sprintf("carlos-release-test/%d/ptr.json", time.Now().UnixNano())

	if _, _, err := s.Get(ctx, key); !errors.Is(err, os.ErrNotExist) {
		t.Fatalf("Get missing: err = %v, want os.ErrNotExist-wrapped", err)
	}
	etag, err := s.Put(ctx, key, []byte("one"), "")
	if err != nil {
		t.Fatalf("create: %v", err)
	}
	if _, err := s.Put(ctx, key, []byte("two"), ""); !errors.Is(err, ErrCASConflict) {
		t.Fatalf("create over existing: err = %v, want ErrCASConflict", err)
	}
	body, gotEtag, err := s.Get(ctx, key)
	if err != nil || string(body) != "one" || gotEtag != etag {
		t.Fatalf("Get = %q, %q, %v; want %q, %q", body, gotEtag, err, "one", etag)
	}
	etag2, err := s.Put(ctx, key, []byte("two"), etag)
	if err != nil {
		t.Fatalf("CAS replace: %v", err)
	}
	if _, err := s.Put(ctx, key, []byte("three"), etag); !errors.Is(err, ErrCASConflict) {
		t.Fatalf("stale etag: err = %v, want ErrCASConflict", err)
	}
	_ = etag2
	keys, err := s.List(ctx, key)
	if err != nil || len(keys) != 1 || keys[0] != key {
		t.Fatalf("List = %v, %v; want [%s]", keys, err, key)
	}

	// ListDirs against the same live bucket: the object written above sits
	// one level below its parent prefix, so the parent's parent must see the
	// child PREFIX (CommonPrefixes) and not the object itself.
	parent := key[:strings.LastIndex(key, "/")+1] // .../<nanos>/
	grandparent := parent[:strings.LastIndex(parent[:len(parent)-1], "/")+1]
	dirs, err := s.ListDirs(ctx, grandparent)
	if err != nil {
		t.Fatalf("ListDirs: %v", err)
	}
	found := false
	for _, d := range dirs {
		if d == parent {
			found = true
		}
		if d == key {
			t.Fatalf("ListDirs returned an OBJECT key %q, want only child prefixes", d)
		}
	}
	if !found {
		t.Fatalf("ListDirs(%q) = %v, want %q among them", grandparent, dirs, parent)
	}
	// And at the object's own level there are no child prefixes at all.
	leaf, err := s.ListDirs(ctx, parent)
	if err != nil || len(leaf) != 0 {
		t.Fatalf("ListDirs(%q) = %v, %v; want empty (the only child is an object)", parent, leaf, err)
	}
}

// ---- prefixStore -------------------------------------------------------------

// TestNewPrefixStoreRebasesKeys pins NewPrefixStore's own contract in
// isolation (customer-fleets plan, Task 5 — moved here from internal/host,
// its first caller, on review: it's a property of Store itself, needed by
// any package that must read a namespaced store, not just statusLoop):
// Put/Get/List/ListDirs all operate in "unprefixed" key space from the
// caller's side, while the underlying store actually holds everything under
// the fixed base — and a key List hands back must round-trip through the
// SAME wrapper's Get without doubling the prefix.
func TestNewPrefixStoreRebasesKeys(t *testing.T) {
	ctx := context.Background()
	under := NewDirStore(t.TempDir())
	wrapped := NewPrefixStore(under, "fleets/pi/")

	if _, err := wrapped.Put(ctx, "status/boxes/pi-box.json", []byte(`{"ok":true}`), ""); err != nil {
		t.Fatal(err)
	}

	// The underlying store must hold the REBASED key, not the caller's one.
	if _, _, err := under.Get(ctx, "fleets/pi/status/boxes/pi-box.json"); err != nil {
		t.Errorf("underlying store missing rebased key: %v", err)
	}
	if _, _, err := under.Get(ctx, "status/boxes/pi-box.json"); err == nil {
		t.Error("underlying store must not hold the unrebased key")
	}

	// List, queried in the caller's unprefixed space, must find it and hand
	// back a key that still round-trips through the SAME wrapper's Get.
	keys, err := wrapped.List(ctx, "status/boxes/")
	if err != nil {
		t.Fatal(err)
	}
	if len(keys) != 1 || keys[0] != "status/boxes/pi-box.json" {
		t.Fatalf("List = %v, want exactly [status/boxes/pi-box.json]", keys)
	}
	if body, _, err := wrapped.Get(ctx, keys[0]); err != nil || string(body) != `{"ok":true}` {
		t.Errorf("Get(%q) via the wrapper = %q, %v", keys[0], body, err)
	}

	// An empty prefix must be a pure passthrough: the same store, unwrapped
	// — not a prefixStore with an empty base. Verified by interface
	// equality, not merely by observing identical behavior.
	if s := NewPrefixStore(under, ""); s != Store(under) {
		t.Errorf("NewPrefixStore with empty prefix = %v, want the underlying store unchanged", s)
	}
}

// TestPrefixStoreListDirsRebasesAndStrips is List's sibling test for the
// delimiter-aware listing: ListDirs must see child prefixes queried under
// the rebased key space, and hand results back stripped of the base, same
// as List.
func TestPrefixStoreListDirsRebasesAndStrips(t *testing.T) {
	ctx := context.Background()
	under := NewDirStore(t.TempDir())
	wrapped := NewPrefixStore(under, "fleets/pi/")

	if _, err := wrapped.Put(ctx, "status/boxes/pi-box.json", []byte(`{}`), ""); err != nil {
		t.Fatal(err)
	}

	dirs, err := wrapped.ListDirs(ctx, "status/")
	if err != nil {
		t.Fatal(err)
	}
	if len(dirs) != 1 || dirs[0] != "status/boxes/" {
		t.Fatalf("ListDirs = %v, want exactly [status/boxes/]", dirs)
	}
}

func TestNewS3StoreInPinsTheRegion(t *testing.T) {
	t.Setenv("AWS_REGION", "us-east-1")
	t.Setenv("AWS_ACCESS_KEY_ID", "k")
	t.Setenv("AWS_SECRET_ACCESS_KEY", "s")
	s, err := NewS3StoreIn(context.Background(), "b", "eu-west-1")
	if err != nil {
		t.Fatal(err)
	}
	if got := s.Client.Options().Region; got != "eu-west-1" {
		t.Fatalf("region = %q, want eu-west-1", got)
	}
}