package status_test

import (
	"context"
	"encoding/json"
	"strings"
	"testing"
	"time"

	"github.com/carlosframework/platform/internal/registry"
	"github.com/carlosframework/platform/internal/status"
)

// ---- Task 5: Contract tests — allowlist + digit scan ----
// The allowlist IS the schema. Adding a field to the structs without adding
// it here fails the build — that friction is the point: every new field is a
// deliberate publication decision. This file guards the public JSON contract
// that the fleet status page publishes, ensuring no accidental leaks of
// hostnames, IDs, or other sensitive data slip into the output.

// allowedBoxKeys are THE schema for Box's JSON output. Any new field in Box
// must be explicitly added here to pass the test — design friction that makes
// the publication decision deliberate, never accidental. The map keys are path
// strings ("" for root, "fieldname" for nested, "fieldname[]" for array
// elements); values are the allowed field names at that path.
var allowedBoxKeys = map[string][]string{
	// "adoption_running" is a deliberate publication (pipelines spec §5): it
	// says whether the platform's own release-adoption timer is armed on this
	// box. It carries no tenant, hostname or machine identity — only whether
	// an opaquely-labelled box is picking up its own releases.
	//
	// "expired_canaries" is likewise deliberate (pipelines spec §5 "Canaries
	// expire"): a COUNT of this box's own canary/* routes past their TTL,
	// never which ones — no hostname, no channel name, no tenant identity.
	//
	// "config_path_running" is the issue #44 sibling of adoption_running: it
	// says whether this box's config-sync trigger unit (carlos-adopt.path) is
	// armed, i.e. whether config reaches unit-backed routes in seconds or only
	// on the hourly floor. Same publication argument — a platform-own unit's
	// liveness on an opaquely-labelled box, no tenant in it anywhere.
	//
	// "restart_path_running" is the issue #113 sibling of both: whether this
	// box's restart trigger unit (carlos-restart.path) is armed, i.e. whether a
	// member's `carlos restart` reaches its units in seconds or waits out the
	// hourly floor. Identical publication argument — one platform-own unit's
	// liveness on an opaquely-labelled box, and no tenant anywhere in it (it
	// says nothing about WHICH app was restarted, or that any was).
	//
	// "metrics" is the one key in this allowlist that is EXEMPT from the
	// band-word-not-a-number rule every other Box field follows (Task 5,
	// internal/status/snapshot.go's package doc): it carries raw byte
	// counts, a load average, a release sha, and tunnel state, unbanded.
	// That's safe only because Box (and this "metrics" key with it) never
	// leaves the bucket — status/boxes/<label>.json is read by fleet-status
	// machinery and operators, never served publicly (internal/edge/status.go's
	// fixed three-object menu doesn't include it) — and because
	// allowedFleetKeys below has no "metrics" entry: BuildFleet's explicit
	// field-by-field copy into FleetBox never names it, so TestFleetSchemaAllowlisted
	// would fail the moment that ever changed.
	//
	// "metrics.route_versions" (Task 8, issue #78) carries real hostnames —
	// the one field under "metrics" that isn't just an unbanded number —
	// safe for exactly the same bucket-private reason: BuildFleet's
	// field-by-field copy never names "metrics" at all, so no hostname here
	// can reach FleetBox or fleet.json regardless of what this map holds.
	// "metrics.upstreams" (multi-upstream plan, Task 6) is route_versions'
	// sibling and then some: its KEYS are route hostnames and its VALUES carry
	// real backend addresses. It is safe on the identical structural ground —
	// BuildFleet's field-by-field copy never names "metrics", so nothing under
	// it can reach FleetBox or fleet.json — and it is spelled out to one more
	// level here than route_versions needs to be, because its values are
	// objects rather than plain strings: "metrics.upstreams.*[]" pins the
	// per-upstream fields, so a future field on UpstreamState is a deliberate
	// publication decision too, not a silent ride-along.
	// "metrics.layout" (Task 5, isolated-exec plan 4) is the box's layout
	// report: which mode it last converged to, and — hostname-keyed, same
	// reasoning as metrics.route_versions and metrics.upstreams just above —
	// every instance-kind route's word from the layout pass's own Classify.
	// Safe on the identical structural ground: BuildFleet's field-by-field
	// copy never names "metrics", so no hostname here can reach FleetBox or
	// fleet.json regardless of what this map holds.
	"":                       {"generated_at", "label", "region", "routes", "load", "capacity", "replication", "adoption_running", "config_path_running", "restart_path_running", "expired_canaries", "metrics"},
	"routes":                 {"static", "resident", "hibernating", "awake", "asleep"},
	"replication":            {"healthy", "lag_seconds"},
	"metrics":                {"mem_total_bytes", "mem_avail_bytes", "load1", "disk_free_bytes", "release", "tunnel", "route_versions", "upstreams", "layout", "config_refusals", "config_refusals_total", "release_refusals", "proof_waits", "config_guard", "build_states", "build_states_err", "update_settings", "updates"},
	"metrics.route_versions": {wildcardAnyKey},
	"metrics.upstreams":      {wildcardAnyKey},
	"metrics.upstreams.*[]":  {"addr", "up", "since", "fails", "last_error"},
	"metrics.layout":         {"mode", "rows", "default", "default_blocked"},
	"metrics.layout.rows":    {wildcardAnyKey},
	"metrics.layout.rows.*":  {"layout", "reason", "note"},
	// config_refusals (amadan #213) names hosts and a closed reason word, in
	// the private block only. Pinned to the field level so a future field on
	// the refusal is a publication decision too.
	"metrics.config_refusals[]": {"host", "reason", "since", "last", "count"},
	// release_refusals (D1) names the host and build the box rolled back, in
	// the private block only, pinned to the field level for the same reason.
	"metrics.release_refusals[]": {"host", "version", "reason", "refused_at", "kind", "recovery_error"},
	// proof_waits (D3) names the host and build the box is holding for a dev
	// proof, in the private block only, pinned to the field level too.
	"metrics.proof_waits[]": {"host", "version", "sha256", "prover", "reason", "since"},
	// build_states (settings spec rev 11 §4.4) is host -> the builds that
	// host's build state names, in the private block only, for the
	// housekeeper's retention. Keys are hostnames; the values are pinned to
	// the field level.
	"metrics.build_states":   {wildcardAnyKey},
	"metrics.build_states.*": {"account", "app", "builds", "complete"},
	// updates (settings spec §4.3) is host -> root's last decision for that
	// host, in the private block only; the values are pinned to the field level.
	// account and app are the host's tenant (Astra r1, R18), as build_states
	// carries it.
	"metrics.updates":   {wildcardAnyKey},
	"metrics.updates.*": {"desired", "reason", "detail", "baking", "major", "pending", "completed", "completed_failed", "account", "app"},
}

// allowedFleetKeys are THE schema for Fleet's JSON output. Same friction as
// allowedBoxKeys: every new field is a deliberate publication decision.
var allowedFleetKeys = map[string][]string{
	"":               {"generated_at", "boxes", "instances", "capacity", "apps", "apps_unlisted", "services", "replication", "adoption_running", "expired_canaries"},
	"boxes[]":        {"label", "region", "load", "stale", "routes", "adoption_running", "config_path_running", "restart_path_running", "expired_canaries"},
	"boxes[].routes": {"static", "resident", "hibernating", "awake", "asleep"},
	"instances":      {"total", "static", "resident", "hibernating", "awake", "asleep"},
	"capacity":       {"level"},
	"apps[]":         {"name", "instances", "healthy", "channel", "version"},
	"services[]":     {"name", "up"},
	"replication":    {"healthy", "lag_seconds"},
}

// assertOnlyKeys walks the decoded JSON map recursively, ensuring every key
// at every path is in the allowlist for that path. Arrays walk their elements;
// a key not in the allowlist fails with the offending path. This is the guard:
// if a new field leaks into the JSON without an explicit allowlist entry, the
// test fails and forces a review.
func assertOnlyKeys(t *testing.T, j []byte, allowedKeys map[string][]string) {
	t.Helper()
	var decoded interface{}
	if err := json.Unmarshal(j, &decoded); err != nil {
		t.Fatalf("unmarshal JSON: %v", err)
	}
	walkKeys(t, decoded, "", allowedKeys)
}

// wildcardAnyKey marks a path (in an allowedKeys map) whose object keys are
// DATA, not a fixed field-name schema — metrics.route_versions (Task 8,
// issue #78) is host -> Version and metrics.upstreams (multi-upstream plan,
// Task 6) is host -> []UpstreamState, so their keys are hostnames chosen at
// runtime, which no fixed allowlist could name in advance. Values still
// recurse normally, so this only relaxes the KEY-NAME check, never the shape
// check: a wildcarded map's values walk on under the literal path segment
// "*" (walkKeys, below), which is what lets "metrics.upstreams.*[]" pin the
// fields of the objects inside — a runtime-chosen key must not also buy its
// value an unexamined shape.
const wildcardAnyKey = "*"

// walkKeys recursively traverses the decoded JSON structure, checking that
// every key at every path is in the allowlist. It handles maps and arrays
// appropriately, using "" for root, "fieldname" for nested maps, and
// "fieldname[]" for array element paths.
func walkKeys(t *testing.T, obj interface{}, path string, allowedKeys map[string][]string) {
	switch v := obj.(type) {
	case map[string]interface{}:
		// This is a map (object). Check that every key is in the allowlist
		// for this path — unless the path is wildcarded (see wildcardAnyKey),
		// in which case the keys themselves are data.
		allowed := allowedKeys[path]
		wildcard := len(allowed) == 1 && allowed[0] == wildcardAnyKey
		for key := range v {
			if !wildcard {
				found := false
				for _, a := range allowed {
					if a == key {
						found = true
						break
					}
				}
				if !found {
					t.Errorf("unexpected key %q at path %q", key, path)
					continue
				}
			}
			// Recurse into this key's value, building the child path. Under a
			// wildcard the key itself is data (a hostname), so every value
			// walks under the same literal "*" segment rather than a path
			// only that one runtime key would ever match — otherwise the
			// values of a wildcarded map could never be allowlisted at all,
			// and any shape inside them would pass unchecked.
			var childPath string
			switch {
			case wildcard:
				childPath = path + ".*"
			case path == "":
				childPath = key
			default:
				childPath = path + "." + key
			}
			walkKeys(t, v[key], childPath, allowedKeys)
		}

	case []interface{}:
		// This is an array. Recurse into each element with path + "[]".
		elemPath := path + "[]"
		for _, elem := range v {
			walkKeys(t, elem, elemPath, allowedKeys)
		}

	case string, float64, bool, nil:
		// Leaf values; nothing to check.
	}
}

// scanForLeaks searches the JSON bytes for any of the banned strings and
// returns the list of banned strings actually found. Used by tests to verify
// sensitive data (hostnames, IDs) never leaks into the output. Delegates to
// status.ScanForLeaks (dryrun.go) rather than reimplementing the scan here:
// DryRun needs this same check at runtime (this file is package
// status_test, which DryRun — living in package status — cannot import), and
// two copies of "search bytes for banned substrings" would risk silently
// drifting into checking different things.
func scanForLeaks(j []byte, banned []string) []string {
	return status.ScanForLeaks(j, banned)
}

// fixtureRoutes creates test routes with a variety of kinds, some hibernating,
// and at least one opted-in app. The result is suitable for CollectBox and
// BuildFleet tests. It includes:
// - A static route (not hibernating, not instance)
// - A resident route (not hibernating, instance kind)
// - A hibernating route with an opted-in app
// - Additional hibernating routes without opt-in to test the various counts
func fixtureRoutes() []registry.Route {
	return []registry.Route{
		{
			Host:      "static-route.internal",
			Kind:      "static",
			App:       "",
			Status:    "ready",
			Socket:    "",
			Hibernate: false,
		},
		{
			Host:        "resident-app.internal",
			Kind:        "instance",
			App:         "resident-service",
			Status:      "ready",
			Socket:      "",
			Hibernate:   false,
			StatusNamed: false,
		},
		{
			Host:        "hibernating-opted.internal",
			Kind:        "instance",
			App:         "opted-app",
			Status:      "ready",
			Socket:      "/var/run/opted-app.sock",
			Hibernate:   true,
			StatusNamed: true,
			Channel:     "stable",
			Version:     "abc1234",
		},
		{
			Host:        "hibernating-not-opted.internal",
			Kind:        "instance",
			App:         "not-opted",
			Status:      "ready",
			Socket:      "/var/run/not-opted.sock",
			Hibernate:   true,
			StatusNamed: false,
		},
		{
			Host:      "svc-pdf.internal",
			Kind:      "service",
			App:       "svc/pdf",
			Status:    "ready",
			Socket:    "",
			Hibernate: false,
		},
	}
}

// fixtureProbes creates test probes with known fractions so that banding
// produces non-nil results. It uses values in the middle bands so that
// load and capacity both resolve to band words (not nil).
//
// The six Metrics fields (memTotal/memAvail/load1/diskFree/release/tunnel)
// are populated here too, with values DISTINCT from dryrun.go's own
// dryRunMetricsNeedles fixtures — the two harnesses check different things
// (this file's allowlist tests guard Box/Fleet's declared JSON schema;
// dryrun.go's leak scan guards the real publish pipeline end to end) and
// must never share fixture values, or a bug that only one harness would
// catch could hide behind the other's coincidentally-matching needle.
func fixtureProbes() status.Probes {
	memFrac := 0.75       // Between 0.70 and 0.90 -> "busy"
	diskFrac := 0.80      // Between 0.70 and 0.90 -> "getting-full"
	lagSecs := int64(300) // 5 minutes, healthy (< 15 min)
	adopting := true      // a real reading, so the field is scanned with a value in it
	contractMajor := 2

	memTotal := int64(8123456789) // distinct from dryrun.go's 4242424242
	memAvail := int64(3123456789) // distinct from dryrun.go's 4242424241
	diskFree := int64(1123456789) // distinct from dryrun.go's 4242424240
	load1 := 1.23                 // distinct from dryrun.go's 42.42

	// Listening function returns true for hibernating routes, false otherwise.
	listening := func(sock string) *bool {
		if strings.HasPrefix(sock, "/var/run/") {
			// Hibernating routes; return true for "awake"
			v := strings.Contains(sock, "opted")
			return &v
		}
		return nil
	}

	// One probed route, so metrics.upstreams is actually exercised by the
	// allowlist walk rather than merely permitted by it — an unexercised
	// schema entry guards nothing. Distinct from dryrun.go's own upstream
	// fixture for the same reason every value here is (see the doc comment).
	upstreams := map[string][]status.UpstreamState{
		"contract-fixture.internal": {
			{Addr: "10.31.31.11:9090", Up: true, Since: time.Now().Add(-time.Hour)},
			{Addr: "10.31.31.12:9090", Up: false, Since: time.Now().Add(-time.Minute), Fails: 5, LastError: "status 500 (want 200)"},
		},
	}

	// One flat row and one foreign row, so both the bare "layout" field
	// (mode) and the wildcarded, host-keyed "rows" map — including a row
	// that carries a reason — are actually exercised by the allowlist walk,
	// the same reasoning fixtureProbes' own comment gives for upstreams.
	layoutReport := &status.LayoutReport{
		Mode: "flat",
		Rows: map[string]status.RowLayout{
			"contract-layout.internal": {Layout: "flat"},
			"contract-foreign.internal": {Layout: "foreign",
				Reason: `db "x" socket "y" are neither the flat nor the nested defaults`},
		},
	}

	return status.Probes{
		MachineID: "test-machine-id",
		Region:    "us-west-1",
		Upstreams: upstreams,
		Layout:    layoutReport,
		// One refusal so metrics.config_refusals is exercised by the
		// allowlist walk and not merely permitted by it.
		ConfigRefusals: []status.ConfigRefusal{
			{Host: "contract-refused.internal", Reason: "cannot_open", Since: time.Now().Add(-time.Hour), Last: time.Now(), Count: 2},
		},
		ConfigRefusalsTotal: 1,
		// One rolled-back build, so metrics.release_refusals is exercised
		// by the allowlist walk too.
		ReleaseRefusals: []status.ReleaseRefusal{
			{Host: "contract-rolled-back.internal", Version: "v2", Reason: "exited: status=2", RefusedAt: time.Now(),
				Kind: "wrong-program", RecoveryError: "rollback did not come up either"},
		},
		// One host held for a dev proof, so metrics.proof_waits is exercised
		// by the allowlist walk too.
		ProofWaits: []status.ProofWait{
			{Host: "contract-proof-wait.internal", Version: "v3", SHA256: "e47fcc1e0123456789abcdef", Prover: "dev",
				Reason: "no proof from dev", Since: time.Now().Add(-time.Hour)},
		},
		// One host's build-state builds, so metrics.build_states is exercised
		// by the allowlist walk too.
		BuildStates: map[string]status.BuildStatePins{
			"contract-held.internal": {Account: "bab", App: "km", Builds: []string{"v1", "v2"}, Complete: true},
		},
		// One host's update decision, so metrics.updates is exercised by the
		// allowlist walk too.
		UpdateSettings: status.UpdateSettingsProtocol,
		Updates: map[string]status.HostUpdates{
			"contract-decided.internal": {Desired: "v2", Reason: "major", Detail: "v2", Baking: "v3", Major: &contractMajor, Pending: 4, Completed: 3, CompletedFailed: true, Account: "bab", App: "km"},
		},
		ConfigGuard:   "bypassed (CARLOS_NO_SEALED_CONFIG)",
		MemFrac:       &memFrac,
		DiskFrac:      &diskFrac,
		Listening:     listening,
		LagSecs:       &lagSecs,
		AdoptRunning:  &adopting,
		MemTotalBytes: &memTotal,
		MemAvailBytes: &memAvail,
		Load1:         &load1,
		DiskFreeBytes: &diskFree,
		Release:       "contract-fixture-sha", // distinct from dryrun.go's "dryrun4242sha"
		Tunnel:        "connected",            // distinct from dryrun.go's "reconnecting"
	}
}

// TestBoxSchemaAllowlisted verifies that Box's JSON output carries only
// fields listed in allowedBoxKeys. Any new field added to Box must be
// explicitly added to allowedBoxKeys to pass this test — that's the guard.
func TestBoxSchemaAllowlisted(t *testing.T) {
	b := status.CollectBox(fixtureRoutes(), fixtureProbes(), time.Now())
	j, err := json.Marshal(b)
	if err != nil {
		t.Fatalf("marshal Box: %v", err)
	}
	assertOnlyKeys(t, j, allowedBoxKeys)
}

// TestFleetSchemaAllowlisted verifies that Fleet's JSON output carries only
// fields listed in allowedFleetKeys. Same guard as TestBoxSchemaAllowlisted,
// but for the merged feed: new fields must be explicitly allowlisted.
func TestFleetSchemaAllowlisted(t *testing.T) {
	s := teststore(t)
	now := time.Now()

	// Write a box so BuildFleet has something to merge.
	if err := status.WriteBox(context.Background(), s,
		status.CollectBox(fixtureRoutes(), fixtureProbes(), now)); err != nil {
		t.Fatalf("WriteBox: %v", err)
	}

	// Build the fleet over the teststore with routes that produce apps/services.
	f, err := status.BuildFleet(context.Background(), s, fixtureRoutes(), now, 5*time.Minute)
	if err != nil {
		t.Fatalf("BuildFleet: %v", err)
	}

	j, err := json.Marshal(f)
	if err != nil {
		t.Fatalf("marshal Fleet: %v", err)
	}
	assertOnlyKeys(t, j, allowedFleetKeys)
}

// TestBuildFleetIgnoresFleetPrefixedSnapshots pins the customer-fleets
// plan's Task 5 Step 3 contract: BuildFleet's loadBoxes lists EXACTLY
// "status/boxes/" (fleet.go:197) — a fleet box's heartbeat, written under
// "fleets/<name>/status/boxes/<label>.json" per the fleet box env contract
// (CARLOS_STATUS_PREFIX, internal/host's newPrefixStore), sits outside that
// prefix entirely and so never surfaces on the platform's own public
// fleet.json. This is owner-only visibility BY CONSTRUCTION — there is no
// allowlist rule to bypass, loadBoxes simply never reads that path — the
// same shape FleetBox never copying Box's "metrics" key already relies on.
func TestBuildFleetIgnoresFleetPrefixedSnapshots(t *testing.T) {
	s := teststore(t)
	now := time.Now()

	// A fleet box's own snapshot, parked at the exact key its
	// CARLOS_STATUS_PREFIX=fleets/pi/ produces — same Box shape a platform
	// box's WriteBox would produce, just outside status/boxes/.
	fleetBox := boxFixture("pi-box", "plenty", now)
	body, err := json.Marshal(fleetBox)
	if err != nil {
		t.Fatal(err)
	}
	if _, err := s.Put(context.Background(), "fleets/pi/status/boxes/pi-box.json", body, ""); err != nil {
		t.Fatal(err)
	}

	f, err := status.BuildFleet(context.Background(), s, nil, now, 5*time.Minute)
	if err != nil {
		t.Fatalf("BuildFleet: %v", err)
	}
	if len(f.Boxes) != 0 {
		t.Errorf("Boxes = %+v, want none — a fleet-prefixed snapshot must never surface on the public fleet page", f.Boxes)
	}

	// Contrast case: a platform box's own snapshot, written through the
	// real WriteBox (the unprefixed key), MUST surface — proving the
	// exclusion above is specifically the fleets/ prefix, not a broken
	// loadBoxes that would hide everything.
	if err := status.WriteBox(context.Background(), s, boxFixture("platform-box", "plenty", now)); err != nil {
		t.Fatal(err)
	}
	f2, err := status.BuildFleet(context.Background(), s, nil, now, 5*time.Minute)
	if err != nil {
		t.Fatalf("BuildFleet: %v", err)
	}
	if len(f2.Boxes) != 1 || f2.Boxes[0].Label != "platform-box" {
		t.Errorf("Boxes = %+v, want exactly platform-box (the fleet-prefixed snapshot still must not appear)", f2.Boxes)
	}
}

// TestNoDigitsInBandSubtrees verifies that the band words (load, capacity)
// never carry numeric digits. The privacy commitment: never publish raw
// fractions or counts, only words. A digit in these fields would violate
// that promise — and could leak enough information for an observer to
// reconstruct the missing band threshold.
func TestNoDigitsInBandSubtrees(t *testing.T) {
	b := status.CollectBox(fixtureRoutes(), fixtureProbes(), time.Now())
	for name, v := range map[string]*string{"load": b.Load, "capacity": b.Capacity} {
		if v != nil && strings.ContainsAny(*v, "0123456789") {
			t.Errorf("%s carries a digit: %q", name, *v)
		}
	}
}