package main

import (
	"bytes"
	"context"
	"crypto/ed25519"
	"encoding/base64"
	"encoding/json"
	"os"
	"path/filepath"
	"strings"
	"testing"
	"time"

	"github.com/carlosframework/platform/internal/release"
)

const cliSHA = "e47fcc1e0123456789abcdef0123456789abcdef0123456789abcdef01234567"

func TestProofKeygenWritesARootOnlyKey(t *testing.T) {
	path := filepath.Join(t.TempDir(), "proving.key")
	var out bytes.Buffer
	if err := proofKeygen(path, &out); err != nil {
		t.Fatal(err)
	}
	fi, err := os.Stat(path)
	if err != nil || fi.Mode().Perm() != 0o600 {
		t.Fatalf("key file mode = %v, %v; want 0600", fi.Mode().Perm(), err)
	}
	seed, _ := os.ReadFile(path)
	key, err := release.ParseSigningKey(string(seed), path)
	if err != nil {
		t.Fatal(err)
	}
	pub := base64.StdEncoding.EncodeToString(key.Public().(ed25519.PublicKey))
	if !strings.Contains(out.String(), "public key: "+pub+"\n") {
		t.Fatalf("printed %q, want the key file's public half %s", out.String(), pub)
	}
	if err := proofKeygen(path, &out); err == nil || !strings.Contains(err.Error(), "already exists") {
		t.Fatalf("second keygen = %v, want a refusal to overwrite", err)
	}
}

func signedCLIProof(t *testing.T) *release.Proof {
	t.Helper()
	seed, _, err := release.GenerateKey()
	if err != nil {
		t.Fatal(err)
	}
	key, err := release.ParseSigningKey(seed, "test")
	if err != nil {
		t.Fatal(err)
	}
	p, err := release.SignProof(key, release.Proof{App: "console", Platform: "linux-arm64", SHA256: cliSHA,
		Version: "f4478b15", Prover: "dev", ActiveSince: time.Date(2026, 10, 6, 9, 0, 0, 0, time.UTC),
		ProvenAt: time.Date(2026, 10, 6, 9, 15, 0, 0, time.UTC)})
	if err != nil {
		t.Fatal(err)
	}
	return p
}

// get against dev, put against flagship, byte for byte.
func TestProofGetThenPutCarriesIt(t *testing.T) {
	ctx := context.Background()
	dev, flagship := release.NewDirStore(t.TempDir()), release.NewDirStore(t.TempDir())
	p := signedCLIProof(t)
	if err := release.PutProof(ctx, dev, "bab", p); err != nil {
		t.Fatal(err)
	}
	var got bytes.Buffer
	if err := proofGet(ctx, dev, "bab", "console", cliSHA, "", &got); err != nil {
		t.Fatalf("proof get: %v", err)
	}
	var out bytes.Buffer
	if err := proofPut(ctx, flagship, "bab", "console", got.Bytes(), &out); err != nil {
		t.Fatalf("proof put: %v", err)
	}
	carried, err := release.GetProof(ctx, flagship, "bab", "console", cliSHA, "dev")
	if err != nil || carried.Sig != p.Sig {
		t.Fatalf("carried = %+v, %v", carried, err)
	}
}

func TestProofGetNotYetNamesTheBake(t *testing.T) {
	ctx := context.Background()
	dev := release.NewDirStore(t.TempDir())
	if err := release.PutProofPending(ctx, dev, "bab", release.ProofPending{App: "console", Platform: "linux-arm64",
		SHA256: cliSHA, Version: "f4478b15", Prover: "dev",
		LiveSince: time.Date(2026, 10, 6, 9, 30, 30, 0, time.UTC), After: "15m"}); err != nil {
		t.Fatal(err)
	}
	err := proofGet(ctx, dev, "bab", "console", cliSHA, "", &bytes.Buffer{})
	want := "not proven yet: " + cliSHA + " has been live on dev since 2026-10-06T09:30:30Z, proven after 15m"
	if err == nil || err.Error() != want {
		t.Fatalf("err = %v, want %q", err, want)
	}
	err = proofGet(ctx, release.NewDirStore(t.TempDir()), "bab", "console", cliSHA, "", &bytes.Buffer{})
	if err == nil || !strings.Contains(err.Error(), "has not been seen live") {
		t.Fatalf("err = %v, want the never-seen text", err)
	}
}

func TestProofPutRefusesAnotherApp(t *testing.T) {
	var b bytes.Buffer
	p := signedCLIProof(t)
	raw, _ := json.MarshalIndent(p, "", "  ")
	if err := proofPut(context.Background(), release.NewDirStore(t.TempDir()), "bab", "other", raw, &b); err == nil {
		t.Fatal("put a console proof under another app")
	}
	if err := proofPut(context.Background(), release.NewDirStore(t.TempDir()), "bab", "console", []byte(`{"schema":1}`), &b); err == nil {
		t.Fatal("put a malformed proof")
	}
}

// Re-running the roll script puts the same proof again: that must succeed.
func TestProofPutTwiceIsIdempotent(t *testing.T) {
	ctx := context.Background()
	s := release.NewDirStore(t.TempDir())
	p := signedCLIProof(t)
	raw, _ := json.MarshalIndent(p, "", "  ")
	for i := 0; i < 2; i++ {
		if err := proofPut(ctx, s, "bab", "console", raw, &bytes.Buffer{}); err != nil {
			t.Fatalf("put #%d: %v", i+1, err)
		}
	}
}

// A different proof under the same key is refused, and the first one stands.
func TestProofPutDifferentProofSameKeyFails(t *testing.T) {
	ctx := context.Background()
	s := release.NewDirStore(t.TempDir())
	p := signedCLIProof(t)
	raw, _ := json.MarshalIndent(p, "", "  ")
	if err := proofPut(ctx, s, "bab", "console", raw, &bytes.Buffer{}); err != nil {
		t.Fatal(err)
	}
	other := *p
	other.ProvenAt = other.ProvenAt.Add(time.Minute)
	raw2, _ := json.MarshalIndent(&other, "", "  ")
	err := proofPut(ctx, s, "bab", "console", raw2, &bytes.Buffer{})
	if err == nil || !strings.Contains(err.Error(), "already exists with different content") {
		t.Fatalf("err = %v, want a refusal naming different content", err)
	}
	got, gerr := release.GetProof(ctx, s, "bab", "console", cliSHA, "dev")
	if gerr != nil || got.Sig != p.Sig {
		t.Fatalf("stored proof changed: %+v, %v", got, gerr)
	}
}