//go:build linux

package provisioner

import (
	family "amadan.net/rastrillo/rastrillo/crypto"
	"bytes"
	"encoding/base64"
	"os"
	"path/filepath"
	"testing"
)

func TestInitializeResumesSameDurableIdentity(t *testing.T) {
	state, floor := persistentDirectory(t), persistentDirectory(t)
	password := []byte("synthetic init password")
	first, e := Initialize(state, floor, password)
	if e != nil {
		t.Fatal(e)
	}
	credential, e := os.ReadFile(filepath.Join(state, "credential.age"))
	if e != nil {
		t.Fatal(e)
	}
	next, e := Initialize(state, floor, password)
	if e != nil || next != first {
		t.Fatal("init identity changed", e)
	}
	again, e := os.ReadFile(filepath.Join(state, "credential.age"))
	if e != nil || !bytes.Equal(credential, again) {
		t.Fatal("credential replaced", e)
	}
	if _, e = Initialize(state, floor, []byte("wrong")); e != ErrRefused {
		t.Fatal("wrong password", e)
	}
	if e = os.Remove(filepath.Join(state, "credential.age")); e != nil {
		t.Fatal(e)
	}
	if _, e = Initialize(state, floor, password); e != ErrRefused {
		t.Fatal("lost credential silently recreated", e)
	}
}
func TestInitializeRefusesLostFloorAndNestedStorage(t *testing.T) {
	state, floor := persistentDirectory(t), persistentDirectory(t)
	password := []byte("synthetic floor-loss password")
	if _, e := Initialize(state, floor, password); e != nil {
		t.Fatal(e)
	}
	entries, e := os.ReadDir(floor)
	if e != nil {
		t.Fatal(e)
	}
	for _, entry := range entries {
		if e = os.Remove(filepath.Join(floor, entry.Name())); e != nil {
			t.Fatal(e)
		}
	}
	if _, e = Initialize(state, floor, password); e != ErrRefused {
		t.Fatal("lost floor silently recreated", e)
	}
	nested := filepath.Join(state, "nested")
	if e = os.Mkdir(nested, 0700); e != nil {
		t.Fatal(e)
	}
	if _, e = Initialize(state, nested, password); e != ErrRefused {
		t.Fatal("floor included in registry backup scope", e)
	}
}

func TestInitializeResumesExactGenesisBeforeDatabaseSchema(t *testing.T) {
	state, floorPath := persistentDirectory(t), persistentDirectory(t)
	d, e := openPrivateDirectory(state)
	if e != nil {
		t.Fatal(e)
	}
	defer d.close()
	fd, e := openPrivateDirectory(floorPath)
	if e != nil {
		t.Fatal(e)
	}
	defer fd.close()
	key, e := family.Generate()
	if e != nil {
		t.Fatal(e)
	}
	identity := floorIdentity{testToken(31), testToken(32), base64.RawURLEncoding.EncodeToString(key.SignPub())}
	password := []byte("synthetic interrupted init")
	wrapped, e := wrapCredential(key, identity, password)
	if e != nil {
		t.Fatal(e)
	}
	if e = d.create("credential.age", wrapped); e != nil {
		t.Fatal(e)
	}
	floor, e := newNativeFloor(fd, identity)
	if e != nil {
		t.Fatal(e)
	}
	genesis, e := floor.signed(key, floorPoint{}, "")
	if e != nil {
		t.Fatal(e)
	}
	if e = d.create("initializing.json", genesis); e != nil {
		t.Fatal(e)
	}
	if e = floor.initialize(key); e != nil {
		t.Fatal(e)
	}
	if e = d.create("registry.db", nil); e != nil {
		t.Fatal(e)
	}
	info, e := Initialize(state, floorPath, password)
	if e != nil || info.Registry != identity.Registry || info.Device != identity.Device || info.PublicKey != identity.Public {
		t.Fatal("exact genesis did not resume", e)
	}
}