package main

import (
	"encoding/json"
	"errors"
	"os"
	"path/filepath"
	"strings"
	"testing"
	"time"
)

// carryTree is a per-user bastion's state folder as an install finds it.
func carryTree(t *testing.T) (from, to string) {
	t.Helper()
	root := t.TempDir()
	from = filepath.Join(root, "account", "privatae-bastion")
	to = filepath.Join(root, "service", "privatae-bastion")
	files := map[string]string{
		"pairings/box-one.example.test.json": `{"host_name":"box-one.example.test","bearer":"mcp_test",` +
			`"context_root":"` + filepath.Join(from, "context", "box-one.example.test") + `",` +
			`"dcn_dir":"` + filepath.Join(from, "dcn", "box-one.example.test") + `",` +
			`"backup_root":"/mnt/nas/backups"}`,
		"dcn/box-one.example.test/grants.json": `{"folders":["/home/someone/notes"]}`,
		"context/box-one.example.test/blob":    "context bytes",
		"ui.secret":                            "account secret",
		"run.lock":                             "",
		"run.holder.json":                      `{"pid":1}`,
		"ui.addr":                              "127.0.0.1:7880",
		"bastion.log":                          "a log line",
	}
	for rel, body := range files {
		p := filepath.Join(from, filepath.FromSlash(rel))
		if err := os.MkdirAll(filepath.Dir(p), 0o700); err != nil {
			t.Fatal(err)
		}
		if err := os.WriteFile(p, []byte(body), 0o600); err != nil {
			t.Fatal(err)
		}
	}
	return from, to
}

// An install that moves the bastion from an account to the service brings
// its pairings with it: the service serves the same Hosts with the same keys,
// the paths that named the account's folder name the service's, nothing that
// belongs to a running bastion comes along, and the account's copy is gone.
//
// MUTATION: return before copyStateTree in carryStateInto. RESULT: red (the
// service has no pairing). Drop the rebaseJSONPaths call. RESULT: red (the
// pairing's context folder is still the account's).
func TestAServiceInstallCarriesTheAccountsPairingsIntoTheService(t *testing.T) {
	from, to := carryTree(t)
	res, err := carryStateInto(from, to)
	if err != nil {
		t.Fatal(err)
	}
	if strings.Join(res.Hosts, ",") != "box-one.example.test" {
		t.Fatalf("carried %v", res.Hosts)
	}
	raw, err := os.ReadFile(filepath.Join(to, "pairings", "box-one.example.test.json"))
	if err != nil {
		t.Fatalf("the service has no pairing: %v", err)
	}
	var c Config
	if err := json.Unmarshal(raw, &c); err != nil {
		t.Fatal(err)
	}
	if c.Bearer != "mcp_test" || c.HostName != "box-one.example.test" {
		t.Errorf("the pairing changed on the way: %+v", c)
	}
	if c.ContextRoot != filepath.Join(to, "context", "box-one.example.test") || c.DCNDir != filepath.Join(to, "dcn", "box-one.example.test") {
		t.Errorf("the pairing's folders still name the account's state: context %q, dcn %q", c.ContextRoot, c.DCNDir)
	}
	if c.BackupRoot != "/mnt/nas/backups" {
		t.Errorf("a path outside the state folder was rewritten: %q", c.BackupRoot)
	}
	if b, _ := os.ReadFile(filepath.Join(to, "dcn", "box-one.example.test", "grants.json")); !strings.Contains(string(b), "/home/someone/notes") {
		t.Errorf("the grants did not come along unchanged: %q", b)
	}
	if b, _ := os.ReadFile(filepath.Join(to, "context", "box-one.example.test", "blob")); string(b) != "context bytes" {
		t.Errorf("the context store did not come along: %q", b)
	}
	for _, n := range []string{"run.lock", "run.holder.json", "ui.addr", "bastion.log"} {
		if _, err := os.Stat(filepath.Join(to, n)); err == nil {
			t.Errorf("%s belongs to the running bastion it was carried from, not to its state", n)
		}
	}
	if _, err := os.Stat(from); !os.IsNotExist(err) {
		t.Errorf("the account's copy, keys included, is still there: %v", err)
	}
	if line := carryReport(res, from); !strings.Contains(line, "box-one.example.test") || !strings.Contains(line, "nothing needs pairing again") {
		t.Errorf("the install does not say what it carried: %q", line)
	}
}

// A service that already serves a Host is never merged into, and the
// account's state stays where it was.
func TestACarryNeverMergesIntoAServiceThatServesAHost(t *testing.T) {
	from, to := carryTree(t)
	p := filepath.Join(to, "pairings", "box-two.example.test.json")
	if err := os.MkdirAll(filepath.Dir(p), 0o700); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(p, []byte(`{"host_name":"box-two.example.test"}`), 0o600); err != nil {
		t.Fatal(err)
	}
	res, err := carryStateInto(from, to)
	if err != nil {
		t.Fatal(err)
	}
	if len(res.Hosts) != 0 || !strings.Contains(res.Note, "box-two.example.test") {
		t.Fatalf("carried into a serving service: %+v", res)
	}
	if _, err := os.Stat(filepath.Join(from, "pairings", "box-one.example.test.json")); err != nil {
		t.Errorf("the account's pairing was touched: %v", err)
	}
	if _, err := os.Stat(filepath.Join(to, "pairings", "box-one.example.test.json")); err == nil {
		t.Error("the account's pairing was merged in")
	}
}

// Not while a bastion still runs from the folder: its next write would be
// lost, and two bastions would hold the same keys.
func TestACarryWaitsForTheAccountsBastionToStop(t *testing.T) {
	prev := carryLockPatience
	t.Cleanup(func() { carryLockPatience = prev })
	carryLockPatience = 300 * time.Millisecond
	from, to := carryTree(t)
	f, err := os.OpenFile(filepath.Join(from, "run.lock"), os.O_RDWR, 0o600)
	if err != nil {
		t.Fatal(err)
	}
	defer f.Close()
	if err := flockFileNB(f); err != nil {
		t.Fatal(err)
	}
	if _, err := carryStateInto(from, to); err == nil || !strings.Contains(err.Error(), "still running") {
		t.Fatalf("carried while the account's bastion ran: %v", err)
	}
	if _, err := os.Stat(filepath.Join(to, "pairings")); err == nil {
		t.Error("the service got a pairing from a running bastion")
	}
	if _, err := os.Stat(filepath.Join(from, "pairings", "box-one.example.test.json")); err != nil {
		t.Errorf("the account's state was touched: %v", err)
	}
}

// A file the service already has is the service's: kept, and counted.
func TestACarryKeepsWhatTheServiceAlreadyHas(t *testing.T) {
	from, to := carryTree(t)
	if err := os.MkdirAll(to, 0o700); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(filepath.Join(to, "ui.secret"), []byte("service secret"), 0o600); err != nil {
		t.Fatal(err)
	}
	res, err := carryStateInto(from, to)
	if err != nil {
		t.Fatal(err)
	}
	if b, _ := os.ReadFile(filepath.Join(to, "ui.secret")); string(b) != "service secret" {
		t.Errorf("the service's own file was replaced: %q", b)
	}
	if res.Kept != 1 {
		t.Errorf("kept %d files, want 1", res.Kept)
	}
}

// The carry removes the folder it carried from, so it refuses anything but a
// bastion's own state folder, and does nothing for a folder with no pairing.
func TestACarryTouchesOnlyABastionsStateFolder(t *testing.T) {
	root := t.TempDir()
	other := filepath.Join(root, "Documents")
	if err := os.MkdirAll(filepath.Join(other, "pairings"), 0o700); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(filepath.Join(other, "pairings", "x.json"), []byte(`{}`), 0o600); err != nil {
		t.Fatal(err)
	}
	if _, err := carryStateInto(other, filepath.Join(root, "service", "privatae-bastion")); err == nil {
		t.Fatal("a folder that is not a bastion's was carried, and would have been removed")
	}
	if _, err := os.Stat(other); err != nil {
		t.Fatalf("the folder was touched: %v", err)
	}
	empty := filepath.Join(root, "account", "privatae-bastion")
	if err := os.MkdirAll(empty, 0o700); err != nil {
		t.Fatal(err)
	}
	if res, err := carryStateInto(empty, filepath.Join(root, "service", "privatae-bastion")); err != nil || len(res.Hosts) != 0 {
		t.Fatalf("a folder with no pairing: %+v, %v", res, err)
	}
	if _, err := os.Stat(empty); err != nil {
		t.Errorf("a folder with nothing to carry was removed: %v", err)
	}
}

func TestRebasePathMovesOnlyPathsUnderTheFolder(t *testing.T) {
	from, to := "/a/privatae-bastion", "/b/privatae-bastion"
	for in, want := range map[string]string{
		"/a/privatae-bastion":          "/b/privatae-bastion",
		"/a/privatae-bastion/dcn/x":    "/b/privatae-bastion/dcn/x",
		"/a/privatae-bastion-old/dcn":  "/a/privatae-bastion-old/dcn",
		"/a/other":                     "/a/other",
		"mcp_/a/privatae-bastion/fake": "mcp_/a/privatae-bastion/fake",
	} {
		if got, _ := rebasePath(in, from, to); got != want {
			t.Errorf("rebasePath(%q) = %q, want %q", in, got, want)
		}
	}
}

// A grant file beside a pairing (pairings/<host>.grant.json, anchor.go) is
// not a pairing: it names no Host the service serves, and a service holding
// only one is not one that serves a Host.
func TestACarryCountsOnlyPairingsAsHosts(t *testing.T) {
	from, _ := carryTree(t)
	if err := os.WriteFile(filepath.Join(from, "pairings", "box-one.example.test"+pairingGrantSuffix), []byte(`{}`), 0o600); err != nil {
		t.Fatal(err)
	}
	hosts, err := pairingHosts(from)
	if err != nil {
		t.Fatal(err)
	}
	if strings.Join(hosts, ",") != "box-one.example.test" {
		t.Fatalf("hosts %v, want only box-one.example.test", hosts)
	}
}

// A bastion killed a moment ago (the installer's Stop-Process) can hold its
// run lock for a moment after it is gone; the carry waits for it rather than
// failing the install.
func TestACarryWaitsAMomentForAJustStoppedBastionsLock(t *testing.T) {
	from, to := carryTree(t)
	f, err := os.OpenFile(filepath.Join(from, "run.lock"), os.O_RDWR, 0o600)
	if err != nil {
		t.Fatal(err)
	}
	if err := flockFileNB(f); err != nil {
		t.Fatal(err)
	}
	go func() {
		time.Sleep(300 * time.Millisecond)
		_ = f.Close()
	}()
	res, err := carryStateInto(from, to)
	if err != nil {
		t.Fatalf("a lock released 300 ms in failed the carry: %v", err)
	}
	if strings.Join(res.Hosts, ",") != "box-one.example.test" {
		t.Fatalf("carried %v", res.Hosts)
	}
}

// The account's version of a file the service already has is not lost when
// the account's folder is removed: it is kept beside the service's.
func TestACarryKeepsTheAccountsVersionOfAFileTheServiceHas(t *testing.T) {
	from, to := carryTree(t)
	if err := os.MkdirAll(to, 0o700); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(filepath.Join(to, "ui.secret"), []byte("service secret"), 0o600); err != nil {
		t.Fatal(err)
	}
	res, err := carryStateInto(from, to)
	if err != nil {
		t.Fatal(err)
	}
	if b, _ := os.ReadFile(filepath.Join(to, "ui.secret")); string(b) != "service secret" {
		t.Errorf("the service's own file was replaced: %q", b)
	}
	if b, err := os.ReadFile(filepath.Join(to, "ui.secret"+carryAsideSuffix)); err != nil || string(b) != "account secret" {
		t.Errorf("the account's version is gone with its folder: %q, %v", b, err)
	}
	if line := carryReport(res, from); !strings.Contains(line, carryAsideSuffix) {
		t.Errorf("the install does not say where the account's version went: %q", line)
	}
}

// A state folder that is a link to elsewhere is walked as nothing at all; the
// carry must not report the pairings moved, nor remove anything, when the
// service did not get them.
func TestACarryRemovesNothingUnlessTheServiceHasEveryPairing(t *testing.T) {
	from, to := carryTree(t)
	link := filepath.Join(filepath.Dir(filepath.Dir(from)), "linked", "privatae-bastion")
	if err := os.MkdirAll(filepath.Dir(link), 0o700); err != nil {
		t.Fatal(err)
	}
	if err := os.Symlink(from, link); err != nil {
		t.Skipf("no symlinks here: %v", err)
	}
	if _, err := carryStateInto(link, to); err == nil {
		t.Fatal("the carry reported success with no pairing in the service")
	}
	if _, err := os.Lstat(link); err != nil {
		t.Errorf("the account's state folder was removed: %v", err)
	}
	if _, err := os.Stat(filepath.Join(from, "pairings", "box-one.example.test.json")); err != nil {
		t.Errorf("the account's pairing was touched: %v", err)
	}
}

// A copy that fails part way takes back what it wrote: a service left with
// some of the pairings would never be carried into again (it serves a Host),
// and would serve those few.
func TestACarryThatFailsPartWayLeavesTheServiceAsItWas(t *testing.T) {
	from, to := carryTree(t)
	second := filepath.Join(from, "pairings", "box-two.example.test.json")
	if err := os.WriteFile(second, []byte(`{"host_name":"box-two.example.test"}`), 0o600); err != nil {
		t.Fatal(err)
	}
	prev := carryWriteFile
	t.Cleanup(func() { carryWriteFile = prev })
	carryWriteFile = func(p string, b []byte, m os.FileMode) error {
		if filepath.Base(p) == "box-two.example.test.json" {
			return errors.New("disk full")
		}
		return prev(p, b, m)
	}
	if _, err := carryStateInto(from, to); err == nil {
		t.Fatal("a failed copy reported success")
	}
	if hosts, _ := pairingHosts(to); len(hosts) != 0 {
		t.Errorf("the service was left serving %v of the account's pairings", hosts)
	}
	if b, err := os.ReadFile(filepath.Join(to, "ui.secret")); err == nil {
		t.Errorf("a file the failed copy wrote was left in the service: %q", b)
	}
	if _, err := os.Stat(second); err != nil {
		t.Errorf("the account's state was touched: %v", err)
	}
}

// Once the service holds every pairing, a source folder that cannot be
// removed is said, not a failure: failing would leave the service stopped,
// and the machine as silent as the empty start this carry replaces.
func TestACarryWhoseSourceCannotBeRemovedStillSucceeds(t *testing.T) {
	from, to := carryTree(t)
	prev := carryRemoveAll
	t.Cleanup(func() { carryRemoveAll = prev })
	carryRemoveAll = func(string) error { return errors.New("in use by another process") }
	res, err := carryStateInto(from, to)
	if err != nil {
		t.Fatalf("a carry that moved every pairing failed the install: %v", err)
	}
	if hosts, _ := pairingHosts(to); strings.Join(hosts, ",") != "box-one.example.test" {
		t.Errorf("the service holds %v", hosts)
	}
	if line := carryReport(res, from); !strings.Contains(line, "delete that folder") {
		t.Errorf("the install does not say the account's copy is still there: %q", line)
	}
}