package main

// The module's directories (novox/hq issue 1873): its state directory said place ".", which is /var/lib/postgres,
// the postgresql package's own (tmpfiles.d/postgresql.conf: postgres, 0700), and its grants directory, placed by
// default, lay inside it; the node-engine gave /var/lib/postgres to the operator's account. What the module keeps
// moves to the mesh's directory for it, and for one delivery the record "state" states the package's owner and mode,
// so the node-engine, which takes a directory it recorded at the same path under the same id as its own, gives it
// back. The store's data is not touched: it is /var/lib/mesh-store, as before.

import (
	"encoding/json"
	"os"
	"reflect"
	"strings"
	"testing"
)

func postgresManifest(t *testing.T) (map[string]map[string]any, map[string]any) {
	t.Helper()
	raw, err := os.ReadFile("../../module.json")
	if err != nil {
		t.Fatal(err)
	}
	if strings.Contains(string(raw), "${dir:state}") {
		t.Errorf("the manifest still keeps something in ${dir:state}, which is /var/lib/postgres")
	}
	var m map[string]any
	if err := json.Unmarshal(raw, &m); err != nil {
		t.Fatal(err)
	}
	out := map[string]map[string]any{}
	list, _ := m["resources"].([]any)
	for _, x := range list {
		r, _ := x.(map[string]any)
		out[r["id"].(string)] = r
	}
	return out, m
}

// 1873/AC2: secrets, consumers and grants are kept in <data root>/mesh/postgres; "state" gives /var/lib/postgres back
// to postgres, 0700; the store's data and dumps are as they were.
func TestTheModuleKeepsItsFilesOutsideThePackagesDirectory(t *testing.T) {
	rs, m := postgresManifest(t)
	data := rs["data"]
	if data == nil || data["type"] != "directory" || data["place"] != "mesh" || data["path"] != nil || data["mode"] != "0700" {
		t.Fatalf("the module's directory is placed \"mesh\" with no path, 0700 (/var/lib/mesh/postgres): %v", data)
	}
	if g := rs["grants"]; g == nil || g["path"] != "${dir:data}/grants" || g["place"] != nil {
		t.Errorf("grants lies in the module's directory: %v", g)
	}
	if c := rs["consumers"]; c == nil || c["path"] != "${dir:data}/consumers.json" {
		t.Errorf("consumers.json lies in the module's directory: %v", c)
	}
	own, _ := m["own-secrets"].(map[string]any)
	if own["superuser"] != "${dir:data}/superuser.secret" || own["reader"] != "${dir:data}/reader.secret" {
		t.Errorf("the own secrets lie in the module's directory: %v", own)
	}
	state := rs["state"]
	if state == nil || state["type"] != "directory" || state["path"] != "/var/lib/postgres" || state["owner"] != "postgres" ||
		state["mode"] != "0700" || state["place"] != nil {
		t.Errorf("state gives /var/lib/postgres back as postgresql declares it, postgres 0700: %v", state)
	}

	// The store's data, its dumps and how the container reads them: exactly as before.
	if s := rs["store-data"]; !reflect.DeepEqual(s, map[string]any{"id": "store-data", "type": "directory",
		"path": "/var/lib/mesh-store", "mode": "0700", "owner": "999:70", "unknown": "program"}) {
		t.Errorf("store-data changed: %v", s)
	}
	if d := rs["dumps"]; !reflect.DeepEqual(d, map[string]any{"id": "dumps", "type": "directory",
		"path": "${dir:store-data}/dumps", "mode": "0700", "owner": "999:70", "unknown": "program"}) {
		t.Errorf("dumps changed: %v", d)
	}
	server := rs["server"]
	if !reflect.DeepEqual(server["volumes"], []any{"/var/lib/mesh-store:/var/lib/postgresql/data",
		"${dir:data}/superuser.secret:/run/secrets/superuser:ro"}) {
		t.Errorf("the container's volumes: %v", server["volumes"])
	}
	if env, _ := server["env"].(map[string]any); env["PGDATA"] != "/var/lib/postgresql/data/pgdata" {
		t.Errorf("PGDATA changed: %v", env)
	}
	build, _ := m["build"].(map[string]any)
	artifacts, _ := build["artifacts"].([]any)
	env := artifacts[0].(map[string]any)["env"].(map[string]any)
	for key, want := range map[string]string{
		"MESH_PROVISION_PASSWORD_FILE":       "${dir:data}/superuser.secret",
		"MESH_POSTGRES_READER_PASSWORD_FILE": "${dir:data}/reader.secret",
		"MESH_CONSUMERS_FILE":                "${dir:data}/consumers.json",
		"MESH_RECEIVES":                      "${dir:grants}/mesh.json",
	} {
		if env[key] != want {
			t.Errorf("%s is %v, not %s", key, env[key], want)
		}
	}
}