package main

import (
	"encoding/json"
	"os"
	"path/filepath"
	"strings"
	"testing"
)

// The manifest keeps the bot token and this channel's state from every agent (novox/hq ADR 0259 §8): the
// bundle runs as the module's own account, which owns its state directory and its secret; it claims one kind
// on both benches, with what it promises; and it names nothing of one installation.
func TestItRunsAsItsOwnAccountWhichAloneHoldsTheToken(t *testing.T) {
	raw, err := os.ReadFile(filepath.Join("..", "..", "module.json"))
	if err != nil {
		t.Fatal(err)
	}
	var m struct {
		Claims []struct {
			Name, Scope, Kind string
			Capabilities      []string
		}
		Own       map[string]string `json:"own-secrets"`
		Owner     string            `json:"secrets-owner"`
		RunsAs    string            `json:"runs-as"`
		Resources []map[string]any
		Build     struct {
			Artifacts []struct {
				Env map[string]string
			}
		}
	}
	if err := json.Unmarshal(raw, &m); err != nil {
		t.Fatal(err)
	}
	if len(m.Claims) != 2 || m.Claims[0].Name != "channel" || m.Claims[0].Kind != Kind || m.Claims[1].Name != "intake" ||
		m.Claims[1].Kind != Kind {
		t.Fatalf("claims %+v", m.Claims)
	}
	promises := strings.Join(m.Claims[0].Capabilities, " ")
	for _, c := range []string{"reaches-away", "choice", "verified-sender", "edit", "max-length:4096"} {
		if !strings.Contains(promises, c) {
			t.Errorf("it does not promise %s", c)
		}
	}
	env := m.Build.Artifacts[0].Env
	if m.RunsAs != "telegram" || env["MESH_TELEGRAM_TOKEN_FILE"] != m.Own["telegram-token"] || m.Owner != "telegram" ||
		m.Own["broker"] == "" {
		t.Fatalf("runs as %q, env %v, secrets %v, owner %q", m.RunsAs, env, m.Own, m.Owner)
	}
	var account, state bool
	for _, r := range m.Resources {
		switch r["type"] {
		case "user":
			account = r["name"] == "telegram" && r["shell"] == "/usr/bin/nologin"
		case "directory":
			state = r["id"] == "state" && r["owner"] == "telegram" && r["mode"] == "0700"
		}
	}
	if !account || !state {
		t.Errorf("the account %v, its state %v", account, state)
	}
	for _, never := range []string{"/home/", "jochen", "g14", "shanks", "novox", "api.telegram"} {
		if strings.Contains(strings.ToLower(string(raw)), never) {
			t.Errorf("module.json names %q", never)
		}
	}
}