package inventory

import (
	"context"
	"encoding/json"
	"testing"
)

// The box the vault sealed a core credential in is kept per machine, module and name, replaced by a newer one, and
// gone with its machine (issue 755).
func TestACoreCredentialsVaultBoxIsKeptPerMachineAndReplaced(t *testing.T) {
	inv := fresh(t)
	ctx := context.Background()
	if _, err := inv.AddNode(ctx, "anchor"); err != nil {
		t.Fatal(err)
	}
	first := CoreBox{Module: "nats", Name: "broker", Generation: 1, SealedTo: "a2V5",
		Box: json.RawMessage(`{"v":1,"eph":"ZQ==","iv":"aQ==","tag":"dA==","ct":"MQ=="}`)}
	if err := inv.KeepCoreBox(ctx, "anchor", first); err != nil {
		t.Fatal(err)
	}
	second := first
	second.Generation, second.Box = 2, json.RawMessage(`{"v":1,"eph":"ZQ==","iv":"aQ==","tag":"dA==","ct":"Mg=="}`)
	if err := inv.KeepCoreBox(ctx, "anchor", second); err != nil {
		t.Fatal(err)
	}
	kept, err := inv.KeptCoreBoxes(ctx, "anchor")
	if err != nil {
		t.Fatal(err)
	}
	got := kept["nats"]["broker"]
	var box map[string]any
	_ = json.Unmarshal(got.Box, &box)
	if len(kept) != 1 || got.Generation != 2 || got.SealedTo != "a2V5" || box["ct"] != "Mg==" || got.GotAt.IsZero() {
		t.Fatalf("kept %+v", kept)
	}
	if err := inv.KeepCoreBox(ctx, "nowhere", first); err == nil {
		t.Error("a box was kept for a machine the mesh does not know")
	}
	if err := inv.KeepCoreBox(ctx, "anchor", CoreBox{Module: "nats", Name: "broker", Generation: 3, SealedTo: "a2V5",
		Box: json.RawMessage(`not json`)}); err == nil {
		t.Error("a box that is not whole was kept")
	}
	if others, err := inv.KeptCoreBoxes(ctx, "laptop"); err != nil || len(others) != 0 {
		t.Errorf("another machine has %v, %v", others, err)
	}
}