package main

import (
	"testing"

	"github.com/novox/mesh-controller/internal/catalogue"
)

// TestReplay401 replays novox/hq issue 401 (2026-10-10): the mounts module's smb-credentials, an own secret
// only an outside party issues, was given by nobody, and the send made a random value for it and placed it on
// the machine; the module read it as a credential given and wrong. The outcome asserted (ADR 0228): the send
// makes no value for an own secret issued outside the mesh that nobody gave and places none, and a value the
// mesh made for it before is not placed either; once a person gives one, that value is placed. Written with
// only what the controller had before its fix (mesh-controller #262) — register, assign, planFor,
// declarationFor and the inventory's secret reads — so it is laid over the commit before. Needs the store
// (MESH_TEST_POSTGRES), and is named in testdata/store-tests.
func TestReplay401(t *testing.T) {
	open := aMesh(t)
	ctx := t.Context()
	const made, outside = "/var/lib/mesh/mounts/password", "/var/lib/mesh/mounts/smb-credentials"
	register(t, open, catalogue.Manifest{Module: "mounts", Version: "1",
		OwnSecrets: catalogue.OwnSecrets{
			"password":        {Path: made, Taken: catalogue.TakenAtStart},
			"smb-credentials": {Path: outside, Taken: catalogue.TakenAtStart, IssuedBy: catalogue.IssuedOutside},
		},
		Resources: []map[string]any{
			{"id": "state", "type": "directory", "path": "/var/lib/mesh/mounts", "mode": "0700"},
		}})
	if _, err := assign(ctx, open, "laptop", "mounts"); err != nil {
		t.Fatal(err)
	}
	sent := func() []map[string]any {
		t.Helper()
		plan, settings, err := planFor(ctx, open, "laptop")
		if err != nil {
			t.Fatal(err)
		}
		declared, err := declarationFor(ctx, open, "laptop", plan, settings)
		if err != nil {
			t.Fatalf("the send to laptop did not compose: %v", err)
		}
		return declared.Resources
	}
	placed := func(resources []map[string]any, path string) map[string]any {
		for _, r := range resources {
			if r["path"] == path && r["sealed"] != nil {
				return r
			}
		}
		return nil
	}

	first := sent()
	if placed(first, made) == nil {
		t.Fatal("the secret the mesh makes was not placed")
	}
	if got := placed(first, outside); got != nil {
		t.Errorf("the send placed a value for smb-credentials, which nobody gave: %v", got)
	}
	if _, held, err := open.inventory.ModuleSecretIfIssued(ctx, "laptop", "mounts", "smb-credentials"); err != nil || held {
		t.Fatalf("the send made a value for a secret issued outside the mesh (held %v, %v)", held, err)
	}

	// A value the mesh made for it before the rule is not one a person gave: it is not placed.
	if _, err := open.inventory.SecretForModule(ctx, "laptop", "mounts", "smb-credentials"); err != nil {
		t.Fatal(err)
	}
	if got := placed(sent(), outside); got != nil {
		t.Fatalf("a value the mesh made for a secret issued outside was placed: %v", got)
	}

	// Given by a person, it is placed, as given.
	if err := open.inventory.AcceptSecretForModule(ctx, "laptop", "mounts", "smb-credentials", "the share's credentials"); err != nil {
		t.Fatal(err)
	}
	given, held, err := open.inventory.ModuleSecretIfIssued(ctx, "laptop", "mounts", "smb-credentials")
	if err != nil || !held {
		t.Fatalf("the value given is not held (%v)", err)
	}
	if got := placed(sent(), outside); got == nil || got["sealed"] != given {
		t.Fatalf("the value given is placed as %v", got)
	}
}