package main

import (
	"testing"

	"github.com/novox/mesh-controller/internal/catalogue"
)

// TestReplay164 replays novox/hq issue 164 (found provisioning the media machine's modules, re-checked
// 2026-10-08): a Servarr app's API key, an indexer's key and a downloader's password are values the provider's
// software holds and only a person can give, and for a consumer of such a provision the send made a random pair
// credential, sealed it to both ends and placed it; the provider refused it, and a consumer retrying it could be
// banned by the provider. The outcome asserted (ADR 0337): for a provision whose offer says its credential is
// issued outside the mesh, the send makes no value and places none, the consumer's machine still composes, and a
// value a person gave for the pair is placed. Written with only what the controller had before its fix —
// register, assign, planFor, declarationFor, AcceptSecretForPair and the inventory's secret reads — so it is laid
// over the commit before. Needs the store (MESH_TEST_POSTGRES), and is named in testdata/store-tests.
func TestReplay164(t *testing.T) {
	open := aMesh(t)
	ctx := t.Context()
	const secretFile = "/var/lib/mesh/requests/tv-api.secret"
	register(t, open, catalogue.Manifest{Module: "tv", Version: "1",
		Provides: []catalogue.Offer{{Name: "tv-api", Scope: catalogue.ScopeMesh,
			Credential: &catalogue.OfferCredential{IssuedBy: catalogue.IssuedOutside}}},
		Serves: map[string]map[string]any{"tv-api": {"port": 8989}}})
	register(t, open, catalogue.Manifest{Module: "requests", Version: "1", Requires: []string{"tv-api"},
		Secrets: map[string]string{"tv-api": secretFile}})
	for _, a := range [][2]string{{"anchor", "tv"}, {"laptop", "requests"}} {
		if _, err := assign(ctx, open, a[0], a[1]); err != nil {
			t.Fatal(err)
		}
	}
	sent := func() []map[string]any {
		t.Helper()
		plan, settings, err := planFor(ctx, open, "laptop")
		if err != nil {
			t.Fatalf("the consumer's machine was refused for a credential only a person gives: %v", err)
		}
		declared, err := declarationFor(ctx, open, "laptop", plan, settings)
		if err != nil {
			t.Fatalf("the send to laptop did not compose: %v", err)
		}
		return declared.Resources
	}
	placed := func(resources []map[string]any) map[string]any {
		for _, r := range resources {
			if r["path"] == secretFile && r["sealed"] != nil {
				return r
			}
		}
		return nil
	}

	if got := placed(sent()); got != nil {
		t.Errorf("the send placed a credential for tv-api (%v), which only a person can give and nobody gave", got["id"])
	}
	held, err := open.inventory.SecretsOf(ctx, "laptop", "requests")
	if err != nil {
		t.Fatal(err)
	}
	for _, s := range held {
		if s.Name == "tv-api" {
			t.Fatalf("the mesh holds a value for tv-api that nobody gave (origin %q)", s.Origin)
		}
	}

	// Given by a person for the pair, it is placed, as given.
	if err := open.inventory.AcceptSecretForPair(ctx, "tv-api", "laptop", "requests", "anchor", "", "the app's key"); err != nil {
		t.Fatal(err)
	}
	if placed(sent()) == nil {
		t.Fatal("the value a person gave for tv-api was not placed")
	}
}