package resolution

import (
	"strings"
	"testing"

	mcat "git.novox.be/novox/mesh-sdk/go/catalogue"
)

// aProviderWithABundle is a provider whose code is a bundle the node's runtime runs — the shape
// every TypeScript provisioner has since ADR 0198.
func aProviderWithABundle() mcat.Manifest {
	return mcat.Manifest{
		Module: "mongodb", Version: "1",
		Provides: mcat.FromAnywhere("mongodb-database"),
		Receives: map[string]string{"mongodb-database": "/var/lib/mongodb/grants/mesh.json"},
		Grants:   map[string]string{"mongodb-database": "/var/lib/mongodb/grants"},
		Bundles:  []mcat.Bundle{{Name: "code", Language: "typescript"}},
		Resources: []map[string]any{{
			"id": "server", "type": "container", "name": "mongodb-server",
			"image": "mongo@sha256:" + strings.Repeat("a", 64),
		}},
	}
}

func TestAGrantSecretIsOwnedByTheAccountThatProvisions(t *testing.T) {
	r, err := Resolve(shelf(aProviderWithABundle()), []string{"mongodb"}, reachable(), mcat.World{})
	if err != nil {
		t.Fatal(err)
	}
	r.Account = "operator"
	out, err := Declaration(r, mcat.Rendering{Grants: []mcat.Grant{{
		Provision: "mongodb-database", Consumer: "workstation", From: "photos", Slug: "photos",
		Values: map[string]any{}, Sealed: "c2VhbGVk",
	}}})
	if err != nil {
		t.Fatal(err)
	}

	var secret map[string]any
	for _, res := range out {
		if res["type"] == "file" && strings.HasSuffix(fmtPath(res), ".secret") {
			secret = res
		}
	}
	if secret == nil {
		t.Fatalf("no grant secret was composed at all: %v", out)
	}
	if got := secret["owner"]; got != "operator" {
		t.Fatalf("the grant secret at %v belongs to %v; the provisioner runs as %q and a "+
			"root-owned 0600 file is one it cannot read — which is silent, because the harness "+
			"calls it \"not readable yet\"", fmtPath(secret), got, "operator")
	}
	// A grant whose offer presents no credential (form none, issue 1126) carries nothing sealed: no secret file is
	// written for it, as none is for a need with no credential, and the provider still learns who asked.
	out, err = Declaration(r, mcat.Rendering{Grants: []mcat.Grant{{
		Provision: "mongodb-database", Consumer: "workstation", From: "photos", Slug: "photos", Values: map[string]any{}}}})
	if err != nil {
		t.Fatal(err)
	}
	asked := false
	for _, res := range out {
		if res["type"] == "file" && strings.HasSuffix(fmtPath(res), ".secret") {
			t.Errorf("a grant with no credential writes %v", res)
		}
		asked = asked || fmtPath(res) == "/var/lib/mongodb/grants/mesh.json"
	}
	if !asked {
		t.Errorf("the provider no longer learns who asked: %v", out)
	}
}

// And a provider whose code still runs in a container keeps the owner it declares, so this
// changes nothing for the modules the runtime has not taken.
func TestAContainerProvidersGrantSecretKeepsItsDeclaredOwner(t *testing.T) {
	m := aProviderWithABundle()
	m.Bundles = nil
	m.SecretsOwner = "65534:65534"
	r, err := Resolve(shelf(m), []string{"mongodb"}, reachable(), mcat.World{})
	if err != nil {
		t.Fatal(err)
	}
	r.Account = "operator"
	out, err := Declaration(r, mcat.Rendering{Grants: []mcat.Grant{{
		Provision: "mongodb-database", Consumer: "workstation", From: "photos", Slug: "photos",
		Values: map[string]any{}, Sealed: "c2VhbGVk",
	}}})
	if err != nil {
		t.Fatal(err)
	}
	for _, res := range out {
		if res["type"] == "file" && strings.HasSuffix(fmtPath(res), ".secret") {
			if got := res["owner"]; got != "65534:65534" {
				t.Fatalf("a container provider's grant secret belongs to %v, not what it declares", got)
			}
			return
		}
	}
	t.Fatal("no grant secret was composed")
}

func fmtPath(r map[string]any) string {
	p, _ := r["path"].(string)
	return p
}