// SPDX-License-Identifier: AGPL-3.0-only

package transport

import (
	"bufio"
	"bytes"
	"context"
	"crypto/sha256"
	"encoding/hex"
	"io"
	"os"
	"path/filepath"
	"slices"
	"testing"
)

type captureRunner struct {
	name  string
	args  []string
	input []byte
	calls int
}

func (runner *captureRunner) Run(_ context.Context, name string, args []string, input io.Reader) ([]byte, error) {
	runner.calls++
	runner.name = name
	runner.args = append([]string(nil), args...)
	runner.input, _ = io.ReadAll(input)
	return []byte(`{"validated":true,"mutation":"activated"}`), nil
}

func TestPushUsesPinnedSSHAndExactFrame(t *testing.T) {
	dir := t.TempDir()
	knownHosts := filepath.Join(dir, "known_hosts")
	identity := filepath.Join(dir, "identity")
	artifact := filepath.Join(dir, "release.tar.gz")
	if err := os.WriteFile(knownHosts, []byte("host key\n"), 0o644); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(identity, []byte("private\n"), 0o600); err != nil {
		t.Fatal(err)
	}
	content := []byte("artifact")
	if err := os.WriteFile(artifact, content, 0o600); err != nil {
		t.Fatal(err)
	}
	hash := sha256.Sum256(content)
	digest := hex.EncodeToString(hash[:])
	runner := &captureRunner{}
	result, err := Push(context.Background(), runner, PushOptions{Target: "tend-deploy@example.test", Port: 2222, KnownHosts: knownHosts, Identity: identity, Service: "example-site", Artifact: artifact, SHA256: digest, ApprovedSHA256: digest, Activate: true})
	if err != nil {
		t.Fatal(err)
	}
	if !bytes.Contains(result, []byte(`"activated"`)) || runner.calls != 1 || runner.name != "ssh" {
		t.Fatalf("result=%s calls=%d name=%q", result, runner.calls, runner.name)
	}
	if !slices.Contains(runner.args, "ProxyCommand=none") || !slices.Contains(runner.args, "StrictHostKeyChecking=yes") || runner.args[len(runner.args)-1] != Protocol {
		t.Fatalf("args=%#v", runner.args)
	}
	reader := bufio.NewReader(bytes.NewReader(runner.input))
	header, err := ReadHeader(reader)
	if err != nil {
		t.Fatal(err)
	}
	var copied bytes.Buffer
	if err = CopyArtifact(&copied, reader, header, 1<<20); err != nil {
		t.Fatal(err)
	}
	if copied.String() != string(content) || header.Service != "example-site" || !header.Activate {
		t.Fatalf("header=%+v body=%q", header, copied.String())
	}
}

func TestPushRejectsShellTargetBeforeExecution(t *testing.T) {
	runner := &captureRunner{}
	_, err := Push(context.Background(), runner, PushOptions{Target: "root@example.test;touch", Port: 22})
	if err == nil || runner.calls != 0 {
		t.Fatalf("err=%v calls=%d", err, runner.calls)
	}
}