//! Tests for [`super`].

/// The shipped `sando.toml` must parse with the base-image declarations in
/// it, and the values must be the ones measured on the boxes. A declaration
/// that silently fails to deserialize is worse than none: the node would be
/// treated as undeclared, skipped, and the deploy log would say so in a line
/// nobody reads.
#[test]
fn the_shipped_topology_declares_what_each_node_is() {
    let raw = std::fs::read_to_string(
        std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../sando.toml"),
    )
    .expect("the repo's sando.toml must be readable from the daemon crate");
    let topo: Topology = toml::from_str(&raw).expect("sando.toml must parse");

    let nodes: Vec<&Node> = topo.tiers.iter().flat_map(|t| t.nodes.iter()).collect();
    let by = |name: &str| {
        *nodes
            .iter()
            .find(|n| n.name.as_str() == name)
            .unwrap_or_else(|| panic!("`{name}` must be in the topology"))
    };
    let image = |n: &Node| n.base_image.as_ref().map(ToString::to_string);

    // Measured 2026-08-25. Staging is deliberately NOT the same base as
    // production, and the assertion below says so out loud: tier A does not
    // rehearse tier B on the axis these fields exist for.
    let testnot = by("testnot-1");
    assert_eq!(image(testnot).as_deref(), Some("ubuntu/26.04"));
    assert_eq!(testnot.libc.as_deref(), Some("2.43"));

    let prod = by("prod-1");
    assert_eq!(image(prod).as_deref(), Some("ubuntu/24.04"));
    assert_eq!(prod.libc.as_deref(), Some("2.39"));

    assert_ne!(
        testnot.base_image, prod.base_image,
        "if these ever match, delete this assertion and the comment in \
             sando.toml that explains why they do not"
    );
}

use super::*;

/// A minimal topology with one serving tier whose gate block is `gates`.
fn topo_with_serving_gates(provisioned: bool, gates: &str) -> Topology {
    let raw = format!(
        r#"
[repo]
bare_path = "/tmp/repo.git"
branch = "main"

[backup]
source = "ssh://prod/dump.sql.gz"
local_path = "/tmp/dump.sql.gz"

[[tier]]
name = "b"
provisioned = {provisioned}
gates = [{gates}]
[[tier.node]]
name = "prod-1"
ssh_target = "prod-1"
release_root = "/srv/mnw"
"#
    );
    toml::from_str(&raw).expect("parse test topology")
}

#[test]
fn page_smoke_without_a_public_url_is_rejected_at_load() {
    // The gate's whole value is that it requests the site the way a visitor
    // does. Without a URL it cannot, and a gate that cannot run must not be
    // discovered halfway through a promote.
    let topo = topo_with_serving_gates(true, r#"{ kind = "page_smoke" }"#);
    let err = topo.validate_for_test().expect_err("must refuse");
    assert!(
        err.to_string().contains("public_url"),
        "error should name the missing field: {err}"
    );
}

#[test]
fn page_smoke_with_a_public_url_loads() {
    let raw = r#"
[repo]
bare_path = "/tmp/repo.git"
branch = "main"

[backup]
source = "ssh://prod/dump.sql.gz"
local_path = "/tmp/dump.sql.gz"

[[tier]]
name = "a"
provisioned = true
public_url = "https://testnot.work"
gates = [{ kind = "page_smoke" }]
[[tier.node]]
name = "testnot-1"
ssh_target = "testnot-1"
release_root = "/srv/mnw"
"#;
    let topo: Topology = toml::from_str(raw).expect("parse");
    topo.validate_for_test().expect("valid");
    assert_eq!(
        topo.tiers[0].public_url.as_deref(),
        Some("https://testnot.work")
    );
    // It guards promotion out of its tier, and it runs after the deploy
    // rather than on the build host -- both are the point of it.
    assert!(topo.tiers[0].gates[0].guards_promotion());
    assert!(topo.tiers[0].gates[0].runs_post_deploy());
}

#[test]
fn provisioned_serving_tier_with_no_gates_is_rejected() {
    let topo = topo_with_serving_gates(true, "");
    let err = topo.validate_for_test().unwrap_err().to_string();
    assert!(err.contains("no promotion gate"), "{err}");
}

#[test]
fn provisioned_serving_tier_with_only_build_gates_is_rejected() {
    // cargo_test / migration_dry_run are build-time and prove nothing about a
    // promote, so a serving tier carrying only them still fails closed.
    let topo = topo_with_serving_gates(
        true,
        r#"{ kind = "cargo_test" }, { kind = "migration_dry_run" }"#,
    );
    let err = topo.validate_for_test().unwrap_err().to_string();
    assert!(err.contains("no promotion gate"), "{err}");
}

#[test]
fn provisioned_serving_tier_with_a_promotion_gate_is_accepted() {
    let topo = topo_with_serving_gates(true, r#"{ kind = "node_health" }"#);
    assert!(topo.validate_for_test().is_ok());
}

#[test]
fn provisioned_serving_tier_with_only_boot_smoke_is_rejected() {
    // boot_smoke is a build-host gate now; it proves nothing about a node, so
    // a serving tier carrying only boot_smoke must fail closed exactly like an
    // empty gate list (Run-2 SERIOUS-3 structural close).
    let topo = topo_with_serving_gates(true, r#"{ kind = "boot_smoke" }"#);
    let err = topo.validate_for_test().unwrap_err().to_string();
    assert!(err.contains("no promotion gate"), "{err}");
}

#[test]
fn unprovisioned_tier_with_empty_gates_is_skipped() {
    // A declared-but-not-yet-provisioned tier (e.g. tier c) carries no
    // promote authority, so the gate requirement does not apply yet.
    let topo = topo_with_serving_gates(false, "");
    assert!(topo.validate_for_test().is_ok());
}

#[test]
fn build_host_matching_a_serving_node_is_rejected() {
    // prod-1 is a node in the provisioned serving tier built above; naming it
    // as the builder must fail closed.
    let topo = topo_with_serving_gates(true, r#"{ kind = "node_health" }"#);
    let err = topo
        .ensure_build_host_not_serving("prod-1")
        .unwrap_err()
        .to_string();
    assert!(err.contains("must not be a prod/serving node"), "{err}");
}

#[test]
fn build_host_distinct_from_serving_nodes_is_accepted() {
    let topo = topo_with_serving_gates(true, r#"{ kind = "node_health" }"#);
    assert!(topo.ensure_build_host_not_serving("fw13").is_ok());
}

#[test]
fn node_companions_default_empty_and_parse_when_present() {
    // A node without [[tier.node.companion]] is server-only.
    let plain = topo_with_serving_gates(true, r#"{ kind = "node_health" }"#);
    assert!(plain.tiers[0].nodes[0].companions.is_empty());

    // A node that declares a companion carries its install target + unit.
    let raw = r#"
[repo]
bare_path = "/tmp/repo.git"
branch = "main"
[backup]
source = "s"
local_path = "/tmp/d"
[[tier]]
name = "b"
provisioned = true
gates = [{ kind = "node_health" }]
[[tier.node]]
name = "prod-1"
ssh_target = "makenotwork@alpha-west-1"
release_root = "/opt/mnw"
[[tier.node.companion]]
name = "mnw-cli"
install_path = "/opt/mnw-cli/mnw-cli"
service_name = "mnw-cli.service"
"#;
    let topo: Topology = toml::from_str(raw).expect("parse companion topology");
    let c = &topo.tiers[0].nodes[0].companions;
    assert_eq!(c.len(), 1);
    assert_eq!(c[0].name, "mnw-cli");
    assert_eq!(c[0].install_path, "/opt/mnw-cli/mnw-cli");
    assert_eq!(c[0].service_name, "mnw-cli.service");
}

/// A topology whose one node installs the named companions.
fn topo_installing(names: &[&str]) -> Topology {
    let mut blocks = String::new();
    for n in names {
        use std::fmt::Write;
        let _ = write!(
            blocks,
            "[[tier.node.companion]]\nname = \"{n}\"\n\
                 install_path = \"/opt/{n}/{n}\"\nservice_name = \"{n}.service\"\n"
        );
    }
    let raw = format!(
        r#"
[repo]
bare_path = "/tmp/repo.git"
branch = "main"
[backup]
source = "s"
local_path = "/tmp/d"
[[tier]]
name = "b"
provisioned = true
gates = [{{ kind = "node_health" }}]
[[tier.node]]
name = "prod-1"
ssh_target = "makenotwork@alpha-west-1"
release_root = "/opt/mnw"
{blocks}"#
    );
    toml::from_str(&raw).expect("parse topology")
}

fn built(names: &[&str]) -> Vec<crate::config::Companion> {
    names
        .iter()
        .map(|n| crate::config::Companion {
            name: (*n).to_string(),
            manifest_dir: (*n).into(),
            bin: (*n).to_string(),
        })
        .collect()
}

fn test_target(dir: &str, aux_repo: Option<&str>) -> crate::config::TestTarget {
    crate::config::TestTarget {
        dir: dir.into(),
        aux_repo: aux_repo.map(str::to_string),
        features: Vec::new(),
        all_features: false,
        scratch_db: false,
    }
}

#[test]
fn a_test_target_naming_a_checked_out_aux_repo_is_accepted() {
    let topo = topo_with_aux(
            "[[aux_repo]]\nname = \"docengine\"\nbare_path = \"/tmp/d.git\"\n\
             upstream = \"git@h:max/d.git\"\nbranch = \"main\"\ncheckout_dir = \"Libraries/docengine\"\n",
        )
        .expect("parse");
    assert!(
        topo.ensure_test_target_aux_repos_exist(&[
            test_target("server", None),
            test_target("", Some("docengine")),
        ])
        .is_ok()
    );
}

#[test]
fn a_test_target_naming_an_unknown_aux_repo_is_rejected_at_load() {
    // The failure this exists to prevent is silent: an unresolvable target
    // is a warn-and-skip (bisect), so the gate stays green having run one
    // crate fewer than the config claims.
    let topo = topo_with_aux(
        "[[aux_repo]]\nname = \"synckit\"\nbare_path = \"/tmp/s.git\"\n\
             upstream = \"git@h:max/s.git\"\nbranch = \"main\"\ncheckout_dir = \"synckit\"\n",
    )
    .expect("parse");
    let err = topo
        .ensure_test_target_aux_repos_exist(&[test_target("", Some("docengine"))])
        .unwrap_err()
        .to_string();
    assert!(err.contains("docengine"), "{err}");
    assert!(err.contains("have: synckit"), "{err}");
}

#[test]
fn test_targets_without_an_aux_repo_need_no_aux_repos_declared() {
    let topo = topo_with_serving_gates(true, r#"{ kind = "node_health" }"#);
    assert!(
        topo.ensure_test_target_aux_repos_exist(&[test_target("server", None)])
            .is_ok()
    );
}

#[test]
fn a_node_companion_the_daemon_builds_is_accepted() {
    let topo = topo_installing(&["mnw-cli", "multithreaded"]);
    assert!(
        topo.ensure_node_companions_are_built(&built(&["mnw-cli", "multithreaded"]))
            .is_ok()
    );
}

#[test]
fn a_node_companion_nothing_builds_is_rejected_at_load() {
    // Left uncaught this fails during the post-swap install on prod, with
    // the server already live on the new version.
    let topo = topo_installing(&["mnw-cli", "multithreadd"]);
    let err = topo
        .ensure_node_companions_are_built(&built(&["mnw-cli", "multithreaded"]))
        .unwrap_err()
        .to_string();
    assert!(err.contains("multithreadd"), "{err}");
    assert!(err.contains("no [[companion]]"), "{err}");
    // The message names what IS available, so the typo is obvious.
    assert!(err.contains("mnw-cli, multithreaded"), "{err}");
}

#[test]
fn a_node_companion_with_no_companions_configured_at_all_is_rejected() {
    let topo = topo_installing(&["multithreaded"]);
    let err = topo
        .ensure_node_companions_are_built(&[])
        .unwrap_err()
        .to_string();
    assert!(err.contains("have: none"), "{err}");
}

#[test]
fn a_topology_installing_no_companions_is_fine_with_none_built() {
    let topo = topo_installing(&[]);
    assert!(topo.ensure_node_companions_are_built(&[]).is_ok());
}

fn topo_with_aux(aux_block: &str) -> Result<Topology> {
    let raw = format!(
        r#"
[repo]
bare_path = "/tmp/repo.git"
branch = "main"
[backup]
source = "s"
local_path = "/tmp/d"
[[tier]]
name = "b"
provisioned = true
gates = [{{ kind = "node_health" }}]
[[tier.node]]
name = "prod-1"
ssh_target = "prod-1"
release_root = "/srv/mnw"
{aux_block}
"#
    );
    let topo: Topology = toml::from_str(&raw)?;
    topo.validate_for_test()?;
    Ok(topo)
}

#[test]
fn aux_repos_default_empty() {
    let topo = topo_with_aux("").expect("no aux_repo block is fine");
    assert!(topo.aux_repos.is_empty());
}

#[test]
fn aux_repo_parses_all_fields() {
    let topo = topo_with_aux(
        r#"
[[aux_repo]]
name = "synckit"
bare_path = "/srv/sando/synckit.git"
upstream = "git@ssh.makenot.work:max/synckit.git"
branch = "main"
checkout_dir = "synckit""#,
    )
    .expect("valid aux_repo parses");
    assert_eq!(topo.aux_repos.len(), 1);
    let a = &topo.aux_repos[0];
    assert_eq!(a.name, "synckit");
    assert_eq!(a.bare_path, "/srv/sando/synckit.git");
    assert_eq!(a.upstream, "git@ssh.makenot.work:max/synckit.git");
    assert_eq!(a.branch, "main");
    assert_eq!(a.checkout_dir, "synckit");
}

#[test]
fn aux_repo_with_nested_checkout_dir_is_accepted() {
    let topo = topo_with_aux(
        r#"
[[aux_repo]]
name = "docengine"
bare_path = "/srv/sando/docengine.git"
upstream = "git@ssh.makenot.work:max/docengine.git"
branch = "main"
checkout_dir = "Libraries/docengine""#,
    )
    .expect("a nested checkout_dir is a valid location");
    assert_eq!(topo.aux_repos[0].checkout_dir, "Libraries/docengine");
}

#[test]
fn aux_repo_with_traversing_checkout_dir_is_rejected() {
    for bad in [
        "../escape",
        "a/../../escape",
        "a/./b",
        "a//b",
        "/abs",
        "a/",
        "..",
        ".",
    ] {
        let err = topo_with_aux(&format!(
            r#"
[[aux_repo]]
name = "x"
bare_path = "/srv/sando/x.git"
upstream = "u"
branch = "main"
checkout_dir = "{bad}""#,
        ))
        .unwrap_err()
        .to_string();
        assert!(err.contains("unsafe checkout_dir"), "for {bad:?}: {err}");
    }
}

#[test]
fn aux_repos_sharing_a_checkout_dir_are_rejected() {
    let err = topo_with_aux(
        r#"
[[aux_repo]]
name = "one"
bare_path = "/srv/sando/one.git"
upstream = "u"
branch = "main"
checkout_dir = "shared"
[[aux_repo]]
name = "two"
bare_path = "/srv/sando/two.git"
upstream = "u"
branch = "main"
checkout_dir = "shared""#,
    )
    .unwrap_err()
    .to_string();
    assert!(err.contains("share or nest checkout_dir"), "{err}");
}

#[test]
fn aux_repo_nested_inside_another_checkout_dir_is_rejected() {
    let err = topo_with_aux(
        r#"
[[aux_repo]]
name = "outer"
bare_path = "/srv/sando/outer.git"
upstream = "u"
branch = "main"
checkout_dir = "Libraries"
[[aux_repo]]
name = "inner"
bare_path = "/srv/sando/inner.git"
upstream = "u"
branch = "main"
checkout_dir = "Libraries/docengine""#,
    )
    .unwrap_err()
    .to_string();
    assert!(err.contains("share or nest checkout_dir"), "{err}");
}

/// A topology whose `[backup]`/`[[backup]]` section is `backup_block`.
fn topo_with_backup_block(backup_block: &str) -> Result<Topology> {
    let raw = format!(
        r#"
[repo]
bare_path = "/tmp/repo.git"
branch = "main"
{backup_block}
[[tier]]
name = "b"
provisioned = true
# migration_dry_run is what makes the backup rules apply at all: a product no
# tier dry-runs migrations for owes no dumps, so a fixture exercising those rules
# has to configure the gate.
gates = [{{ kind = "node_health" }}, {{ kind = "migration_dry_run" }}]
[[tier.node]]
name = "prod-1"
ssh_target = "prod-1"
release_root = "/srv/mnw"
"#
    );
    let topo: Topology = toml::from_str(&raw)?;
    topo.validate_for_test()?;
    Ok(topo)
}

/// A topology with no `[backup]` at all, so the dump rules are exercised
/// by what its gates ask for rather than by what it declares.
fn topo_without_backup(gates: &str) -> Result<Topology> {
    let raw = format!(
        r#"
backup = []

[repo]
bare_path = "/tmp/repo.git"
branch = "main"

[[tier]]
name = "b"
provisioned = true
gates = [{gates}]
[[tier.node]]
name = "prod-1"
ssh_target = "prod-1"
release_root = "/srv/mnw"
"#
    );
    let topo: Topology = toml::from_str(&raw)?;
    topo.validate_for_test()?;
    Ok(topo)
}

#[test]
fn a_product_that_never_dry_runs_migrations_owes_no_dump() {
    // pom is this product: no postgres schema, so no tier configures
    // migration_dry_run and demanding a prod dump would be demanding a
    // fixture for a gate that never runs.
    let topo = topo_without_backup(r#"{ kind = "node_health" }"#)
        .expect("a topology with no migration gate loads without a [backup]");
    assert!(topo.backup.is_empty());
}

#[test]
fn a_migration_dry_run_with_no_backup_is_rejected_at_load() {
    // The gate restores a dump into the scratch database. With nothing
    // declared it would have nothing to restore, and the discovery would
    // come mid-promote.
    let err = topo_without_backup(r#"{ kind = "node_health" }, { kind = "migration_dry_run" }"#)
        .expect_err("a dry-run gate with no dump declared must not load")
        .to_string();
    assert!(err.contains("declares no [backup]"), "{err}");
}

#[test]
fn a_single_backup_table_still_parses_as_one_named_server() {
    // Back-compat is the point: every deployed sando.toml uses the single
    // `[backup]` form, and the box this config lives on is the one whose job
    // is deploying — it must not need an edit to start.
    let topo = topo_with_backup_block(
        r#"
[backup]
source = "ssh://prod/dump.sql.gz"
local_path = "/tmp/dump.sql.gz""#,
    )
    .expect("the single-table form must still load");
    assert_eq!(topo.backup.len(), 1);
    assert_eq!(topo.backup[0].name, "server");
    assert!(topo.backup_named("server").is_some());
}

#[test]
fn a_backup_list_parses_and_keeps_its_names() {
    let topo = topo_with_backup_block(
        r#"
[[backup]]
name = "server"
source = "ssh://prod/makenotwork/latest.sql.gz"
local_path = "/tmp/server.sql.gz"
[[backup]]
name = "multithreaded"
source = "ssh://prod/multithreaded/latest.sql.gz"
local_path = "/tmp/mt.sql.gz""#,
    )
    .expect("the list form must load");
    assert_eq!(topo.backup.len(), 2);
    assert_eq!(
        topo.backup_named("multithreaded").unwrap().local_path,
        "/tmp/mt.sql.gz"
    );
    assert!(topo.backup_named("nope").is_none());
}

#[test]
fn two_backups_sharing_a_name_are_rejected() {
    // They would interleave in `backups`, so the freshness check and the
    // plausibility floor would each read the other's row.
    let err = topo_with_backup_block(
        r#"
[[backup]]
name = "server"
source = "a"
local_path = "/tmp/a.sql.gz"
[[backup]]
name = "server"
source = "b"
local_path = "/tmp/b.sql.gz""#,
    )
    .unwrap_err()
    .to_string();
    assert!(err.contains("share the name"), "{err}");
}

#[test]
fn two_backups_sharing_a_local_path_are_rejected() {
    // Whichever fetched last would be restored for both checks — green, and
    // proving nothing about one of the two databases.
    let err = topo_with_backup_block(
        r#"
[[backup]]
name = "server"
source = "a"
local_path = "/tmp/same.sql.gz"
[[backup]]
name = "multithreaded"
source = "b"
local_path = "/tmp/same.sql.gz""#,
    )
    .unwrap_err()
    .to_string();
    assert!(err.contains("share local_path"), "{err}");
}

#[test]
fn a_migration_check_naming_an_undeclared_backup_is_rejected_at_startup() {
    // Daemon config and topology are separate files, so nothing but this
    // cross-check catches the typo. Uncaught it surfaces as a permanently
    // Blocked gate on the next promote, which reads like a missed fetch.
    let topo = topo_with_backup_block(
        r#"
[backup]
source = "s"
local_path = "/tmp/d""#,
    )
    .unwrap();
    let checks = vec![crate::config::MigrationCheck {
        dir: std::path::PathBuf::from("multithreaded/migrations"),
        backup: "multithreaded".into(),
        scratch_db: Some("sando_scratch_mt".into()),
        owner_role: Some("multithreaded".into()),
    }];
    let err = topo
        .ensure_migration_checks_have_backups(&checks)
        .unwrap_err()
        .to_string();
    assert!(err.contains("which no [[backup]]"), "{err}");

    // And the shipped pair agree, which is the case that actually ships.
    let shipped_checks = crate::config::default_migration_checks_for_test();
    shipped()
        .ensure_migration_checks_have_backups(&shipped_checks)
        .expect("the default server check resolves against the shipped topology");
}

#[test]
fn real_sando_toml_loads_clean() {
    // The shipped topology must satisfy the invariant — guards against a
    // regression that would lock sandod out of its own config.
    let path = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../sando.toml");
    Topology::load(&path).expect("shipped sando.toml must validate");
}

fn shipped() -> Topology {
    let path = std::path::Path::new(env!("CARGO_MANIFEST_DIR")).join("../sando.toml");
    Topology::load(&path).expect("shipped sando.toml must validate")
}

#[test]
fn shipping_to_the_last_provisioned_tier_needs_an_operator_signoff() {
    // A tier's gates guard promotion *out* of it, which is the subtlety that
    // made manual_confirm inert: it sat on tier b, guarding b -> c, and c is
    // not provisioned. So the ship to production was cleared by node_health
    // + burn_in alone — and `hotfix: true` skips burn_in.
    //
    // The gate that matters therefore belongs on the PREDECESSOR of the last
    // provisioned tier. Asserted structurally so re-provisioning tiers cannot
    // silently strand the sign-off again.
    let topo = shipped();
    let last = topo
        .tiers
        .iter()
        .rposition(|t| t.provisioned)
        .expect("some tier must be provisioned");
    assert!(last > 0, "the production tier cannot be the first tier");
    let guard = &topo.tiers[last - 1];
    assert!(
        guard.gates.iter().any(|g| matches!(g, Gate::ManualConfirm)),
        "tier {} guards promotion into the last provisioned tier ({}), so it must              require an operator sign-off; its gates are {:?}",
        guard.name,
        topo.tiers[last].name,
        guard
            .gates
            .iter()
            .map(|g| g.kind().as_str())
            .collect::<Vec<_>>(),
    );
}

#[test]
fn every_serving_node_has_a_readiness_probe() {
    // Without health_url, node_health degrades to `systemctl is-active`,
    // which a crash-looping binary satisfies between restarts — exactly what
    // the 0.10.14 CDN_BASE_URL crash-loop did on prod-1.
    let topo = shipped();
    for tier in topo.tiers.iter().filter(|t| t.provisioned) {
        for node in &tier.nodes {
            assert!(
                node.health_url.is_some(),
                "node {} on tier {} has no health_url, so node_health proves only that                      systemd thinks the unit is running",
                node.name,
                tier.name,
            );
        }
    }
}