//go:build selfupdate_qualification

package main

import (
	"os"
	"path/filepath"
	"runtime"
	"testing"

	"gitgud.io/mike/mpv-manager/pkg/version"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

func TestValidateFixtureIdentities(t *testing.T) {
	oldIdentity := version.BinaryIdentity{
		Product: version.ProductID, Component: version.ComponentID,
		Version: "1.2.99", GOOS: runtime.GOOS, GOARCH: runtime.GOARCH,
	}
	newIdentity := oldIdentity
	newIdentity.Version = "1.3.0"
	require.NoError(t, validateFixtureIdentities(oldIdentity, newIdentity))

	newIdentity.GOARCH = "wrong"
	assert.ErrorContains(t, validateFixtureIdentities(oldIdentity, newIdentity), "must match native")
}

func TestDriverContainmentRequiresCapabilityAndOwnedPaths(t *testing.T) {
	root := t.TempDir()
	caseDir := filepath.Join(root, "commit")
	require.NoError(t, os.Mkdir(caseDir, 0o700))
	executable := filepath.Join(caseDir, executableName("primary"))
	secondary := filepath.Join(caseDir, executableName("secondary"))
	require.NoError(t, os.WriteFile(executable, []byte("old"), 0o700))
	require.NoError(t, os.WriteFile(secondary, []byte("old"), 0o700))
	capability, err := createQualificationCapability(root)
	require.NoError(t, err)

	opts := options{
		rootPath:   root,
		capability: capability,
		secondary:  secondary,
		resultPath: filepath.Join(caseDir, "result.json"),
		updateURL:  "http://127.0.0.1:12345/payload",
		expected: version.BinaryIdentity{
			Product: version.ProductID, Component: version.ComponentID,
			Version: "1.3.0", GOOS: runtime.GOOS, GOARCH: runtime.GOARCH,
		},
	}
	require.NoError(t, validateDriverContainment(opts, executable))

	wrongCapability := opts
	wrongCapability.capability = "wrong"
	assert.ErrorContains(t, validateDriverContainment(wrongCapability, executable), "invalid qualifier capability")

	outside := filepath.Join(t.TempDir(), executableName("outside"))
	require.NoError(t, os.WriteFile(outside, []byte("outside"), 0o700))
	outOfRoot := opts
	outOfRoot.secondary = outside
	assert.ErrorContains(t, validateDriverContainment(outOfRoot, executable), "path escapes qualifier root")

	nonLoopback := opts
	nonLoopback.updateURL = "https://example.com/payload"
	assert.ErrorContains(t, validateDriverContainment(nonLoopback, executable), "loopback HTTP")
}

func TestRequirePathWithinRootRejectsSymlinkEscape(t *testing.T) {
	if runtime.GOOS == "windows" {
		t.Skip("symlink creation requires elevated privileges on Windows")
	}
	root := t.TempDir()
	outside := t.TempDir()
	link := filepath.Join(root, "escape")
	require.NoError(t, os.Symlink(outside, link))

	err := requirePathWithinRoot(root, filepath.Join(link, "result.json"), true)
	assert.ErrorContains(t, err, "path escapes qualifier root")
}

func TestParseOptionsRejectsJSONWithoutVersion(t *testing.T) {
	_, err := parseOptions([]string{"--json"})
	assert.ErrorContains(t, err, "requires --version")
}

func TestIsolatedEnvironmentReplacesConfigLocations(t *testing.T) {
	t.Setenv("HOME", "real-home")
	t.Setenv("APPDATA", "real-appdata")
	environment := isolatedEnvironment("isolated")
	assert.Contains(t, environment, "HOME=isolated")
	assert.Contains(t, environment, "APPDATA=isolated")
	assert.NotContains(t, environment, "HOME=real-home")
	assert.NotContains(t, environment, "APPDATA=real-appdata")
}