package updateagent

import (
	"context"
	"io"
	"log/slog"
	"os"
	"path/filepath"
	"testing"
)

func TestValidateServerConfigRejectsUnsafeSocketPaths(t *testing.T) {
	t.Parallel()
	valid := ServerConfig{
		Socket:          "/run/domain-control-update/agent.sock",
		DockerSocket:    "/var/run/docker.sock",
		ImageRepository: defaultImageRepository,
		TargetLabel:     "de.j-mahler.domain-control.role=app",
	}
	if err := validateServerConfig(valid); err != nil {
		t.Fatalf("valid config rejected: %v", err)
	}
	for _, socket := range []string{"agent.sock", "/agent.sock", "/var/run/docker.sock"} {
		candidate := valid
		candidate.Socket = socket
		if err := validateServerConfig(candidate); err == nil {
			t.Errorf("unsafe socket path %q was accepted", socket)
		}
	}
}

func TestServeDoesNotDeleteRegularFileAtSocketPath(t *testing.T) {
	t.Parallel()
	directory := t.TempDir()
	socket := filepath.Join(directory, "agent.sock")
	if err := os.WriteFile(socket, []byte("keep"), 0o600); err != nil {
		t.Fatal(err)
	}
	config := ServerConfig{
		Socket:          socket,
		DockerSocket:    "/var/run/docker.sock",
		ImageRepository: defaultImageRepository,
		TargetLabel:     "de.j-mahler.domain-control.role=app",
	}
	err := Serve(context.Background(), config, slog.New(slog.NewTextHandler(io.Discard, nil)))
	if err == nil {
		t.Fatal("regular file at the socket path was silently replaced")
	}
	content, readErr := os.ReadFile(socket)
	if readErr != nil || string(content) != "keep" {
		t.Fatalf("regular file was changed: content=%q err=%v", content, readErr)
	}
}