package updateagent

import (
	"context"
	"encoding/json"
	"errors"
	"io"
	"net/http"
	"strconv"
	"strings"
	"sync/atomic"
	"testing"
	"time"

	"github.com/root-kdw12/hetzner-api-dyndns-records-webinterface/internal/buildinfo"
)

type roundTripFunc func(*http.Request) (*http.Response, error)

func (f roundTripFunc) RoundTrip(request *http.Request) (*http.Response, error) {
	return f(request)
}

func TestValidateUpdateCompatibilityAllowsDirectMajorJump(t *testing.T) {
	t.Parallel()
	current := compatibleImage("v1.4.0", "v1.4.0")
	target := compatibleImage("v2.0.0", "v1.4.0")
	if err := validateUpdateCompatibility("v1.4.0", "v2.0.0", current, target); err != nil {
		t.Fatalf("compatible direct update was rejected: %v", err)
	}
}

func TestWaitForDockerAPIRetriesBootTransient(t *testing.T) {
	t.Parallel()
	var calls atomic.Int32
	err := waitForDockerAPI(context.Background(), 100*time.Millisecond, time.Millisecond, func(context.Context) error {
		if calls.Add(1) < 3 {
			return errors.New("Docker is still starting")
		}
		return nil
	})
	if err != nil || calls.Load() != 3 {
		t.Fatalf("Docker boot transient was not retried: calls=%d err=%v", calls.Load(), err)
	}
}

func TestWaitCurrentHealthyAllowsStartingButRejectsUnhealthy(t *testing.T) {
	t.Parallel()
	var calls atomic.Int32
	client := dockerTestClient(func() string {
		if calls.Add(1) == 1 {
			return "starting"
		}
		return "healthy"
	})
	inspected, err := client.waitCurrentHealthy(context.Background(), "container-id", "sha256:current", 100*time.Millisecond, time.Millisecond)
	if err != nil || inspected.State.Health == nil || inspected.State.Health.Status != "healthy" {
		t.Fatalf("starting container did not become eligible: inspect=%#v err=%v", inspected, err)
	}

	unhealthy := dockerTestClient(func() string { return "unhealthy" })
	if _, err := unhealthy.waitCurrentHealthy(context.Background(), "container-id", "sha256:current", 100*time.Millisecond, time.Millisecond); err == nil || !strings.Contains(err.Error(), "unhealthy") {
		t.Fatalf("unhealthy container was not rejected immediately: %v", err)
	}
}

func TestResolveCurrentVersionRequiresRuntimeAndImageMetadataToAgree(t *testing.T) {
	t.Parallel()
	config := json.RawMessage(`{"Image":"registry.example/app:v1.4.0","Labels":{"org.opencontainers.image.version":"v1.4.0"}}`)
	version, err := resolveCurrentVersion("", config, "registry.example/app")
	if err != nil || version != "v1.4.0" {
		t.Fatalf("exact image version was not resolved: version=%q err=%v", version, err)
	}
	if _, err := resolveCurrentVersion("v1.5.0", config, "registry.example/app"); err == nil {
		t.Fatal("untrusted reported version overrode the running image metadata")
	}
	mismatch := json.RawMessage(`{"Image":"registry.example/app:v1.4.0","Labels":{"org.opencontainers.image.version":"v1.3.0"}}`)
	if _, err := resolveCurrentVersion("", mismatch, "registry.example/app"); err == nil {
		t.Fatal("mismatching image reference and label were accepted")
	}
}

func TestValidateUpdateCompatibilityRejectsUnsupportedJump(t *testing.T) {
	t.Parallel()
	tests := []struct {
		name   string
		mutate func(map[string]any)
	}{
		{name: "minimum version", mutate: func(config map[string]any) { config["Labels"].(map[string]string)[labelMinimumVersion] = "v1.5.0" }},
		{name: "runtime contract", mutate: func(config map[string]any) {
			config["Labels"].(map[string]string)[labelRuntimeContract] = strconv.Itoa(buildinfo.RuntimeContractVersion + 1)
		}},
		{name: "database contract", mutate: func(config map[string]any) { config["Labels"].(map[string]string)[labelDatabaseContract] = "2" }},
		{name: "agent protocol", mutate: func(config map[string]any) {
			config["Labels"].(map[string]string)[labelMinimumAgent] = strconv.Itoa(buildinfo.UpdateProtocolVersion + 1)
		}},
		{name: "wrong image version", mutate: func(config map[string]any) { config["Labels"].(map[string]string)[labelImageVersion] = "v1.9.9" }},
		{name: "missing healthcheck", mutate: func(config map[string]any) { delete(config, "Healthcheck") }},
	}
	for _, test := range tests {
		test := test
		t.Run(test.name, func(t *testing.T) {
			t.Parallel()
			image := compatibleImage("v2.0.0", "v1.4.0")
			var config map[string]any
			if err := json.Unmarshal(image.Config, &config); err != nil {
				t.Fatal(err)
			}
			labels := make(map[string]string)
			for key, value := range config["Labels"].(map[string]any) {
				labels[key] = value.(string)
			}
			config["Labels"] = labels
			test.mutate(config)
			image.Config, _ = json.Marshal(config)
			if err := validateUpdateCompatibility("v1.4.0", "v2.0.0", compatibleImage("v1.4.0", "v1.4.0"), image); err == nil {
				t.Fatal("incompatible image was accepted")
			}
		})
	}
}

func TestValidateUpdateCompatibilityRejectsSchemaRegressionAfterEarlierSkip(t *testing.T) {
	t.Parallel()
	current := compatibleImage("v2.0.0", "v1.4.0")
	target := compatibleImage("v2.1.0", "v1.4.0")
	current.Config = withImageLabel(t, current.Config, labelSchemaVersion, "20")
	target.Config = withImageLabel(t, target.Config, labelSchemaVersion, "19")
	if err := validateUpdateCompatibility("v2.0.0", "v2.1.0", current, target); err == nil {
		t.Fatal("target with an older schema contract was accepted")
	}
}

func TestBuildReplacementConfigUsesNewImageDefaultsAndKeepsDeploymentOverrides(t *testing.T) {
	t.Parallel()
	oldImage := json.RawMessage(`{
		"User":"dyndns:dyndns",
		"Entrypoint":["/old-entrypoint"],
		"WorkingDir":"/data",
		"Env":["PATH=/old","OLD_DEFAULT=1"],
		"Labels":{"org.opencontainers.image.version":"v1.3.0","image-owned":"old"},
		"ExposedPorts":{"8080/tcp":{}},
		"Volumes":{"/data":{}}
	}`)
	targetImage := json.RawMessage(`{
		"User":"dyndns:dyndns",
		"Entrypoint":["/new-entrypoint"],
		"WorkingDir":"/data",
		"Env":["PATH=/new","NEW_DEFAULT=1"],
		"Labels":{"org.opencontainers.image.version":"v2.0.0","image-owned":"new"},
		"ExposedPorts":{"8080/tcp":{}},
		"Volumes":{"/data":{}}
	}`)
	container := containerInspect{
		ID: "0123456789abcdef",
		Config: json.RawMessage(`{
			"Hostname":"0123456789ab",
			"User":"dyndns:dyndns",
			"Entrypoint":["/old-entrypoint"],
			"WorkingDir":"/data",
			"Env":["PATH=/old","OLD_DEFAULT=1","CUSTOM=yes"],
			"Labels":{"org.opencontainers.image.version":"v0.0.0","image-owned":"old","com.docker.compose.project":"domain-control","de.j-mahler.domain-control.role":"app"},
			"ExposedPorts":{"8080/tcp":{},"9091/tcp":{}},
			"Volumes":{"/data":{},"/custom":{}}
		}`),
	}
	config, err := buildReplacementConfig(container, oldImage, targetImage, "registry.example/app:v2.0.0")
	if err != nil {
		t.Fatal(err)
	}
	if _, exists := config["Hostname"]; exists {
		t.Fatal("generated container hostname was copied")
	}
	var image, user string
	var entrypoint, environment []string
	var labels map[string]string
	var ports, volumes map[string]any
	_ = json.Unmarshal(config["Image"], &image)
	_ = json.Unmarshal(config["User"], &user)
	_ = json.Unmarshal(config["Entrypoint"], &entrypoint)
	_ = json.Unmarshal(config["Env"], &environment)
	_ = json.Unmarshal(config["Labels"], &labels)
	_ = json.Unmarshal(config["ExposedPorts"], &ports)
	_ = json.Unmarshal(config["Volumes"], &volumes)
	if image != "registry.example/app:v2.0.0" || user != runtimeUser || len(entrypoint) != 1 || entrypoint[0] != "/new-entrypoint" {
		t.Fatalf("new image defaults were not retained: image=%q user=%q entrypoint=%v", image, user, entrypoint)
	}
	if !contains(environment, "PATH=/new") || !contains(environment, "NEW_DEFAULT=1") || !contains(environment, "CUSTOM=yes") || contains(environment, "OLD_DEFAULT=1") {
		t.Fatalf("environment was merged incorrectly: %v", environment)
	}
	if labels[labelImageVersion] != "v2.0.0" || labels["image-owned"] != "new" || labels["com.docker.compose.project"] != "domain-control" || labels["de.j-mahler.domain-control.role"] != "app" {
		t.Fatalf("labels were merged incorrectly: %#v", labels)
	}
	if _, exists := ports["9091/tcp"]; !exists {
		t.Fatalf("custom exposed port was lost: %#v", ports)
	}
	if _, exists := volumes["/custom"]; !exists {
		t.Fatalf("custom volume was lost: %#v", volumes)
	}
}

func compatibleImage(version, minimum string) imageInspect {
	config := map[string]any{
		"User":       runtimeUser,
		"Entrypoint": []string{runtimeEntrypoint},
		"Cmd":        []string{runtimeCommand},
		"WorkingDir": runtimeWorkingDirectory,
		"ExposedPorts": map[string]any{
			"8080/tcp": map[string]any{},
		},
		"Healthcheck": map[string]any{
			"Test": []string{"CMD", runtimeEntrypoint, "healthcheck"},
		},
		"Labels": map[string]string{
			labelImageVersion:     version,
			labelMinimumVersion:   minimum,
			labelMinimumAgent:     strconv.Itoa(buildinfo.MinimumAgentProtocol),
			labelRuntimeContract:  strconv.Itoa(buildinfo.RuntimeContractVersion),
			labelDatabaseContract: strconv.Itoa(buildinfo.DatabaseContractVersion),
			labelSchemaVersion:    strconv.Itoa(buildinfo.CurrentSchemaVersion),
		},
	}
	encoded, _ := json.Marshal(config)
	return imageInspect{ID: "sha256:target", Config: encoded}
}

func withImageLabel(t *testing.T, raw json.RawMessage, key, value string) json.RawMessage {
	t.Helper()
	var config map[string]any
	if err := json.Unmarshal(raw, &config); err != nil {
		t.Fatal(err)
	}
	labels, ok := config["Labels"].(map[string]any)
	if !ok {
		t.Fatal("image labels are missing")
	}
	labels[key] = value
	encoded, err := json.Marshal(config)
	if err != nil {
		t.Fatal(err)
	}
	return encoded
}

func contains(values []string, expected string) bool {
	for _, value := range values {
		if value == expected {
			return true
		}
	}
	return false
}

func dockerTestClient(health func() string) *dockerClient {
	transport := roundTripFunc(func(*http.Request) (*http.Response, error) {
		body := `{"Id":"container-id","Image":"sha256:current","Config":{"Labels":{}},"State":{"Running":true,"ExitCode":0,"Health":{"Status":"` + health() + `"}}}`
		return &http.Response{StatusCode: http.StatusOK, Header: make(http.Header), Body: io.NopCloser(strings.NewReader(body))}, nil
	})
	return &dockerClient{client: &http.Client{Transport: transport}, apiPrefix: "/v1.0"}
}