//! The registry's custody, on the command line: verification runs on one machine and writes an
//! unsigned record, signing is a separate light step on another, and nothing signs without being
//! given the key by its path. A throwaway key throughout: no test needs the production key.

use flowrs_registry::package::Package;
use flowrs_registry::record::{
    Condition, ConditionId, Method, PackageRef, Record, SCHEMA, SignedRecord, Status, Toolchain,
};
use serde_json::Value;
use std::path::{Path, PathBuf};
use std::process::{Command, Output};
use tempfile::TempDir;

fn flowrsc(dir: &Path, args: &[&str], keys: Option<&str>) -> Output {
    let mut c = Command::new(env!("CARGO_BIN_EXE_flowrsc"));
    c.args(args).current_dir(dir);
    match keys {
        Some(k) => c.env("FLOWRS_REGISTRY_KEYS", k),
        None => c.env_remove("FLOWRS_REGISTRY_KEYS"),
    };
    c.output().expect("flowrsc runs")
}

fn text(o: &Output) -> String {
    format!(
        "{}{}",
        String::from_utf8_lossy(&o.stdout),
        String::from_utf8_lossy(&o.stderr)
    )
}

const MANIFEST: &str = r#"schema = "flowrs.package/1"
name = "tiny"
version = "0.1.0"
kind = "widget"
licence = "Apache-2.0"
description = "A package for the custody tests."
provides = ["tiny.node"]
tests = ["tests::it_runs"]

[needs]
network = []
filesystem = []

[[ports]]
of = "tiny.node"
port = "in"
unit = "1"
"#;

/// A package tree, its archive, and a record of it with all five conditions as given.
fn package(dir: &Path) -> Package {
    let p = dir.join("tiny");
    std::fs::create_dir_all(p.join("src")).unwrap();
    std::fs::write(
        p.join("Cargo.toml"),
        "[package]\nname = \"tiny\"\nversion = \"0.1.0\"\nedition = \"2024\"\n",
    )
    .unwrap();
    std::fs::write(
        p.join("src/lib.rs"),
        "#[cfg(test)]\nmod tests {\n    #[test]\n    fn it_runs() {}\n}\n",
    )
    .unwrap();
    std::fs::write(p.join("flowrs-package.toml"), MANIFEST).unwrap();
    Package::from_dir(&p).unwrap()
}

fn record(pkg: &Package, status: Status) -> Record {
    let manifest = pkg.manifest().unwrap();
    Record {
        schema: SCHEMA.into(),
        package: PackageRef {
            name: manifest.name.clone(),
            version: manifest.version.clone(),
            kind: manifest.kind,
        },
        hash: pkg.hash.clone(),
        manifest,
        conditions: ConditionId::ALL
            .iter()
            .map(|&id| Condition {
                id,
                status,
                how: vec![Method::Observed],
                detail: "checked on another machine".into(),
                evidence: vec![],
            })
            .collect(),
        toolchain: Toolchain {
            rustc: "rustc".into(),
            cargo: "cargo".into(),
            host: "aarch64-apple-darwin".into(),
            sandbox: "seatbelt".into(),
            observation: "kernel reports (canary seen)".into(),
        },
        flowrs_commit: "0000000".into(),
        verified_at: "2026-11-02T00:00:00Z".into(),
        verifier: "flowrs-registry test".into(),
    }
}

/// Stage `pkg` as `pkg submit` does on the verifying machine.
fn stage(reg: &Path, pkg: &Package, r: Record) -> PathBuf {
    let hex = flowrs_registry::archive::hex_of(&pkg.hash).unwrap();
    let incoming = reg.join("incoming");
    std::fs::create_dir_all(&incoming).unwrap();
    std::fs::write(incoming.join(format!("{hex}.fpkg")), &pkg.archive).unwrap();
    let file = incoming.join(format!("{hex}.json"));
    std::fs::write(
        &file,
        serde_json::to_string_pretty(&SignedRecord {
            record: r,
            signature: None,
        })
        .unwrap(),
    )
    .unwrap();
    file
}

/// A key made by the command, and its id.
fn key(dir: &Path) -> (PathBuf, String) {
    let f = dir.join("key.json");
    let o = flowrsc(dir, &["pkg", "keygen", f.to_str().unwrap()], None);
    assert!(o.status.success(), "{}", text(&o));
    let public: Value =
        serde_json::from_str(&std::fs::read_to_string(dir.join("key.json.pub")).unwrap()).unwrap();
    (f, public["id"].as_str().unwrap().to_string())
}

fn signature(file: &Path) -> Option<Value> {
    let v: Value = serde_json::from_str(&std::fs::read_to_string(file).unwrap()).unwrap();
    v.get("signature").cloned()
}

/// `keygen` writes a key only its owner can read, and never over one that exists.
#[test]
fn keygen_writes_an_owners_key_and_never_over_another() {
    let d = TempDir::new().unwrap();
    let (f, id) = key(d.path());
    assert!(id.starts_with("v2:"));
    #[cfg(unix)]
    {
        use std::os::unix::fs::PermissionsExt;
        let mode = std::fs::metadata(&f).unwrap().permissions().mode();
        assert_eq!(mode & 0o777, 0o600, "{mode:o}");
    }
    let before = std::fs::read(&f).unwrap();
    let o = flowrsc(d.path(), &["pkg", "keygen", f.to_str().unwrap()], None);
    assert!(!o.status.success());
    assert!(text(&o).contains("never overwritten"), "{}", text(&o));
    assert_eq!(std::fs::read(&f).unwrap(), before);
    // The public half holds no secret.
    let public = std::fs::read_to_string(d.path().join("key.json.pub")).unwrap();
    assert!(
        !public.contains("ml_dsa_65") && !public.contains("ed25519\""),
        "{public}"
    );
}

/// Verifying and staging take no key at all: there is no way to sign on the machine that builds.
#[test]
fn verify_and_submit_take_no_key() {
    let d = TempDir::new().unwrap();
    for args in [
        &["pkg", "verify", "x", "--key", "k.json"][..],
        &["pkg", "submit", "x", "--registry", "r", "--key", "k.json"][..],
    ] {
        let o = flowrsc(d.path(), args, None);
        assert_eq!(o.status.code(), Some(2), "{args:?}");
        assert!(text(&o).contains("--key"), "{}", text(&o));
    }
}

/// `sign` needs a key named on its command line; a mistyped path signs nothing and falls back to
/// nothing.
#[test]
fn a_mistyped_key_path_signs_nothing() {
    let d = TempDir::new().unwrap();
    let (_, id) = key(d.path());
    let pkg = package(d.path());
    let reg = d.path().join("reg");
    let staged = stage(&reg, &pkg, record(&pkg, Status::Passed));
    let reg_s = reg.to_str().unwrap();
    // With no --key at all.
    let o = flowrsc(d.path(), &["pkg", "sign", "--registry", reg_s], Some(&id));
    assert_eq!(o.status.code(), Some(2));
    assert!(text(&o).contains("--key"), "{}", text(&o));
    assert_eq!(signature(&staged), None);
    // With a path that is not there.
    let o = flowrsc(
        d.path(),
        &["pkg", "sign", "--key", "kye.json", "--registry", reg_s],
        Some(&id),
    );
    assert_eq!(o.status.code(), Some(2));
    assert!(text(&o).contains("kye.json"), "{}", text(&o));
    assert_eq!(signature(&staged), None);
}

/// A real key this host does not trust signs nothing: it would be a record no host admits.
#[test]
fn a_key_this_host_does_not_trust_signs_nothing() {
    let d = TempDir::new().unwrap();
    let (f, _) = key(d.path());
    let pkg = package(d.path());
    let reg = d.path().join("reg");
    let staged = stage(&reg, &pkg, record(&pkg, Status::Passed));
    let o = flowrsc(
        d.path(),
        &[
            "pkg",
            "sign",
            "--key",
            f.to_str().unwrap(),
            "--registry",
            reg.to_str().unwrap(),
        ],
        None,
    );
    assert_eq!(o.status.code(), Some(2));
    assert!(text(&o).contains("does not trust"), "{}", text(&o));
    assert_eq!(signature(&staged), None);
}

/// The whole split: a record verified elsewhere, signed here by a command that compiles nothing,
/// published, and then admitted for this exact tree.
#[test]
fn verified_elsewhere_signed_here_published_and_admitted() {
    let d = TempDir::new().unwrap();
    let (f, id) = key(d.path());
    let pkg = package(d.path());
    let reg = d.path().join("reg");
    let staged = stage(&reg, &pkg, record(&pkg, Status::Passed));
    let (reg_s, key_s) = (reg.to_str().unwrap(), f.to_str().unwrap());
    let tree = d.path().join("tiny");
    let tree_s = tree.to_str().unwrap();

    // Not signed: publishing holds it back.
    let o = flowrsc(
        d.path(),
        &["pkg", "publish", "--registry", reg_s],
        Some(&id),
    );
    assert!(o.status.success(), "{}", text(&o));
    assert!(text(&o).contains("left out"), "{}", text(&o));
    let o = flowrsc(
        d.path(),
        &["pkg", "check", tree_s, "--registry", reg_s],
        Some(&id),
    );
    assert_eq!(o.status.code(), Some(1), "{}", text(&o));

    let o = flowrsc(
        d.path(),
        &["pkg", "sign", "--key", key_s, "--registry", reg_s],
        Some(&id),
    );
    assert!(o.status.success(), "{}", text(&o));
    assert!(text(&o).contains("signed tiny"), "{}", text(&o));
    assert_eq!(
        signature(&staged).unwrap()["key_id"].as_str(),
        Some(id.as_str())
    );

    let o = flowrsc(
        d.path(),
        &["pkg", "publish", "--registry", reg_s],
        Some(&id),
    );
    assert!(o.status.success(), "{}", text(&o));
    let o = flowrsc(
        d.path(),
        &["pkg", "check", tree_s, "--registry", reg_s],
        Some(&id),
    );
    assert!(o.status.success(), "{}", text(&o));
    assert!(text(&o).contains("is admitted"), "{}", text(&o));

    // One byte of the tree changed: the signed record no longer covers it.
    std::fs::write(tree.join("src/lib.rs"), "// changed\n").unwrap();
    let o = flowrsc(
        d.path(),
        &["pkg", "check", tree_s, "--registry", reg_s],
        Some(&id),
    );
    assert_eq!(o.status.code(), Some(1), "{}", text(&o));
}

/// Signing one record file, for a record carried by hand, holds to the same rule: a record that
/// did not pass is not signed, and the file stays as it was.
#[test]
fn one_record_file_is_signed_only_if_it_passed() {
    let d = TempDir::new().unwrap();
    let (f, id) = key(d.path());
    let pkg = package(d.path());
    let key_s = f.to_str().unwrap();
    let write = |name: &str, status| {
        let file = d.path().join(name);
        std::fs::write(
            &file,
            serde_json::to_string_pretty(&SignedRecord {
                record: record(&pkg, status),
                signature: None,
            })
            .unwrap(),
        )
        .unwrap();
        file
    };
    let bad = write("failed.json", Status::Failed);
    let o = flowrsc(
        d.path(),
        &["pkg", "sign", bad.to_str().unwrap(), "--key", key_s],
        Some(&id),
    );
    assert_eq!(o.status.code(), Some(2), "{}", text(&o));
    assert_eq!(signature(&bad), None);
    let good = write("passed.json", Status::Passed);
    let out = d.path().join("signed.json");
    let o = flowrsc(
        d.path(),
        &[
            "pkg",
            "sign",
            good.to_str().unwrap(),
            "--key",
            key_s,
            "-o",
            out.to_str().unwrap(),
        ],
        Some(&id),
    );
    assert!(o.status.success(), "{}", text(&o));
    assert_eq!(signature(&good), None, "the input stays as it was with -o");
    assert_eq!(
        signature(&out).unwrap()["key_id"].as_str(),
        Some(id.as_str())
    );
}

/// `check` with no registry is what a contributor runs: no key, and a package whose manifest does
/// not read stops there with the reason.
#[test]
fn a_contributors_check_stops_at_a_manifest_that_does_not_read() {
    let d = TempDir::new().unwrap();
    let p = d.path().join("broken");
    std::fs::create_dir_all(&p).unwrap();
    std::fs::write(p.join("Cargo.toml"), "[package]\nname = \"broken\"\n").unwrap();
    std::fs::write(
        p.join("flowrs-package.toml"),
        "schema = \"flowrs.package/9\"\n",
    )
    .unwrap();
    let o = flowrsc(d.path(), &["pkg", "check", p.to_str().unwrap()], None);
    assert_eq!(o.status.code(), Some(2), "{}", text(&o));
    assert!(text(&o).contains("error"), "{}", text(&o));
}

/// The whole local check, with no key on the machine: a package whose test fails is told so, with
/// a non-zero status, and nothing is written anywhere. It builds flowrs-core confined, once, in the
/// verifier's shared target.
#[test]
fn a_contributors_check_runs_with_no_key_and_says_what_failed() {
    let d = TempDir::new().unwrap();
    let p = d.path().join("failing");
    std::fs::create_dir_all(p.join("src")).unwrap();
    std::fs::write(
        p.join("Cargo.toml"),
        "[package]\nname = \"failing\"\nversion = \"0.1.0\"\nedition = \"2024\"\npublish = false\n\n[dependencies]\nflowrs-core = { path = \"../../crates/flowrs-core\" }\n",
    )
    .unwrap();
    std::fs::write(
        p.join("src/lib.rs"),
        "pub fn install() -> Result<(), String> {\n    Ok(())\n}\n#[cfg(test)]\nmod tests {\n    #[test]\n    fn it_runs() {\n        panic!(\"this package is broken\");\n    }\n}\n",
    )
    .unwrap();
    std::fs::write(
        p.join("flowrs-package.toml"),
        MANIFEST.replace("\"tiny\"", "\"failing\""),
    )
    .unwrap();
    let work = std::env::temp_dir().join("flowrs-registry-verify");
    let o = flowrsc(
        d.path(),
        &[
            "pkg",
            "check",
            p.to_str().unwrap(),
            "--work",
            work.to_str().unwrap(),
            "--commit",
            "custody-test",
        ],
        None,
    );
    let t = text(&o);
    assert_eq!(o.status.code(), Some(1), "{t}");
    assert!(t.contains("the manifest reads"), "{t}");
    assert!(t.contains("FAILED  tests"), "{t}");
    assert!(t.contains("fix it before opening a pull request"), "{t}");
    assert!(!p.join("record.json").exists());
}