//! Tests for the repository layer.

use super::*;

use crate::repo::{BisectStep, Selection};

use crate::protocol::SignedPolicy;

/// Point `$OXY_HOME` at a throwaway directory once per test process so no

/// test reads or writes the developer's real user configuration or keys.

fn hermetic() {

    static ONCE: std::sync::Once = std::sync::Once::new();

    static DIR: std::sync::OnceLock<tempfile::TempDir> = std::sync::OnceLock::new();

    ONCE.call_once(|| {

        let d = tempfile::tempdir().unwrap();

        std::env::set_var("OXY_HOME", d.path());

        DIR.set(d).ok();

    });

}

fn write(root: &Path, rel: &str, content: &[u8]) {

    let p = root.join(rel);

    fs::create_dir_all(p.parent().unwrap()).unwrap();

    fs::write(p, content).unwrap();

}

fn statuses(s: &SnapshotResult) -> Vec<(String, ChangeStatus)> {

    s.statuses.iter().map(|p| (p.path.clone(), p.status)).collect()

}

#[test]

fn init_snapshot_commit_log_undo() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let repo = Repo::init(root).unwrap();

    assert!(Repo::init(root).is_err());

    let ops = repo.op_log().unwrap();

    assert_eq!(ops.len(), 1);

    assert_eq!(ops[0].1.command, "oxy init");

    // Empty working copy: snapshot records no operation (spec §12.3).

    let s = repo.snapshot("oxy status").unwrap();

    assert!(!s.changed);

    assert_eq!(repo.op_log().unwrap().len(), 1);

    write(root, "src/main.rs", b"fn main() {}\n");

    write(root, "README.md", b"# Hello\n");

    write(root, ".oxyignore", b"/target\n");

    write(root, "target/junk.o", b"\0\0\0");

    let s = repo.snapshot("oxy status").unwrap();

    assert!(s.changed);

    assert_eq!(

        statuses(&s),

        vec![

            (".oxyignore".into(), ChangeStatus::Added),

            ("README.md".into(), ChangeStatus::Added),

            ("src/main.rs".into(), ChangeStatus::Added),

        ]

    );

    assert_eq!(repo.op_log().unwrap().len(), 2);

    // Snapshotting again with nothing changed records no op.

    let s2 = repo.snapshot("oxy status").unwrap();

    assert!(!s2.changed);

    assert_eq!(s2.wc_hash, s.wc_hash);

    assert_eq!(repo.op_log().unwrap().len(), 2);

    let h1 = repo.commit("Initial import", &[]).unwrap();

    let c1 = repo.store().get_change(&h1).unwrap();

    assert_eq!(c1.kind, ChangeKind::Normal);

    assert!(c1.deps.is_empty(), "first change has nothing to depend on");

    assert_eq!(repo.bookmark_heads().unwrap(), vec![h1]);

    let (wc_hash, wc) = repo.working_copy().unwrap();

    assert_eq!(wc.deps, vec![h1]);

    assert!(wc.edits.is_empty());

    assert!(repo.commit("nothing", &[]).is_err());

    // Modify one file, remove another, add a binary file.

    write(root, "src/main.rs", b"fn main() {\n    println!(\"hi\");\n}\n");

    fs::remove_file(root.join("README.md")).unwrap();

    write(root, "logo.png", b"\x89PNG\0\0\x01");

    let s = repo.snapshot("oxy status").unwrap();

    assert_eq!(

        statuses(&s),

        vec![

            ("README.md".into(), ChangeStatus::Removed),

            ("logo.png".into(), ChangeStatus::Added),

            ("src/main.rs".into(), ChangeStatus::Modified),

        ]

    );

    assert_ne!(s.wc_hash, wc_hash);

    // The rewritten working copy keeps its ChangeId and depends on h1.

    assert_eq!(s.wc.change_id, wc.change_id);

    assert!(s.wc.deps.contains(&h1));

    let h2 = repo.commit("Second", &[]).unwrap();

    let c2 = repo.store().get_change(&h2).unwrap();

    assert_eq!(c2.deps, vec![h1], "everything it touches was introduced by h1");

    assert_eq!(repo.bookmark_heads().unwrap(), vec![h2]);

    // The materialized head state matches the working copy.

    let st = repo.load_state(&[h2]).unwrap();

    let snap = st.materialize();

    assert!(!snap.is_conflicted());

    assert_eq!(snap.files.keys().cloned().collect::<Vec<_>>(), [".oxyignore", "logo.png", "src", "src/main.rs"]);

    assert!(matches!(&snap.files["src/main.rs"].content, FileContent::Text { bytes, .. } if bytes == b"fn main() {\n    println!(\"hi\");\n}\n"));

    assert!(snap.files["logo.png"].mode.opaque);

    if let FileContent::Opaque { blobs } = &snap.files["logo.png"].content {

        assert_eq!(repo.read_blob(&blobs[0]).unwrap(), b"\x89PNG\0\0\x01");

    } else {

        panic!("logo should be opaque");

    }

    // Log: newest first, working copy included.

    let log = repo.log().unwrap();

    assert_eq!(log.len(), 3);

    assert!(log[0].is_working_copy);

    assert_eq!(log[1].hash, h2);

    assert!(log[1].is_head);

    assert_eq!(log[2].hash, h1);

    let d = repo.describe_change(&h2).unwrap();

    assert!(d.contains("D README.md"), "{d}");

    assert!(d.contains("+    println!(\"hi\");"), "{d}");

    assert!(d.contains("-fn main() {}"), "{d}");

    // Resolution by prefix.

    assert_eq!(repo.resolve_change(&c2.change_id.short(6)).unwrap(), h2);

    assert_eq!(repo.resolve_change(&format!("#{}", h1.short(8))).unwrap(), h1);

    assert!(repo.resolve_change("zzzz").is_err());

    // Undo the commit: bookmark and working copy go back.

    repo.undo().unwrap();

    assert_eq!(repo.bookmark_heads().unwrap(), vec![h1]);

    let s = repo.snapshot("oxy status").unwrap();

    assert!(!s.changed, "files on disk still match the pre-commit working copy");

    assert_eq!(s.statuses.len(), 3);

}

/// Make `main` conflicted: two commits on the same base that edit the same line.

fn conflicted_repo() -> (tempfile::TempDir, Repo, ChangeHash, ChangeHash, ChangeHash) {

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let repo = Repo::init(root).unwrap();

    write(root, "f.txt", b"a\nb\nc\n");

    let h1 = repo.commit("base", &[]).unwrap();

    write(root, "f.txt", b"a\nB\nc\n");

    let h2 = repo.commit("upper", &[]).unwrap();

    repo.checkout(&[h1], false, "checkout").unwrap();

    write(root, "f.txt", b"a\nX\nc\n");

    let h3 = repo.commit("ex", &[]).unwrap();

    (dir, repo, h1, h2, h3)

}

#[test]

fn concurrent_edits_conflict_and_can_be_resolved() {

    hermetic();

    let (dir, repo, h1, h2, h3) = conflicted_repo();

    let root = dir.path();

    let heads: BTreeSet<_> = repo.bookmark_heads().unwrap().into_iter().collect();

    assert_eq!(heads, [h2, h3].into_iter().collect());

    let st = repo.load_state(&[h2, h3]).unwrap();

    assert!(st.materialize().is_conflicted());

    // Checking out main writes markers.

    let r = repo.checkout(&repo.bookmark_heads().unwrap(), false, "checkout main").unwrap();

    assert!(r.conflicted);

    let marked = fs::read_to_string(root.join("f.txt")).unwrap();

    assert!(marked.starts_with("a\n<<<<<<< oxy conflict 1 of 1"), "{marked}");

    assert!(marked.contains("B\n") && marked.contains("X\n") && marked.ends_with("end\nc\n"), "{marked}");

    assert!(has_conflict_markers(marked.as_bytes()));

    // Untouched markers: clean working copy; commit has nothing to do.

    let s = repo.snapshot("status").unwrap();

    assert!(s.statuses.is_empty());

    assert!(!s.resolves);

    // Partially edited file that still has markers cannot be committed.

    write(root, "f.txt", marked.replace("B\n", "BB\n").as_bytes());

    let s = repo.snapshot("status").unwrap();

    assert_eq!(statuses(&s), vec![("f.txt".into(), ChangeStatus::ConflictEdited)]);

    assert!(repo.commit("no", &[]).is_err());

    // Resolve by keeping one side and adding a line elsewhere.

    write(root, "f.txt", b"a\nX\nc\nd\n");

    let s = repo.snapshot("status").unwrap();

    assert_eq!(statuses(&s), vec![("f.txt".into(), ChangeStatus::Resolved)]);

    assert!(s.resolves);

    let h4 = repo.commit("resolve", &[]).unwrap();

    let c4 = repo.store().get_change(&h4).unwrap();

    assert_eq!(c4.kind, ChangeKind::Resolution);

    let mut want = vec![h1, h2, h3];

    want.sort();

    assert_eq!(c4.deps, want, "a resolution depends on exactly the contributors and what it references");

    assert_eq!(repo.bookmark_heads().unwrap(), vec![h4]);

    let snap = repo.load_state(&[h4]).unwrap().materialize();

    assert!(!snap.is_conflicted());

    assert!(matches!(&snap.files["f.txt"].content, FileContent::Text { bytes, .. } if bytes == b"a\nX\nc\nd\n"));

    assert!(!repo.snapshot("status").unwrap().changed);

    // A peer holding only h2 and h3 and receiving h4 sees the same result,

    // whatever order the changes arrive in.

    let mut st = State::new();

    for h in [h4, h3, h1, h2] {

        st.add_unchecked(repo.store().get_change(&h).unwrap());

    }

    st.validate().unwrap();

    assert!(matches!(&st.materialize().files["f.txt"].content, FileContent::Text { bytes, .. } if bytes == b"a\nX\nc\nd\n"));

}

#[test]

fn resolution_may_keep_both_sides_or_neither() {

    hermetic();

    let (dir, repo, _h1, _h2, _h3) = conflicted_repo();

    let root = dir.path();

    repo.checkout(&repo.bookmark_heads().unwrap(), false, "checkout main").unwrap();

    // Keep both sides in a chosen order.

    write(root, "f.txt", b"a\nX\nB\nc\n");

    let h = repo.commit("both", &[]).unwrap();

    let snap = repo.load_state(&[h]).unwrap().materialize();

    assert!(!snap.is_conflicted());

    assert!(matches!(&snap.files["f.txt"].content, FileContent::Text { bytes, .. } if bytes == b"a\nX\nB\nc\n"));

    // Undo and instead drop the whole region.

    repo.undo().unwrap();

    write(root, "f.txt", b"a\nc\n");

    let h = repo.commit("neither", &[]).unwrap();

    let snap = repo.load_state(&[h]).unwrap().materialize();

    assert!(!snap.is_conflicted());

    assert!(matches!(&snap.files["f.txt"].content, FileContent::Text { bytes, .. } if bytes == b"a\nc\n"));

}

#[test]

fn name_conflict_resolved_by_removing_a_candidate() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let repo = Repo::init(root).unwrap();

    write(root, "keep.txt", b"k\n");

    let h1 = repo.commit("base", &[]).unwrap();

    write(root, "new.txt", b"one\n");

    repo.commit("one", &[]).unwrap();

    repo.checkout(&[h1], false, "checkout").unwrap();

    write(root, "new.txt", b"two\n");

    repo.commit("two", &[]).unwrap();

    let r = repo.checkout(&repo.bookmark_heads().unwrap(), false, "checkout main").unwrap();

    assert!(r.conflicted);

    assert!(root.join("new.txt.oxy-conflict-1").exists() && root.join("new.txt.oxy-conflict-2").exists());

    assert!(!root.join("new.txt").exists());

    // Candidate numbering follows change-hash order, so pick by content:

    // keep the "two" candidate under the real name and drop the other.

    let (keep, drop) = if fs::read(root.join("new.txt.oxy-conflict-1")).unwrap() == b"two\n" { (1, 2) } else { (2, 1) };

    fs::remove_file(root.join(format!("new.txt.oxy-conflict-{drop}"))).unwrap();

    fs::rename(root.join(format!("new.txt.oxy-conflict-{keep}")), root.join("new.txt")).unwrap();

    let h = repo.commit("pick two", &[]).unwrap();

    assert_eq!(repo.store().get_change(&h).unwrap().kind, ChangeKind::Resolution);

    // The resolution does not touch keep.txt, so it does not depend on h1;

    // the bookmark keeps both as heads and their union is the state.

    let heads: BTreeSet<_> = repo.bookmark_heads().unwrap().into_iter().collect();

    assert_eq!(heads, [h1, h].into_iter().collect());

    let snap = repo.load_state(&repo.bookmark_heads().unwrap()).unwrap().materialize();

    assert!(!snap.is_conflicted(), "{:?}", snap.tree.conflicts);

    assert_eq!(snap.files.keys().cloned().collect::<Vec<_>>(), ["keep.txt", "new.txt"]);

    assert!(matches!(&snap.files["new.txt"].content, FileContent::Text { bytes, .. } if bytes == b"two\n"));

}

#[test]

fn identities_and_signed_commits() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let mut repo = Repo::init(root).unwrap().with_home(root.join("home"));

    write(root, "a.txt", b"a\n");

    let h0 = repo.commit("unsigned", &[]).unwrap();

    assert_eq!(repo.verify_change(&h0).unwrap(), SignatureStatus::Unsigned);

    assert_eq!(repo.store().get_change(&h0).unwrap().author, ObjectRef::ZERO);

    let (key, id) = repo.create_identity("Ada", "[email protected]", IdentityScope::Repo).unwrap();

    assert_eq!(id.hash(), key);

    assert_eq!(repo.config.author_key, Some(key));

    // Config survives reopen; the secret key is found again.

    let reopened = Repo::open(root).unwrap().with_home(root.join("home"));

    assert_eq!(reopened.config.author_key, Some(key));

    assert_eq!(reopened.secret_key().unwrap().unwrap().0, key);

    // Default core.sign = seal: commits carry the author but no signature.

    write(root, "a.txt", b"a\nb\n");

    let h1 = repo.commit("authored", &[]).unwrap();

    assert_eq!(repo.store().get_change(&h1).unwrap().author, key);

    assert_eq!(repo.verify_change(&h1).unwrap(), SignatureStatus::Unsigned);

    // Signing later works too.

    repo.sign_change(&h1).unwrap();

    assert!(matches!(repo.verify_change(&h1).unwrap(), SignatureStatus::Valid { key: k, .. } if k == key));

    repo.config.set("core.sign", "change").unwrap();

    repo.save_config().unwrap();

    write(root, "a.txt", b"a\nb\nc\n");

    let h2 = repo.commit("signed", &[]).unwrap();

    assert_eq!(repo.verify_change(&h2).unwrap(), SignatureStatus::Valid { key, name: "Ada".into(), email: "[email protected]".into(), sealed: false, revoked: false });

    // A signature by a key that is not the author or a delegate is rejected.

    let other = SecretKey::generate();

    let other_id = other.identity("Mallory", "[email protected]", 0);

    let other_key = repo.store().put_identity(&other_id).unwrap();

    let forged = other.sign(Domain::Change, &other_key, &h0);

    repo.store().put_signature(&h0, &forged).unwrap();

    assert!(matches!(repo.verify_change(&h0).unwrap(), SignatureStatus::Invalid(m) if m.contains("neither the author")));

    // Tampering with the stored signature invalidates it.

    let mut sig = repo.store().signatures(&h2).unwrap().remove(0);

    sig.ed[0] ^= 1;

    repo.store().put_signature(&h2, &sig).unwrap();

    assert!(matches!(repo.verify_change(&h2).unwrap(), SignatureStatus::Invalid(_)));

    // Without the secret key, signing at commit fails cleanly.

    let no_keys = Repo::open(root).unwrap().with_home(root.join("nowhere"));

    write(root, "a.txt", b"z\n");

    assert!(no_keys.commit("cannot sign", &[]).is_err());

}

#[test]

fn checkout_moves_the_working_copy() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let repo = Repo::init(root).unwrap();

    write(root, "a.txt", b"one\n");

    write(root, "sub/deep/b.txt", b"b\n");

    let h1 = repo.commit("first", &[]).unwrap();

    write(root, "a.txt", b"two\n");

    fs::remove_file(root.join("sub/deep/b.txt")).unwrap();

    write(root, "bin.dat", &[0, 1, 2, 3]);

    let h2 = repo.commit("second", &[]).unwrap();

    let r = repo.checkout(&[h1], false, "oxy checkout").unwrap();

    assert_eq!(r, CheckoutReport { written: 2, removed: 1, conflicted: false, notes: vec![] });

    assert_eq!(fs::read(root.join("a.txt")).unwrap(), b"one\n");

    assert_eq!(fs::read(root.join("sub/deep/b.txt")).unwrap(), b"b\n");

    assert!(!root.join("bin.dat").exists());

    let (_, wc) = repo.working_copy().unwrap();

    assert_eq!(wc.deps, vec![h1]);

    assert!(!repo.snapshot("status").unwrap().changed, "checkout leaves a clean working copy");

    // The bookmark still points at h2.

    assert_eq!(repo.bookmark_heads().unwrap(), vec![h2]);

    // Dirty working copy refuses without --discard.

    write(root, "a.txt", b"dirty\n");

    assert!(repo.checkout(&[h2], false, "oxy checkout").is_err());

    let r = repo.checkout(&[h2], true, "oxy checkout --discard").unwrap();

    assert_eq!(fs::read(root.join("a.txt")).unwrap(), b"two\n");

    assert_eq!(fs::read(root.join("bin.dat")).unwrap(), [0, 1, 2, 3]);

    assert!(!root.join("sub").exists(), "empty directories are pruned");

    assert_eq!(r.removed, 1);

    assert!(!repo.snapshot("status").unwrap().changed);

    // Refuses to write through a symlinked directory.

    #[cfg(unix)]

    {

        fs::remove_dir_all(root.join("sub")).ok();

        std::os::unix::fs::symlink("/tmp", root.join("sub")).unwrap();

        assert!(repo.checkout(&[h1], true, "oxy checkout").is_err());

    }

}

#[test]

fn large_files_are_chunked_and_read_back() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let repo = Repo::init(dir.path()).unwrap();

    let mut big = vec![0u8; 700 * 1024];

    for (i, b) in big.iter_mut().enumerate() {

        *b = (i as u32).wrapping_mul(2654435761).to_le_bytes()[0];

    }

    let r = repo.store_blob(&big).unwrap();

    let blob = Blob::decode(&repo.store().get_typed(&r, ObjectType::Blob).unwrap()).unwrap();

    assert!(blob.chunks.len() >= 3, "{}", blob.chunks.len());

    assert_eq!(repo.read_blob(&r).unwrap(), big);

    assert_eq!(Repo::blob_ref(&big), r);

}

#[test]

fn clone_push_pull_with_seals_and_attestations() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let origin_path = root.join("origin");

    let origin = Repo::init(&origin_path).unwrap();

    let origin_url = origin_path.to_string_lossy().to_string();

    // A clones, creates an identity (default core.sign = seal), commits, pushes.