//! Tests for the repository layer.

use super::*;

use crate::protocol::SignedPolicy;

use crate::repo::{BisectStep, Selection};

/// Point `$OXY_HOME` at a throwaway directory once per test process so no

/// test reads or writes the developer's real user configuration or keys.

fn hermetic() {

    static ONCE: std::sync::Once = std::sync::Once::new();

    static DIR: std::sync::OnceLock<tempfile::TempDir> = std::sync::OnceLock::new();

    ONCE.call_once(|| {

        let d = tempfile::tempdir().unwrap();

        std::env::set_var("OXY_HOME", d.path());

        DIR.set(d).ok();

    });

}

fn write(root: &Path, rel: &str, content: &[u8]) {

    let p = root.join(rel);

    fs::create_dir_all(p.parent().unwrap()).unwrap();

    fs::write(p, content).unwrap();

}

fn statuses(s: &SnapshotResult) -> Vec<(String, ChangeStatus)> {

    s.statuses

        .iter()

        .map(|p| (p.path.clone(), p.status))

        .collect()

}

#[test]

fn init_snapshot_commit_log_undo() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let repo = Repo::init(root).unwrap();

    assert!(Repo::init(root).is_err());

    let ops = repo.op_log().unwrap();

    assert_eq!(ops.len(), 1);

    assert_eq!(ops[0].1.command, "oxy init");

    // Empty working copy: snapshot records no operation (spec §12.3).

    let s = repo.snapshot("oxy status").unwrap();

    assert!(!s.changed);

    assert_eq!(repo.op_log().unwrap().len(), 1);

    write(root, "src/main.rs", b"fn main() {}\n");

    write(root, "README.md", b"# Hello\n");

    write(root, ".oxyignore", b"/target\n");

    write(root, "target/junk.o", b"\0\0\0");

    let s = repo.snapshot("oxy status").unwrap();

    assert!(s.changed);

    assert_eq!(

        statuses(&s),

        vec![

            (".oxyignore".into(), ChangeStatus::Added),

            ("README.md".into(), ChangeStatus::Added),

            ("src/main.rs".into(), ChangeStatus::Added),

        ]

    );

    assert_eq!(repo.op_log().unwrap().len(), 2);

    // Snapshotting again with nothing changed records no op.

    let s2 = repo.snapshot("oxy status").unwrap();

    assert!(!s2.changed);

    assert_eq!(s2.wc_hash, s.wc_hash);

    assert_eq!(repo.op_log().unwrap().len(), 2);

    let h1 = repo.commit("Initial import", &[]).unwrap();

    let c1 = repo.store().get_change(&h1).unwrap();

    assert_eq!(c1.kind, ChangeKind::Normal);

    assert!(c1.deps.is_empty(), "first change has nothing to depend on");

    assert_eq!(repo.bookmark_heads().unwrap(), vec![h1]);

    let (wc_hash, wc) = repo.working_copy().unwrap();

    assert_eq!(wc.deps, vec![h1]);

    assert!(wc.edits.is_empty());

    assert!(repo.commit("nothing", &[]).is_err());

    // Modify one file, remove another, add a binary file.

    write(

        root,

        "src/main.rs",

        b"fn main() {\n    println!(\"hi\");\n}\n",

    );

    fs::remove_file(root.join("README.md")).unwrap();

    write(root, "logo.png", b"\x89PNG\0\0\x01");

    let s = repo.snapshot("oxy status").unwrap();

    assert_eq!(

        statuses(&s),

        vec![

            ("README.md".into(), ChangeStatus::Removed),

            ("logo.png".into(), ChangeStatus::Added),

            ("src/main.rs".into(), ChangeStatus::Modified),

        ]

    );

    assert_ne!(s.wc_hash, wc_hash);

    // The rewritten working copy keeps its ChangeId and depends on h1.

    assert_eq!(s.wc.change_id, wc.change_id);

    assert!(s.wc.deps.contains(&h1));

    let h2 = repo.commit("Second", &[]).unwrap();

    let c2 = repo.store().get_change(&h2).unwrap();

    assert_eq!(

        c2.deps,

        vec![h1],

        "everything it touches was introduced by h1"

    );

    assert_eq!(repo.bookmark_heads().unwrap(), vec![h2]);

    // The materialized head state matches the working copy.

    let st = repo.load_state(&[h2]).unwrap();

    let snap = st.materialize();

    assert!(!snap.is_conflicted());

    assert_eq!(

        snap.files.keys().cloned().collect::<Vec<_>>(),

        [".oxyignore", "logo.png", "src", "src/main.rs"]

    );

    assert!(

        matches!(&snap.files["src/main.rs"].content, FileContent::Text { bytes, .. } if bytes == b"fn main() {\n    println!(\"hi\");\n}\n")

    );

    assert!(snap.files["logo.png"].mode.opaque);

    if let FileContent::Opaque { blobs } = &snap.files["logo.png"].content {

        assert_eq!(repo.read_blob(&blobs[0]).unwrap(), b"\x89PNG\0\0\x01");

    } else {

        panic!("logo should be opaque");

    }

    // Log: newest first, working copy included.

    let log = repo.log().unwrap();

    assert_eq!(log.len(), 3);

    assert!(log[0].is_working_copy);

    assert_eq!(log[1].hash, h2);

    assert!(log[1].is_head);

    assert_eq!(log[2].hash, h1);

    let d = repo.describe_change(&h2).unwrap();

    assert!(d.contains("D README.md"), "{d}");

    assert!(d.contains("+    println!(\"hi\");"), "{d}");

    assert!(d.contains("-fn main() {}"), "{d}");

    // Resolution by prefix.

    assert_eq!(repo.resolve_change(&c2.change_id.short(6)).unwrap(), h2);

    assert_eq!(

        repo.resolve_change(&format!("#{}", h1.short(8))).unwrap(),

        h1

    );

    assert!(repo.resolve_change("zzzz").is_err());

    // Undo the commit: bookmark and working copy go back.

    repo.undo().unwrap();

    assert_eq!(repo.bookmark_heads().unwrap(), vec![h1]);

    let s = repo.snapshot("oxy status").unwrap();

    assert!(

        !s.changed,

        "files on disk still match the pre-commit working copy"

    );

    assert_eq!(s.statuses.len(), 3);

}

/// Make `main` conflicted: two commits on the same base that edit the same line.

fn conflicted_repo() -> (tempfile::TempDir, Repo, ChangeHash, ChangeHash, ChangeHash) {

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let repo = Repo::init(root).unwrap();

    write(root, "f.txt", b"a\nb\nc\n");

    let h1 = repo.commit("base", &[]).unwrap();

    write(root, "f.txt", b"a\nB\nc\n");

    let h2 = repo.commit("upper", &[]).unwrap();

    repo.checkout(&[h1], false, "checkout").unwrap();

    write(root, "f.txt", b"a\nX\nc\n");

    let h3 = repo.commit("ex", &[]).unwrap();

    (dir, repo, h1, h2, h3)

}

#[test]

fn concurrent_edits_conflict_and_can_be_resolved() {

    hermetic();

    let (dir, repo, h1, h2, h3) = conflicted_repo();

    let root = dir.path();

    let heads: BTreeSet<_> = repo.bookmark_heads().unwrap().into_iter().collect();

    assert_eq!(heads, [h2, h3].into_iter().collect());

    let st = repo.load_state(&[h2, h3]).unwrap();

    assert!(st.materialize().is_conflicted());

    // Checking out main writes markers.

    let r = repo

        .checkout(&repo.bookmark_heads().unwrap(), false, "checkout main")

        .unwrap();

    assert!(r.conflicted);

    let marked = fs::read_to_string(root.join("f.txt")).unwrap();

    assert!(

        marked.starts_with("a\n<<<<<<< oxy conflict 1 of 1"),

        "{marked}"

    );

    assert!(

        marked.contains("B\n") && marked.contains("X\n") && marked.ends_with("end\nc\n"),

        "{marked}"

    );

    assert!(has_conflict_markers(marked.as_bytes()));

    // Untouched markers: clean working copy; commit has nothing to do.

    let s = repo.snapshot("status").unwrap();

    assert!(s.statuses.is_empty());

    assert!(!s.resolves);

    // Partially edited file that still has markers cannot be committed.

    write(root, "f.txt", marked.replace("B\n", "BB\n").as_bytes());

    let s = repo.snapshot("status").unwrap();

    assert_eq!(

        statuses(&s),

        vec![("f.txt".into(), ChangeStatus::ConflictEdited)]

    );

    assert!(repo.commit("no", &[]).is_err());

    // Resolve by keeping one side and adding a line elsewhere.

    write(root, "f.txt", b"a\nX\nc\nd\n");

    let s = repo.snapshot("status").unwrap();

    assert_eq!(statuses(&s), vec![("f.txt".into(), ChangeStatus::Resolved)]);

    assert!(s.resolves);

    let h4 = repo.commit("resolve", &[]).unwrap();

    let c4 = repo.store().get_change(&h4).unwrap();

    assert_eq!(c4.kind, ChangeKind::Resolution);

    let mut want = vec![h1, h2, h3];

    want.sort();

    assert_eq!(

        c4.deps, want,

        "a resolution depends on exactly the contributors and what it references"

    );

    assert_eq!(repo.bookmark_heads().unwrap(), vec![h4]);

    let snap = repo.load_state(&[h4]).unwrap().materialize();

    assert!(!snap.is_conflicted());

    assert!(

        matches!(&snap.files["f.txt"].content, FileContent::Text { bytes, .. } if bytes == b"a\nX\nc\nd\n")

    );

    assert!(!repo.snapshot("status").unwrap().changed);

    // A peer holding only h2 and h3 and receiving h4 sees the same result,

    // whatever order the changes arrive in.

    let mut st = State::new();

    for h in [h4, h3, h1, h2] {

        st.add_unchecked(repo.store().get_change(&h).unwrap());

    }

    st.validate().unwrap();

    assert!(

        matches!(&st.materialize().files["f.txt"].content, FileContent::Text { bytes, .. } if bytes == b"a\nX\nc\nd\n")

    );

}

#[test]

fn resolution_may_keep_both_sides_or_neither() {

    hermetic();

    let (dir, repo, _h1, _h2, _h3) = conflicted_repo();

    let root = dir.path();

    repo.checkout(&repo.bookmark_heads().unwrap(), false, "checkout main")

        .unwrap();

    // Keep both sides in a chosen order.

    write(root, "f.txt", b"a\nX\nB\nc\n");

    let h = repo.commit("both", &[]).unwrap();

    let snap = repo.load_state(&[h]).unwrap().materialize();

    assert!(!snap.is_conflicted());

    assert!(

        matches!(&snap.files["f.txt"].content, FileContent::Text { bytes, .. } if bytes == b"a\nX\nB\nc\n")

    );

    // Undo and instead drop the whole region.

    repo.undo().unwrap();

    write(root, "f.txt", b"a\nc\n");

    let h = repo.commit("neither", &[]).unwrap();

    let snap = repo.load_state(&[h]).unwrap().materialize();

    assert!(!snap.is_conflicted());

    assert!(

        matches!(&snap.files["f.txt"].content, FileContent::Text { bytes, .. } if bytes == b"a\nc\n")

    );

}

#[test]

fn name_conflict_resolved_by_removing_a_candidate() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let repo = Repo::init(root).unwrap();

    write(root, "keep.txt", b"k\n");

    let h1 = repo.commit("base", &[]).unwrap();

    write(root, "new.txt", b"one\n");

    repo.commit("one", &[]).unwrap();

    repo.checkout(&[h1], false, "checkout").unwrap();

    write(root, "new.txt", b"two\n");

    repo.commit("two", &[]).unwrap();

    let r = repo

        .checkout(&repo.bookmark_heads().unwrap(), false, "checkout main")

        .unwrap();

    assert!(r.conflicted);

    assert!(

        root.join("new.txt.oxy-conflict-1").exists()

            && root.join("new.txt.oxy-conflict-2").exists()

    );

    assert!(!root.join("new.txt").exists());

    // Candidate numbering follows change-hash order, so pick by content:

    // keep the "two" candidate under the real name and drop the other.

    let (keep, drop) = if fs::read(root.join("new.txt.oxy-conflict-1")).unwrap() == b"two\n" {

        (1, 2)

    } else {

        (2, 1)

    };

    fs::remove_file(root.join(format!("new.txt.oxy-conflict-{drop}"))).unwrap();

    fs::rename(

        root.join(format!("new.txt.oxy-conflict-{keep}")),

        root.join("new.txt"),

    )

    .unwrap();

    let h = repo.commit("pick two", &[]).unwrap();

    assert_eq!(

        repo.store().get_change(&h).unwrap().kind,

        ChangeKind::Resolution

    );

    // The resolution does not touch keep.txt, so it does not depend on h1;

    // the bookmark keeps both as heads and their union is the state.

    let heads: BTreeSet<_> = repo.bookmark_heads().unwrap().into_iter().collect();

    assert_eq!(heads, [h1, h].into_iter().collect());

    let snap = repo

        .load_state(&repo.bookmark_heads().unwrap())

        .unwrap()

        .materialize();

    assert!(!snap.is_conflicted(), "{:?}", snap.tree.conflicts);

    assert_eq!(

        snap.files.keys().cloned().collect::<Vec<_>>(),

        ["keep.txt", "new.txt"]

    );

    assert!(

        matches!(&snap.files["new.txt"].content, FileContent::Text { bytes, .. } if bytes == b"two\n")

    );

}

#[test]

fn identities_and_signed_commits() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let mut repo = Repo::init(root).unwrap().with_home(root.join("home"));

    write(root, "a.txt", b"a\n");

    let h0 = repo.commit("unsigned", &[]).unwrap();

    assert_eq!(repo.verify_change(&h0).unwrap(), SignatureStatus::Unsigned);

    assert_eq!(

        repo.store().get_change(&h0).unwrap().author,

        ObjectRef::ZERO

    );

    let (key, id) = repo

        .create_identity("Ada", "[email protected]", IdentityScope::Repo)

        .unwrap();

    assert_eq!(id.hash(), key);

    assert_eq!(repo.config.author_key, Some(key));

    // Config survives reopen; the secret key is found again.

    let reopened = Repo::open(root).unwrap().with_home(root.join("home"));

    assert_eq!(reopened.config.author_key, Some(key));

    assert_eq!(reopened.secret_key().unwrap().unwrap().0, key);

    // Default core.sign = seal: commits carry the author but no signature.

    write(root, "a.txt", b"a\nb\n");

    let h1 = repo.commit("authored", &[]).unwrap();

    assert_eq!(repo.store().get_change(&h1).unwrap().author, key);

    assert_eq!(repo.verify_change(&h1).unwrap(), SignatureStatus::Unsigned);

    // Signing later works too.

    repo.sign_change(&h1).unwrap();

    assert!(

        matches!(repo.verify_change(&h1).unwrap(), SignatureStatus::Valid { key: k, .. } if k == key)

    );

    repo.config.set("core.sign", "change").unwrap();

    repo.save_config().unwrap();

    write(root, "a.txt", b"a\nb\nc\n");

    let h2 = repo.commit("signed", &[]).unwrap();

    assert_eq!(

        repo.verify_change(&h2).unwrap(),

        SignatureStatus::Valid {

            key,

            name: "Ada".into(),

            email: "[email protected]".into(),

            sealed: false,

            revoked: false

        }

    );

    // A signature by a key that is not the author or a delegate is rejected

    // when the change names an author; an anonymous change (made before any

    // identity, author zero) is adopted by whoever signs it (spec §14.4).

    let other = SecretKey::generate();

    let other_id = other.identity("Mallory", "[email protected]", 0);

    let other_key = repo.store().put_identity(&other_id).unwrap();

    write(root, "a.txt", b"a\nb\nc\nd\n");

    repo.config.set("core.sign", "seal").unwrap();

    let h3 = repo.commit("ada's, unsigned", &[]).unwrap();

    let forged = other.sign(Domain::Change, &other_key, &h3);

    repo.store().put_signature(&h3, &forged).unwrap();

    assert!(

        matches!(repo.verify_change(&h3).unwrap(), SignatureStatus::Invalid(m) if m.contains("neither the author"))

    );

    let adopted = other.sign(Domain::Change, &other_key, &h0);

    repo.store().put_signature(&h0, &adopted).unwrap();

    assert!(

        matches!(repo.verify_change(&h0).unwrap(), SignatureStatus::Valid { name, .. } if name == "Mallory")

    );

    // Tampering with the stored signature invalidates it.

    let mut sig = repo.store().signatures(&h2).unwrap().remove(0);

    sig.ed[0] ^= 1;

    repo.store().put_signature(&h2, &sig).unwrap();

    assert!(matches!(

        repo.verify_change(&h2).unwrap(),

        SignatureStatus::Invalid(_)

    ));

    // Without the secret key, signing at commit fails cleanly.

    let no_keys = Repo::open(root).unwrap().with_home(root.join("nowhere"));

    write(root, "a.txt", b"z\n");

    assert!(no_keys.commit("cannot sign", &[]).is_err());

}

#[test]

fn checkout_moves_the_working_copy() {

    hermetic();

    let dir = tempfile::tempdir().unwrap();

    let root = dir.path();

    let repo = Repo::init(root).unwrap();

    write(root, "a.txt", b"one\n");

    write(root, "sub/deep/b.txt", b"b\n");

    let h1 = repo.commit("first", &[]).unwrap();

    write(root, "a.txt", b"two\n");

    fs::remove_file(root.join("sub/deep/b.txt")).unwrap();

    write(root, "bin.dat", &[0, 1, 2, 3]);

    let h2 = repo.commit("second", &[]).unwrap();

    let r = repo.checkout(&[h1], false, "oxy checkout").unwrap();

    assert_eq!(

        r,

        CheckoutReport {

            written: 2,

            removed: 1,

            removed_paths: vec!["bin.dat".into()],

            conflicted: false,

            notes: vec![],

            lacks: 1,

        }

    );

    assert_eq!(fs::read(root.join("a.txt")).unwrap(), b"one\n");

    assert_eq!(fs::read(root.join("sub/deep/b.txt")).unwrap(), b"b\n");

    assert!(!root.join("bin.dat").exists());