//! Tier 2 conformance on a real microVM (spec §10.1 and §10.5). Runs when

//! `FLOW_TEST_HOME` names a Flow home with `[microvm]` pinned and

//! `FLOW_TEST_ROOTFS` the hash of an Alpine rootfs in it; skipped otherwise.

use std::process::Command;

#[test]

fn a_pipeline_runs_isolated_in_microvms() {

    let (Some(home), Some(rootfs)) = (std::env::var_os("FLOW_TEST_HOME"), std::env::var("FLOW_TEST_ROOTFS").ok()) else {

        eprintln!("skipped: set FLOW_TEST_HOME and FLOW_TEST_ROOTFS to boot microVMs");

        return;

    };

    let dir = tempfile::tempdir().unwrap();

    std::fs::create_dir_all(dir.path().join(".flow")).unwrap();

    std::fs::write(

        dir.path().join(".flow/pipeline.kdl"),

        format!(

            r#"schema-version 1

sandbox "alpine" {{

    rootfs "cas://blob/{rootfs}"

    memory-limit "256MiB"

}}

job "literal" {{

    sandbox "alpine"

    exec "echo" "a; touch /src/pwned && $(id) | `id`"

}}

job "isolated" {{

    sandbox "alpine"

    exec "sh" "-c" "cat /proc/net/dev | tail -n +3 | cut -d: -f1 | tr -d ' '; wget -q -T 2 -O /dev/null http://1.1.1.1 && echo NETWORK || echo no-network"

}}

job "readonly" {{

    sandbox "alpine"

    exec "sh" "-c" "touch /etc/x 2>/dev/null && echo ROOTFS-WRITABLE; echo ok > /src/w && cat /src/w; id -u"

}}

job "fails" {{

    sandbox "alpine"

    exec "false"

}}

job "after-failure" {{

    sandbox "alpine"

    depends-on "fails"

    exec "echo" "SHOULD-NOT-RUN"

}}

"#

        ),

    )

    .unwrap();

    let out = Command::new(env!("CARGO_BIN_EXE_flow")).arg("--home").arg(&home).arg("run").current_dir(dir.path()).output().unwrap();

    let stdout = String::from_utf8_lossy(&out.stdout);

    assert!(!out.status.success(), "a failed job fails the run");

    assert!(stdout.contains("   a; touch /src/pwned && $(id) | `id`\n"), "argv is literal: {stdout}");

    assert!(!dir.path().join("pwned").exists());

    assert!(stdout.contains("   lo\n") && stdout.contains("no-network") && !stdout.contains("   NETWORK\n"), "only loopback: {stdout}");

    assert!(stdout.contains("   ok\n") && !stdout.contains("   ROOTFS-WRITABLE\n"), "rootfs read-only, workspace writable: {stdout}");

    assert!(!stdout.contains("   0\n"), "the job never runs as root: {stdout}");

    assert!(stdout.contains("── fails failed (exit 1)"), "{stdout}");

    assert!(stdout.contains("── after-failure skipped: fails failed") && !stdout.contains("   SHOULD-NOT-RUN\n"), "{stdout}");

}