//! Setting a server up without the owner's secret key (spec §8.6,

//! spectra#22): `spectra init --owner KEYID`, nothing served but who it

//! is until the named owner claims it, and nobody else may.

mod common;

use common::{hermetic, run, text, Serving};

use spectra_core::daemon::WireEvent;

use spectra_core::keys::KeyPair;

use spectra_core::principals::{identity_payload, signed_event};

use spectra_mcp::client::{Client, Endpoint};

use spectra_mcp::tls::Pinned;

fn claim_body(pair: &KeyPair) -> Vec<u8> {

    let e = signed_event(pair, "human", "identity.owner", identity_payload(&pair.identity));

    serde_json::to_vec(&WireEvent::from_new(&e)).unwrap()

}

#[tokio::test]

async fn the_named_owner_claims_a_server_and_nobody_else_can() {

    let dir = tempfile::tempdir().unwrap();

    let d = dir.path();

    // The owner's key is on another machine: here there is only its KeyId.

    let owner = KeyPair::generate("Andy McCall", "");

    let o = run(d, &["init", "--owner", &owner.key.to_hex(), "--name", "earth"]);

    assert!(o.status.success(), "{}", text(&o));

    assert!(text(&o).contains("not yet claimed"), "{}", text(&o));

    assert!(!d.join("owner").exists(), "no owner home was read or made");

    let (srv, port) = Serving::start_tls(d);

    let probe = Pinned::new(None);

    let anon = Client::at(Endpoint::Tls { addr: format!("127.0.0.1:{port}"), config: probe.client_config().unwrap() }, None);

    let info = anon.send("GET", "/api/v1/instance", &[], vec![]).await.unwrap().json().unwrap();

    assert_eq!(info["name"], "earth");

    assert!(info["owner"].is_null(), "unclaimed");

    let pin = probe.seen().unwrap().1;

    let url = format!("https://127.0.0.1:{port}");

    // Before the claim, even the owner's signed requests are refused, and say why.

    let as_owner = Client::at(Endpoint::tls(&url, pin).unwrap(), Some(owner.clone()));

    let r = as_owner.send("GET", "/api/v1/agents", &[], vec![]).await.unwrap();

    assert_eq!(r.status, 401);

    assert!(String::from_utf8_lossy(&r.body).contains("no owner yet"), "{}", String::from_utf8_lossy(&r.body));

    // Someone else cannot claim it.

    let mallory = KeyPair::generate("Mallory", "");

    let r = anon.send("POST", "/api/v1/claim", &[], claim_body(&mallory)).await.unwrap();

    assert_eq!(r.status, 403);

    assert!(String::from_utf8_lossy(&r.body).contains("another owner"));

    // Nor can a claim naming the owner but signed by another key.

    let mut forged = signed_event(&mallory, "human", "identity.owner", identity_payload(&owner.identity));

    forged.payload = identity_payload(&owner.identity);

    let r = anon.send("POST", "/api/v1/claim", &[], serde_json::to_vec(&WireEvent::from_new(&forged)).unwrap()).await.unwrap();

    assert_eq!(r.status, 403);

    // The owner can, once.

    let r = anon.send("POST", "/api/v1/claim", &[], claim_body(&owner)).await.unwrap();

    assert_eq!(r.status, 200, "{}", String::from_utf8_lossy(&r.body));

    let r = as_owner.send("GET", "/api/v1/agents", &[], vec![]).await.unwrap();

    assert_eq!(r.status, 200, "{}", String::from_utf8_lossy(&r.body));

    let r = anon.send("POST", "/api/v1/claim", &[], claim_body(&owner)).await.unwrap();

    assert_eq!(r.status, 403);

    assert!(String::from_utf8_lossy(&r.body).contains("already has an owner"));

    let info = anon.send("GET", "/api/v1/instance", &[], vec![]).await.unwrap().json().unwrap();

    assert_eq!(info["owner"], owner.key.to_hex());

    srv.stop();

    // An owner recorded after the instance verifies, and rebuilds.

    for args in [["admin", "verify"], ["admin", "rebuild"], ["admin", "check"]] {

        let o = hermetic(d).args(args).output().unwrap();

        assert!(o.status.success(), "{args:?}: {}", text(&o));

    }

}

#[test]

fn init_refuses_what_is_not_a_key_id() {

    let dir = tempfile::tempdir().unwrap();

    let o = run(dir.path(), &["init", "--owner", "andy"]);

    assert!(!o.status.success());

    assert!(text(&o).contains("not a KeyId"), "{}", text(&o));

}