//! The owner and agents from the command line (spec §8.1, §8.3), as the
//! built binary in a hermetic environment: `init` proves the owner's
//! identity, `agent add` refuses until the owner delegates, ownership is
//! shown, and the ledger verifies throughout.

use oxy_core::durable::{write_atomic, write_atomic_private};
use oxy_core::identity::{Delegate, Identity, SecretKey};
use spectra_core::keys::KeyPair;
use spectra_core::principals::DELEGATION_SCOPE;
use std::path::Path;
use std::process::{Command, Output};

fn hermetic(dir: &Path) -> Command {
    let mut c = Command::new(env!("CARGO_BIN_EXE_spectra"));
    c.env("SPECTRA_DATA", dir.join("data"))
        .env("OXY_HOME", dir.join("owner"))
        .env("HOME", dir)
        .env("XDG_DATA_HOME", dir.join("xdg"))
        .env("NO_COLOR", "1");
    c
}

fn run(dir: &Path, args: &[&str]) -> Output {
    hermetic(dir).args(args).output().unwrap()
}

fn text(o: &Output) -> String {
    format!("{}{}", String::from_utf8_lossy(&o.stdout), String::from_utf8_lossy(&o.stderr))
}

/// `oxy identity delegate add IDENTITY --scope changes` in the owner's home.
fn delegate(owner_home: &Path, agent: &Identity) {
    let cur = KeyPair::load_home(owner_home).unwrap();
    let keys = owner_home.join("keys");
    let (_, secret) = SecretKey::decode(&std::fs::read(keys.join(format!("{}.secret", cur.key.to_hex()))).unwrap()).unwrap();
    let mut d = cur.identity.delegates.clone();
    d.push(Delegate { key: agent.hash(), scope: DELEGATION_SCOPE, expires: None });
    let next = cur.identity.successor(d, None, spectra_core::ids::now_ms());
    let k = next.hash();
    write_atomic_private(&keys.join(format!("{}.secret", k.to_hex())), &secret.encode(&k)).unwrap();
    write_atomic(&keys.join(format!("{}.identity", k.to_hex())), &next.encode()).unwrap();
    oxy_core::repo::Config::set_user(&owner_home.join("config.toml"), "author.key", &k.to_hex()).unwrap();
}

fn verify_clean(dir: &Path) {
    let o = run(dir, &["admin", "verify", "--json"]);
    let v: serde_json::Value = serde_json::from_slice(&o.stdout).unwrap_or_else(|_| panic!("{}", text(&o)));
    assert!(o.status.success() && v["findings"].as_array().unwrap().is_empty(), "{v}");
}

#[test]
fn init_then_an_owned_agent_end_to_end() {
    let dir = tempfile::tempdir().unwrap();
    let d = dir.path();
    KeyPair::create_home(&d.join("owner"), "Andy McCall", "andy@example.org").unwrap();

    let o = run(d, &["init", "--name", "laptop"]);
    assert!(o.status.success(), "{}", text(&o));
    assert!(text(&o).contains("oxy identity delegate add"), "{}", text(&o));
    assert!(!run(d, &["init"]).status.success(), "a second init is refused");
    verify_clean(d);

    let checkout = d.join("oxygen");
    std::fs::create_dir_all(&checkout).unwrap();
    let o = run(d, &["project", "add", checkout.to_str().unwrap()]);
    assert!(o.status.success(), "{}", text(&o));
    let home = d.join("agents/claude-oxygen");
    let home_s = home.to_str().unwrap();
    let args = ["agent", "add", "claude-oxygen", "--kind", "claude-code", "--project", "oxygen", "--home", home_s, "--wait", "0"];
    let o = run(d, &args);
    assert!(!o.status.success(), "refused until delegated");
    assert!(text(&o).contains("oxy identity delegate add") && text(&o).contains("not delegated yet"), "{}", text(&o));
    let agent = KeyPair::load_home(&home).unwrap();

    delegate(&d.join("owner"), &agent.identity);
    let o = run(d, &args);
    assert!(o.status.success(), "{}", text(&o));
    assert!(text(&o).contains("Added claude-oxygen") && text(&o).contains("Andy McCall's agent"), "{}", text(&o));
    assert_eq!(KeyPair::load_home(&home).unwrap().key, agent.key, "the key made first is the key recorded");

    let list: serde_json::Value = serde_json::from_slice(&run(d, &["agent", "list", "--json"]).stdout).unwrap();
    assert_eq!(list[0]["display"], "claude-oxygen · Andy McCall's agent");
    assert_eq!(list[0]["state"], "ok");
    verify_clean(d);

    assert!(run(d, &["agent", "disable", "claude-oxygen"]).status.success());
    let list: serde_json::Value = serde_json::from_slice(&run(d, &["agent", "list", "--json"]).stdout).unwrap();
    assert!(list[0]["state"].as_str().unwrap().contains("disabled"), "{list}");
    verify_clean(d);
    assert!(run(d, &["admin", "check"]).status.success());

    // Piped, as here, output is plain like oxy's: no colour codes, no glyphs.
    let o = run(d, &["agent", "list"]);
    let t = text(&o);
    assert!(!t.contains('\x1b') && !t.contains('✔'), "{t}");
}

#[test]
fn an_owner_without_a_secret_key_cannot_init() {
    let dir = tempfile::tempdir().unwrap();
    let o = run(dir.path(), &["init"]);
    assert!(!o.status.success());
    assert!(text(&o).contains("the owner signs with their own identity"), "{}", text(&o));
}

#[tokio::test]
async fn a_second_writer_is_refused() {
    let dir = tempfile::tempdir().unwrap();
    let d = dir.path();
    KeyPair::create_home(&d.join("owner"), "Andy McCall", "").unwrap();
    assert!(run(d, &["init"]).status.success());
    let instance = KeyPair::instance(&d.join("data"), "x").unwrap();
    let held = spectra_core::ledger::Ledger::open(&d.join("data/spectra.db"), Some(instance)).await.unwrap();
    let o = run(d, &["agent", "disable", "nobody"]);
    assert!(text(&o).contains("another process is writing"), "{}", text(&o));
    assert!(run(d, &["admin", "verify"]).status.success(), "reading needs no lock");
    drop(held);
}