#!/usr/bin/env bats

# Shared by bats and cozytest.sh: inspect exit codes directly, without bats-only
# helpers. Scratch directories stay available if an assertion fails.

load test_helper

make_render_chart() {
    mkdir -p "$1/templates"
    printf 'apiVersion: v2\nname: render-test\nversion: 0.0.0\n' > "$1/Chart.yaml"
    printf 'apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: render-test\n' > "$1/templates/object.yaml"
}

expect_render_failure() {
    if output=$(dash hack/check-render-matrix.sh "$@" 2>&1); then
        echo "expected render failure, got: $output" >&2
        return 1
    fi
    printf '%s\n' "$output"
}

@test "rendered plus skipped accounts for every app chart" {
    total=$(find packages/apps -mindepth 1 -maxdepth 1 -type d | wc -l | tr -d ' ')
    output=$(dash hack/check-render-matrix.sh)
    summary=$(printf '%s\n' "$output" | grep '^check-render-matrix:')
    rendered=$(printf '%s\n' "$summary" | sed 's/.*: \([0-9]*\) rendered.*/\1/')
    skipped=$(printf '%s\n' "$summary" | sed 's/.*, \([0-9]*\) skipped.*/\1/')
    [ "$rendered" -gt 0 ]
    [ "$((rendered + skipped))" -eq "$total" ]
}

@test "render matrix preserves multiple chart paths containing spaces" {
    tmp=$(mktemp -d)
    make_render_chart "$tmp/space in parent/first"
    make_render_chart "$tmp/space in parent/second"
    output=$(dash hack/check-render-matrix.sh "$tmp/space in parent/first/" "$tmp/space in parent/second")
    printf '%s\n' "$output" | grep -Fx 'check-render-matrix: 2 rendered, 0 skipped'
    rm -rf "$tmp"
}

@test "render matrix refuses empty discovery and ignores nested fixtures" {
    tmp=$(mktemp -d)
    mkdir -p "$tmp/hack/testdata/render-fixtures/validator"
    cp hack/check-render-matrix.sh "$tmp/hack/"
    cp hack/testdata/render-fixtures/fresh.yaml "$tmp/hack/testdata/render-fixtures/validator/nested.yaml"
    output=$(cd "$tmp" && expect_render_failure)
    printf '%s\n' "$output" | grep -F 'found no charts under packages/apps'
    make_render_chart "$tmp/packages/apps/example"
    output=$(cd "$tmp" && expect_render_failure)
    printf '%s\n' "$output" | grep -F 'no fixtures under hack/testdata/render-fixtures'
    rm -rf "$tmp"
}

@test "render matrix reports a broken chart and still checks the next chart" {
    tmp=$(mktemp -d)
    make_render_chart "$tmp/broken"
    make_render_chart "$tmp/valid"
    printf '{{ required "deliberately broken" .Values.nope }}\n' > "$tmp/broken/templates/object.yaml"
    output=$(expect_render_failure "$tmp/broken" "$tmp/valid")
    for fixture in hack/testdata/render-fixtures/*.yaml; do
        state=$(basename "$fixture" .yaml)
        printf '%s\n' "$output" | grep -Fx "FAIL broken ($state)"
    done
    printf '%s\n' "$output" | grep -F 'deliberately broken'
    printf '%s\n' "$output" | grep -Fx 'check-render-matrix: 1 rendered, 0 skipped'
    rm -rf "$tmp"
}

@test "render matrix fails on malformed YAML" {
    tmp=$(mktemp -d)
    make_render_chart "$tmp/badyaml"
    printf 'a: b\n  c: d\n' > "$tmp/badyaml/templates/object.yaml"
    output=$(expect_render_failure "$tmp/badyaml")
    printf '%s\n' "$output" | grep -F 'FAIL badyaml'
    printf '%s\n' "$output" | grep -F 'YAML parse error'
    rm -rf "$tmp"
}

@test "render matrix does not count a nonexistent chart as rendered" {
    tmp=$(mktemp -d)
    output=$(expect_render_failure "$tmp/missing")
    printf '%s\n' "$output" | grep -F 'FAIL missing'
    printf '%s\n' "$output" | grep -Fx 'check-render-matrix: 0 rendered, 0 skipped'
    rm -rf "$tmp"
}

@test "render matrix rejects skips that now render or fail for another reason" {
    tmp=$(mktemp -d)
    for name in vm-instance kubernetes-nodes; do
        make_render_chart "$tmp/$name"
        output=$(expect_render_failure "$tmp/$name")
        printf '%s\n' "$output" | grep -F 'chart now renders; remove its skip'
        printf '{{ fail "unrelated render failure" }}\n' > "$tmp/$name/templates/object.yaml"
        output=$(expect_render_failure "$tmp/$name")
        printf '%s\n' "$output" | grep -F 'unrelated render failure'
        printf '%s\n' "$output" | grep -Fx 'check-render-matrix: 0 rendered, 0 skipped'
    done
    rm -rf "$tmp"
}

@test "render matrix counts documented lookup failures as skipped" {
    tmp=$(mktemp -d)
    make_render_chart "$tmp/vm-instance"
    make_render_chart "$tmp/kubernetes-nodes"
    printf '%s\n' '{{ fail "Specified instanceType does not exist in the cluster: u1.medium" }}' > "$tmp/vm-instance/templates/object.yaml"
    printf '%s\n' '{{ fail `specified instanceType "u1.medium" not found in cluster` }}' > "$tmp/kubernetes-nodes/templates/object.yaml"
    output=$(dash hack/check-render-matrix.sh "$tmp/vm-instance" "$tmp/kubernetes-nodes")
    printf '%s\n' "$output" | grep -F 'SKIP vm-instance ('
    printf '%s\n' "$output" | grep -F 'SKIP kubernetes-nodes ('
    printf '%s\n' "$output" | grep -Fx 'check-render-matrix: 0 rendered, 2 skipped'
    rm -rf "$tmp"
}

@test "fixtures match the injected value types" {
    for fixture in hack/testdata/render-fixtures/*.yaml; do
        helm template fixture-check hack/testdata/render-fixtures/validator \
            --set-file "fixture=$fixture"
    done
}

@test "fixture validation rejects wrong scalar and scheduling types" {
    tmp=$(mktemp -d)
    for value in true 12 null '[]' '{}'; do
        printf '_cluster:\n  oidc-enabled: %s\n_namespace: {host: "example.org"}\n' "$value" > "$tmp/value.yaml"
        if output=$(helm template fixture-check hack/testdata/render-fixtures/validator \
            --set-file "fixture=$tmp/value.yaml" 2>&1); then
            echo "accepted non-string oidc-enabled: $value" >&2
            exit 1
        fi
        printf '%s\n' "$output" | grep -F '_cluster.oidc-enabled must be a string'
    done
    for value in true 12 null '[]' '{}'; do
        printf '_cluster:\n  scheduling:\n    globalAppTopologySpreadConstraints: %s\n    dedicatedNodesForWindowsVMs: "false"\n_namespace: {host: "example.org"}\n' "$value" > "$tmp/value.yaml"
        if output=$(helm template fixture-check hack/testdata/render-fixtures/validator \
            --set-file "fixture=$tmp/value.yaml" 2>&1); then
            echo "accepted non-string scheduling constraint: $value" >&2
            exit 1
        fi
        printf '%s\n' "$output" | grep -F '_cluster.scheduling.globalAppTopologySpreadConstraints must be a string'
    done
    rm -rf "$tmp"
}

@test "fixture validation rejects malformed maps and missing scheduling keys" {
    tmp=$(mktemp -d)
    for variant in malformed-yaml empty-namespace branding-scalar namespace-map scheduling-scalar missing-scheduling missing-constraint missing-windows; do
        cluster_extra=''
        scheduling='scheduling:'
        namespace='host: "example.org"'
        constraint='globalAppTopologySpreadConstraints: ""'
        windows='dedicatedNodesForWindowsVMs: "false"'
        case "$variant" in
            malformed-yaml) constraint='['; windows=''; expected='error converting YAML to JSON' ;;
            empty-namespace) namespace=''; expected='_namespace must be a non-empty map' ;;
            branding-scalar) cluster_extra='branding: true'; expected='_cluster.branding must be a map' ;;
            namespace-map) namespace='branding: {}'; expected='_namespace.branding must be a string' ;;
            scheduling-scalar) constraint='true'; windows=''; expected='_cluster.scheduling must be a map' ;;
            missing-scheduling) cluster_extra='oidc-enabled: "false"'; scheduling=''; constraint=''; windows=''; expected='_cluster.scheduling must be a map' ;;
            missing-constraint) constraint=''; expected='_cluster.scheduling.globalAppTopologySpreadConstraints is missing' ;;
            missing-windows) windows=''; expected='_cluster.scheduling.dedicatedNodesForWindowsVMs is missing' ;;
        esac
        printf '_cluster:\n  %s\n  %s\n    %s\n    %s\n_namespace: {%s}\n' \
            "$cluster_extra" "$scheduling" "$constraint" "$windows" "$namespace" > "$tmp/value.yaml"
        if output=$(helm template fixture-check hack/testdata/render-fixtures/validator \
            --set-file "fixture=$tmp/value.yaml" 2>&1); then
            echo "accepted invalid fixture: $variant" >&2
            exit 1
        fi
        printf '%s\n' "$output" | grep -F "$expected"
    done
    rm -rf "$tmp"
}

@test "configured scheduling reaches the postgres manifest" {
    tmp=$(mktemp -d)
    for state in fresh configured wildcard; do
        helm template postgres-render-check packages/apps/postgres -n tenant-test \
            -f "hack/testdata/render-fixtures/$state.yaml" > "$tmp/$state.yaml"
    done
    if grep -q '^  topologySpreadConstraints:' "$tmp/fresh.yaml"; then
        echo 'fresh unexpectedly enables topology spread' >&2
        exit 1
    fi
    for state in configured wildcard; do
        grep -A 7 '^  topologySpreadConstraints:' "$tmp/$state.yaml" > "$tmp/constraints"
        grep -F 'maxSkew: 1' "$tmp/constraints"
        grep -F 'topologyKey: topology.kubernetes.io/zone' "$tmp/constraints"
        grep -F 'cnpg.io/cluster: postgres-render-check' "$tmp/constraints"
    done
    rm -rf "$tmp"
}

@test "render matrix reaches capability-gated OIDC templates" {
    tmp=$(mktemp -d)
    make_render_chart "$tmp/tenant"
    cat > "$tmp/tenant/templates/object.yaml" <<'EOF'
{{- if and (eq (index .Values._cluster "oidc-enabled") "true") (.Capabilities.APIVersions.Has "v1.edp.epam.com/v1") }}
{{- fail "OIDC branch rendered" }}
{{- end }}
EOF
    output=$(expect_render_failure "$tmp/tenant")
    printf '%s\n' "$output" | grep -Fx 'FAIL tenant (configured)'
    printf '%s\n' "$output" | grep -Fx 'FAIL tenant (wildcard)'
    printf '%s\n' "$output" | grep -F 'OIDC branch rendered'
    if printf '%s\n' "$output" | grep -Fq 'FAIL tenant (fresh)'; then
        echo 'OIDC branch enabled for fresh fixture' >&2
        exit 1
    fi
    rm -rf "$tmp"
}

@test "fixture states enable OIDC groups and shared-service resources" {
    tmp=$(mktemp -d)
    for state in fresh configured wildcard; do
        helm template tenant-check packages/apps/tenant -n tenant-test \
            --api-versions v1.edp.epam.com/v1 \
            -f "hack/testdata/render-fixtures/$state.yaml" > "$tmp/tenant.yaml"
        helm template kubernetes-check packages/apps/kubernetes -n tenant-test \
            -f "hack/testdata/render-fixtures/$state.yaml" > "$tmp/kubernetes.yaml"
        groups=$(awk '/^kind: KeycloakRealmGroup$/ {n++} END {print n+0}' "$tmp/tenant.yaml")
        metrics=$(awk '/^  name: kubernetes-check-metrics-server$/ {n++} END {print n+0}' "$tmp/kubernetes.yaml")
        case "$state" in
            fresh) [ "$groups" -eq 0 ]; [ "$metrics" -eq 0 ] ;;
            *) [ "$groups" -eq 4 ]; [ "$metrics" -eq 1 ] ;;
        esac
    done
    rm -rf "$tmp"
}

@test "certificate fixtures exercise per-host ACME and wildcard ingress" {
    tmp=$(mktemp -d)
    for state in configured wildcard; do
        helm template harbor-check packages/apps/harbor -n tenant-test \
            -f "hack/testdata/render-fixtures/$state.yaml" \
            --show-only templates/ingress.yaml > "$tmp/$state.yaml"
        grep -Fx 'kind: Ingress' "$tmp/$state.yaml"
        grep -F 'harbor-check.example.org' "$tmp/$state.yaml"
    done
    grep -F 'acme.cert-manager.io/http01-ingress-ingressclassname: tenant-test' "$tmp/configured.yaml"
    grep -F 'cert-manager.io/cluster-issuer: letsencrypt-prod' "$tmp/configured.yaml"
    grep -F 'secretName: harbor-check-ingress-tls' "$tmp/configured.yaml"
    grep -Fx '  tls:' "$tmp/wildcard.yaml"
    if grep -Eq '^[[:space:]]+(acme.cert-manager.io/|cert-manager.io/cluster-issuer:|secretName:)' "$tmp/wildcard.yaml"; then
        echo 'wildcard ingress unexpectedly requests a per-host certificate' >&2
        exit 1
    fi
    rm -rf "$tmp"
}

@test "every pair of fixture states produces different deterministic manifests" {
    tmp=$(mktemp -d)
    count=0
    for fixture in hack/testdata/render-fixtures/*.yaml; do
        state=$(basename "$fixture" .yaml)
        count=$((count + 1))
        # This compares whole states; the tests above assert specific branches.
        # Render twice so randomness cannot masquerade as state coverage.
        for run in first second; do
            helm template tenant-check packages/apps/tenant -n tenant-test \
                --api-versions v1.edp.epam.com/v1 -f "$fixture" > "$tmp/$state-$run.yaml"
        done
        cmp "$tmp/$state-first.yaml" "$tmp/$state-second.yaml"
        cp "$tmp/$state-first.yaml" "$tmp/$state.manifests"
    done
    [ "$count" -ge 3 ]
    for a in "$tmp"/*.manifests; do
        for b in "$tmp"/*.manifests; do
            [ "$a" != "$b" ] || continue
            if cmp -s "$a" "$b"; then
                echo "fixture states produce identical manifests: $a and $b" >&2
                exit 1
            fi
        done
    done
    rm -rf "$tmp"
}