felhom-agent/internal/hub/contract_test.go

package hub

import (
	"encoding/json"
	"os"
	"reflect"
	"sort"
	"testing"
)

// The host-report shape is a contract DUPLICATED across two repos (no shared types
// module yet). testdata/host-report.golden.json MUST be kept byte-identical with
// felhom-hub's hub/internal/api/testdata/host-report.golden.json. This test fails
// if a json tag on HostReport/HostMetrics/Guest is renamed/added/removed relative
// to the golden, catching silent drift before slices 5/6 populate the empty
// collections. (Promote to a shared types module when those land.)
func TestHostReport_ContractMatchesGolden(t *testing.T) {
	raw, err := os.ReadFile("testdata/host-report.golden.json")
	if err != nil {
		t.Fatal(err)
	}
	var golden map[string]any
	if err := json.Unmarshal(raw, &golden); err != nil {
		t.Fatalf("golden is not valid JSON: %v", err)
	}

	// A constructed report mirroring the golden's populated shape: guests[0] has spec,
	// storage_targets[0] is an lvmthin (so its thin_pool + smart sub-objects are exercised).
	report := &HostReport{
		HostID: "demo-host-01", ReportedAt: "2026-06-08T12:00:00Z", AgentVersion: "0.3.1",
		Host: HostMetrics{Node: "demo-felhom", LoadAvg: []string{"0.10"}},
		Guests: []Guest{
			{VMID: 100, Name: "a", Status: "running", ControllerVersion: "", Spec: &GuestSpec{Cores: 2}},
			{VMID: 101, Name: "b", Status: "stopped", ControllerVersion: ""},
		},
		StorageTargets: []StorageTarget{
			{
				Name: "local-lvm", Type: StorageTypeLVMThin, DurableID: "pve/data",
				State: StorageStateAttached, Reachable: true, ClassHint: "fast",
				ThinPool: &ThinPoolFill{DataUsedFraction: 0.42},
				Smart:    SmartSummary{Health: SmartUnknown},
			},
			{
				Name: "usb-backup", Type: StorageTypeUSB, DurableID: "uuid:x",
				State: StorageStateAttached, Reachable: true, MountPath: "/mnt/usb-backup", TotalBytes: 2000000000000,
				Smart: SmartSummary{Health: SmartUnknown},
			},
		},
		Backups: []Backup{
			{
				TargetID: "local", VMID: 9001, Archive: "local:backup/x.tar.zst", Mode: "snapshot",
				CrashConsistent: true, SizeBytes: 1, Success: true, StartedAt: "2026-06-09T11:00:00Z",
				DurationSeconds: 1, UncoveredVolumes: []string{"/mnt/bulk"},
			},
		},
		RestoreTests: []RestoreTest{
			{
				SourceArchive: "local:backup/x.tar.zst", SourceTier: "local", ScratchVMID: 990000,
				Pass: true, Verified: "boot+running", TestedAt: "2026-06-09T11:05:00Z", DurationSeconds: 1,
				// slice-7 (v0.7.0): warnings + warnings_recognized must appear in the marshaled
				// shape so the bidirectional key-set guard exercises the new wire keys.
				Warnings:           []string{"WARN: Systemd 257 detected. You may need to enable nesting."},
				WarningsRecognized: true,
			},
		},
		PBSSnapshots: []PBSSnapshot{
			{
				Namespace: "root", BackupType: "ct", BackupID: "9001", BackupTime: "2026-06-09T14:18:33Z",
				SizeBytes: 1, Owner: "felhom@pbs!n100", Protected: false, Encrypted: true,
				VerifyState: "ok", VerifyUPID: "UPID:dooplex:x:verify:felhom-spike:u:",
			},
		},
		AuditTail:   []AuditEntry{},
		Cloudflared: Cloudflared{Status: "active"},
	}
	// dr_recipe host-half: built from the same guest/storage/pbs facts (the production path).
	report.DRRecipe = BuildDRRecipeHostHalf(report.Guests, report.StorageTargets, report.PBSSnapshots)
	b, _ := json.Marshal(report)
	var got map[string]any
	json.Unmarshal(b, &got)

	assertSameKeys(t, "<top>", golden, got)
	assertSameKeys(t, "host", golden["host"], got["host"])
	assertSameKeys(t, "guests[0]",
		firstElem(golden["guests"]), firstElem(got["guests"]))

	// storage_targets[0] is the slice-5 addition — assert its full key set and both
	// sub-objects (smart always present; thin_pool present for the lvmthin element).
	gst := firstElem(golden["storage_targets"])
	sst := firstElem(got["storage_targets"])
	assertSameKeys(t, "storage_targets[0]", gst, sst)
	assertSameKeys(t, "storage_targets[0].smart", field(gst, "smart"), field(sst, "smart"))
	assertSameKeys(t, "storage_targets[0].thin_pool", field(gst, "thin_pool"), field(sst, "thin_pool"))

	// slice-6 additions — backups[0] / restore_tests[0] key sets (the bidirectional guard).
	assertSameKeys(t, "backups[0]", firstElem(golden["backups"]), firstElem(got["backups"]))
	assertSameKeys(t, "restore_tests[0]", firstElem(golden["restore_tests"]), firstElem(got["restore_tests"]))
	// slice-6-Phase-B addition — pbs_snapshots[0] key set.
	assertSameKeys(t, "pbs_snapshots[0]", firstElem(golden["pbs_snapshots"]), firstElem(got["pbs_snapshots"]))

	// DR-recipe host-half — the agent's secret-free reconstruction-scaffolding section. Assert the
	// dr_recipe key set + each sub-array's element key set (the cross-repo wire pinned in the golden).
	grec, srec := golden["dr_recipe"], got["dr_recipe"]
	assertSameKeys(t, "dr_recipe", grec, srec)
	assertSameKeys(t, "dr_recipe.pbs", field(grec, "pbs"), field(srec, "pbs"))
	assertSameKeys(t, "dr_recipe.guests[0]", firstElem(field(grec, "guests")), firstElem(field(srec, "guests")))
	assertSameKeys(t, "dr_recipe.drives[0]", firstElem(field(grec, "drives")), firstElem(field(srec, "drives")))
	assertSameKeys(t, "dr_recipe.pve_storage[0]", firstElem(field(grec, "pve_storage")), firstElem(field(srec, "pve_storage")))
}

// field extracts a nested object value from a decoded JSON map (nil if absent/not a map).
func field(v any, key string) any {
	m, ok := v.(map[string]any)
	if !ok {
		return nil
	}
	return m[key]
}

func firstElem(v any) any {
	arr, ok := v.([]any)
	if !ok || len(arr) == 0 {
		return map[string]any{}
	}
	return arr[0]
}

func assertSameKeys(t *testing.T, where string, a, b any) {
	t.Helper()
	ka, kb := keysOf(a), keysOf(b)
	if !reflect.DeepEqual(ka, kb) {
		t.Errorf("contract drift at %s:\n golden keys = %v\n struct keys = %v", where, ka, kb)
	}
}

func keysOf(v any) []string {
	m, ok := v.(map[string]any)
	if !ok {
		return nil
	}
	keys := make([]string, 0, len(m))
	for k := range m {
		keys = append(keys, k)
	}
	sort.Strings(keys)
	return keys
}