package offsiteapply

import (
	"context"
	"strings"
	"testing"
)

// ── R-218's CONSUME HALF ─────────────────────────────────────────────────────────────────────────
//
// Measured on the R-201 re-walk, 2026-08-06: the hub staged a credential at 11:44:57 and logged
// "the box re-consumes on its next cycle"; a full report cycle ran at 11:55:46; at 12:06 it was still
// unconsumed, and a guest command line applied it in 18 seconds. Everything was correct except that
// nothing ever re-ran the reconcile.
//
// These assert the EFFECT — was a reconcile attempted, and did the tier get applied — not that a
// helper returned a bool.

// ── SCENARIO A — a credential staged AFTER start-up is collected, unaided ────────────────────────
//
// RED-PROOF: make RetryIfDeclared return (false, nil) unconditionally — i.e. remove the retry, which
// is the pre-v0.203.0 world — and this FAILS with the credential still sitting unconsumed. That is
// the re-walk's first dead end, reproduced.
func TestRetryIfDeclared_CollectsACredentialStagedAfterStartup(t *testing.T) {
	b, cons, _, en, _ := newBridge(t, goodOffsite())

	// The box declares: it was rebuilt, has no target, and the hub holds a package for it.
	attempted, err := b.RetryIfDeclared(context.Background(), func() bool { return true })
	if err != nil {
		t.Fatalf("retry: %v", err)
	}
	if !attempted {
		t.Fatal("R-218 RETURNED: the box declared a need and no reconcile was attempted")
	}
	// EFFECT: the one-time password was actually consumed and the tier configured.
	if cons.calls == 0 {
		t.Fatal("the staged credential was never collected")
	}
	if en.calls == 0 {
		t.Fatal("the off-site tier was never configured after collecting the credential")
	}
}

// ── SCENARIO C — a healthy box does not retry, and makes no noise ────────────────────────────────
//
// RED-PROOF: drop the `!declared()` guard so the tick always reconciles → this FAILS, and a box whose
// tier already works hammers the hub forever.
func TestRetryIfDeclared_HealthyBoxDoesNothing(t *testing.T) {
	b, cons, inst, en, logbuf := newBridge(t, goodOffsite())

	attempted, err := b.RetryIfDeclared(context.Background(), func() bool { return false })
	if err != nil {
		t.Fatalf("retry: %v", err)
	}
	if attempted {
		t.Fatal("a box that declares NO need must not reconcile")
	}
	if cons.calls != 0 || inst.calls != 0 || en.calls != 0 {
		t.Fatalf("a healthy box touched the hub: consume=%d install=%d enable=%d", cons.calls, inst.calls, en.calls)
	}
	if strings.TrimSpace(logbuf.String()) != "" {
		t.Fatalf("a healthy box logged noise every tick: %q", logbuf.String())
	}
}

// A nil bridge (off-site not configured for this customer) is a silent no-op, not a panic — main.go
// wires nil in exactly that case.
func TestRetryIfDeclared_NilBridgeIsSilent(t *testing.T) {
	var b *Bridge
	attempted, err := b.RetryIfDeclared(context.Background(), func() bool { return true })
	if attempted || err != nil {
		t.Fatalf("a nil bridge must be a silent no-op, got attempted=%v err=%v", attempted, err)
	}
}

// ── SCENARIO D — the settle gate still holds on the retry path ───────────────────────────────────
//
// The retry must not become a back door around the day-0 floor race the gate exists for. It goes
// through ReconcileWhenSettled, so an unsettled box WAITS rather than reconciling immediately.
//
// RED-PROOF: change RetryIfDeclared to call Reconcile directly instead of ReconcileWhenSettled →
// this FAILS, because the reconcile happens while the floor is still unknown.
func TestRetryIfDeclared_HonoursTheSettleGate(t *testing.T) {
	b, cons, _, _, _ := newBridge(t, goodOffsite())
	// Floor never becomes known → the gate must hold the reconcile off until its own bound expires.
	b.Settle = SettleFunc(func() (string, string, bool, bool) { return "0.203.0", "", false, false })

	ctx, cancel := context.WithCancel(context.Background())
	cancel() // the gate observes a cancelled context and must not proceed to reconcile

	attempted, err := b.RetryIfDeclared(ctx, func() bool { return true })
	if !attempted {
		t.Fatal("the box declared, so a retry attempt must be reported even when the gate stops it")
	}
	if err == nil {
		t.Fatal("a cancelled gate must surface an error, not silently reconcile")
	}
	if cons.calls != 0 {
		t.Fatal("SETTLE GATE BYPASSED: the retry consumed a password while the floor was unknown")
	}
}