package monitor

import (
	"testing"

	"gitea.dooplex.hu/admin/felhom-controller/internal/config"
	"gitea.dooplex.hu/admin/felhom-controller/internal/infra"
	"gitea.dooplex.hu/admin/felhom-controller/internal/settings"
)

func contains(ss []string, want string) bool {
	for _, s := range ss {
		if s == want {
			return true
		}
	}
	return false
}

// EffectiveProtected must drop cloudflared when no tunnel token is configured (LAN-only node), so the
// health loop doesn't report it missing forever — but keep it when a token IS configured.
func TestEffectiveProtectedDropsCloudflaredWithoutToken(t *testing.T) {
	base := config.StacksConfig{Protected: []string{"traefik", "cloudflared", "felhom-controller", "filebrowser"}}

	cfgNoTok := &config.Config{Stacks: base}
	got := EffectiveProtected(cfgNoTok, settings.SMBSettings{})
	if contains(got, "cloudflared") {
		t.Errorf("cloudflared must be dropped when no tunnel token: %v", got)
	}
	for _, must := range []string{"traefik", "felhom-controller", "filebrowser"} {
		if !contains(got, must) {
			t.Errorf("%s must remain protected: %v", must, got)
		}
	}

	cfgTok := &config.Config{Stacks: base}
	cfgTok.Infrastructure.CFTunnelToken = "tok"
	if !contains(EffectiveProtected(cfgTok, settings.SMBSettings{}), "cloudflared") {
		t.Error("cloudflared must remain protected when a tunnel token is configured")
	}
}

// R-7b Scenario E, BOTH directions. Sharing is a customer-toggled feature, so the samba container can
// never be in the golden controller.yaml — the effective set must add it dynamically when sharing is
// ON (so a dead sharing service raises the same protected-container issue as a dead traefik) and must
// leave it out when sharing is OFF (so a box that never enabled it never reports a missing container).
// Red-proof: delete the `if smb.Enabled` append and the enabled case fails.
func TestEffectiveProtectedTracksSharingToggle(t *testing.T) {
	cfg := &config.Config{Stacks: config.StacksConfig{Protected: []string{"traefik", "felhom-controller"}}}

	on := EffectiveProtected(cfg, settings.SMBSettings{Enabled: true})
	if !contains(on, infra.SambaContainerName) {
		t.Errorf("sharing ON: %q must be watched, got %v", infra.SambaContainerName, on)
	}
	off := EffectiveProtected(cfg, settings.SMBSettings{Enabled: false})
	if contains(off, infra.SambaContainerName) {
		t.Errorf("sharing OFF: %q must NOT be watched, got %v", infra.SambaContainerName, off)
	}
	// The base set is untouched in both directions.
	for _, set := range [][]string{on, off} {
		for _, must := range []string{"traefik", "felhom-controller"} {
			if !contains(set, must) {
				t.Errorf("%s must remain protected: %v", must, set)
			}
		}
	}
}