package api

import (
	"encoding/base64"
	"encoding/json"
	"net/http"
	"testing"

	"gitea.dooplex.hu/admin/felhom-hub/internal/store"
)

// R-1254: an escrow upload with a malformed identity blob is refused BEFORE anything is stored — until this fix the new
// key and its hash were committed first and the bad identity answered 400 after, leaving the new hash beside the old
// identity package. Through the real endpoint. RED-PROOF (2026-10-24): with the identity decoded after the key save
// (the old order), this fails on „the key was stored before the bad identity was refused".
func TestR1254_ABadIdentityBlobStoresNothing(t *testing.T) {
	h, st, _ := newTestHandler(t)
	st.UpsertHost(&store.Host{HostID: "h1", CustomerID: "c1", APIKey: "HKEY"})
	if rr := do(h, http.MethodPut, "/hosts/h1/escrow", "HKEY", escrowBodyWithHash([]byte("k1"), "SHA_GEN1", "age-gen1")); rr.Code != http.StatusOK {
		t.Fatalf("first PUT = %d (%s)", rr.Code, rr.Body.String())
	}
	m := map[string]string{
		"blob_b64": base64.StdEncoding.EncodeToString([]byte("k2")), "key_fingerprint": "ab:cd:ef",
		"posture": "zero_knowledge", "created_at": "2026-10-24T21:00:00Z", "restic_pw_sha256": "SHA_GEN2",
		"identity_blob_b64": "%%% not base64 %%%",
	}
	body, _ := json.Marshal(m)
	if rr := do(h, http.MethodPut, "/hosts/h1/escrow", "HKEY", string(body)); rr.Code != http.StatusBadRequest {
		t.Fatalf("a bad identity blob must be a 400, got %d", rr.Code)
	}
	e, _ := st.GetHostEscrow("h1")
	if e == nil || string(e.Blob) != "k1" || e.ResticPwSHA256 != "SHA_GEN1" {
		t.Fatalf("the key was stored before the bad identity was refused: %+v", e)
	}
	if b, _ := st.GetHostDRBundle("h1"); b == nil || string(b.IdentityBlob) != "age-gen1" {
		t.Fatalf("the old identity must stay: %+v", b)
	}
}