package store

import "testing"

// R-246 (operator ruling 2026-10-12, S30, `09` §3 decision 225): `stale_at` is RETIRED.
//
// The column changed behaviour — a stamped value withheld `restic_pw_sha256` from the report ACK, so
// the box could never auto-confirm and every off-site run was refused — while nothing in the product
// set it (its one caller was removed in v0.95.0) and nothing showed it. On demo-hp a leftover stamp
// silently did exactly that from 2026-08-04 until it was cleared by hand on 2026-08-08.
//
// The test asserts the CONSEQUENCE: a row that still carries an old stamp (any database written
// before this release may) serves its hash like any other row.
//
// RED-PROOF: with the pre-retirement reader (stale_at → Stale=true, hash emptied) this fails with
// „a stamped stale_at still withholds the hash".
func TestStaleAtNoLongerWithholdsTheHash(t *testing.T) {
	s := newTestStore(t)
	const cust = "cust-r246"
	if err := s.UpsertHost(&Host{HostID: cust + "-01", CustomerID: cust, APIKey: "k"}); err != nil {
		t.Fatal(err)
	}
	if _, _, err := s.SaveHostEscrow(cust+"-01", []byte("blob"), "SHA256:fp", "zero_knowledge", "2026-07-16T00:00:00Z", "HASH"); err != nil {
		t.Fatal(err)
	}
	// An old database's leftover stamp. The column stays in the schema (SQLite keeps it); nothing
	// in the product writes it any more.
	if _, err := s.db.Exec(`UPDATE host_escrow SET stale_at = datetime('now') WHERE host_id = ?`, cust+"-01"); err != nil {
		t.Fatal(err)
	}
	es, err := s.GetEscrowStatusForCustomer(cust)
	if err != nil || es == nil {
		t.Fatalf("escrow status: %v %+v", err, es)
	}
	if es.ResticPwSHA256 != "HASH" {
		t.Fatalf("a stamped stale_at still withholds the hash (got %q) — R-246: the flag is retired", es.ResticPwSHA256)
	}
}