package offsite

import (
	"context"
	"errors"
	"sync"
	"testing"

	"gitea.dooplex.hu/admin/felhom-hub/internal/hetznerapi"
)

// gatedAPI blocks the FIRST ListSubaccounts after it has listed, so a second Save can arrive in the
// window between "no sub-account yet" and "create" — the race R-31 names.
type gatedAPI struct {
	*hetznerapi.Fake
	once    sync.Once
	listed  chan struct{}
	release chan struct{}
}

func (g *gatedAPI) ListSubaccounts(ctx context.Context, boxID int64, sel string) ([]hetznerapi.Subaccount, error) {
	out, err := g.Fake.ListSubaccounts(ctx, boxID, sel)
	first := false
	g.once.Do(func() { first = true })
	if first {
		close(g.listed)
		<-g.release
	}
	return out, err
}

// R-31 — a second Save while the first provisioning still runs must not create a second sub-account
// (for a dedicated box: a second bill). It is refused at once with ErrProvisionInProgress.
//
// COMPANION RED-PROOF (observed): remove the begin()/release() claim from ProvisionOffsite → this fails
// with "the second Save must be refused while the first runs; got err=<nil>". Restored.
func TestProvision_R31_ConcurrentSaveRefused(t *testing.T) {
	p, fake, _ := newTestProvisioner(t)
	g := &gatedAPI{Fake: fake, listed: make(chan struct{}), release: make(chan struct{})}
	p.API = g

	firstErr := make(chan error, 1)
	go func() {
		_, err := p.ProvisionOffsite(context.Background(), "cust-r31", Input{Enabled: true, Type: "shared", QuotaGB: 10})
		firstErr <- err
	}()
	<-g.listed // the first Save has seen "no sub-account" and is about to create one

	_, err := p.ProvisionOffsite(context.Background(), "cust-r31", Input{Enabled: true, Type: "shared", QuotaGB: 10})
	close(g.release)
	if e := <-firstErr; e != nil {
		t.Fatalf("the first Save must succeed: %v", e)
	}
	if !errors.Is(err, ErrProvisionInProgress) {
		t.Fatalf("the second Save must be refused while the first runs; got err=%v", err)
	}
	if fake.CreatedSubaccounts != 1 {
		t.Fatalf("exactly one sub-account must exist, got %d", fake.CreatedSubaccounts)
	}

	// After the first finished, a Save is idempotent again (no refusal, no second create).
	if _, err := p.ProvisionOffsite(context.Background(), "cust-r31", Input{Enabled: true, Type: "shared", QuotaGB: 10}); err != nil {
		t.Fatalf("a Save after the first finished must pass: %v", err)
	}
	if fake.CreatedSubaccounts != 1 {
		t.Fatalf("still exactly one sub-account, got %d", fake.CreatedSubaccounts)
	}
}

// Another customer is never blocked by one customer's running provisioning.
func TestProvision_R31_OtherCustomerNotBlocked(t *testing.T) {
	p, _, _ := newTestProvisioner(t)
	release, err := p.begin("cust-x")
	if err != nil {
		t.Fatal(err)
	}
	defer release()
	if _, err := p.ProvisionOffsite(context.Background(), "cust-y", Input{Enabled: true, Type: "shared", QuotaGB: 10}); err != nil {
		t.Fatalf("another customer must not be blocked: %v", err)
	}
}