package runtime

import (
	"bytes"
	"context"
	"encoding/base64"
	"encoding/json"
	"os"
	"os/exec"
	"path/filepath"
	"runtime"
	"strings"
	"testing"

	"browser.local/run/protocol"
)

func TestWorkerDistributionBuildCompilesAndUploadsRawRunExecutable(t *testing.T) {
	client := newFakeWorkerClient()
	cfg := workerTestConfig(t)
	cfg.BuildSourceRoot = ".."
	worker, err := NewWorker(cfg, client)
	if err != nil {
		t.Fatalf("new worker: %v", err)
	}
	worker.state.SessionToken = "session-token"

	output := "run"
	if runtime.GOOS == "windows" {
		output = "run.exe"
	}
	assignment := protocol.RunJobAssignment{
		JobID:            "job-distribution-build-test",
		ServerInstanceID: "server-build-test",
		RunEndpointID:    "run-test",
		Capability:       protocol.RunCapabilityDistributionBuild,
		TargetKey:        "distribution/run",
		InputRef:         "input://distribution-build/run-test",
		IdempotencyKey:   "distribution-build:test",
		State:            "running",
		LeaseToken:       "lease-test",
		Attempt:          1,
	}
	client.claimJob = assignment
	client.buildInput = protocol.DistributionBuildInputResponse{
		JobID:            assignment.JobID,
		ComponentKind:    "run",
		ServerInstanceID: assignment.ServerInstanceID,
		PluginID:         "game.scum",
		RunEndpointID:    assignment.RunEndpointID,
		TargetOS:         runtime.GOOS,
		TargetArch:       runtime.GOARCH,
		TargetRelease:    "run-release-test",
		PlatformURL:      "https://scum.npc0.com",
		PackageFormat:    "raw-executable",
		ArtifactID:       "artifact-built-run",
		OutputFilename:   output,
		SecretRef:        "secret://runtime-keys/server-build-test/run/current",
		KeyGeneration:    1,
		AuthKey:          "test-component-key",
	}

	result := worker.executeDistributionBuild(context.Background(), assignment)
	if result.State != lifecycleResultStateSucceeded || result.ResultRef != "artifact://artifact-built-run" {
		t.Fatalf("expected successful real build, got %+v", result)
	}
	if len(client.artifactPayload) < 1024 {
		t.Fatalf("expected compiled executable payload, got %d bytes", len(client.artifactPayload))
	}
	extracted := t.TempDir()
	binaryPath := filepath.Join(extracted, output)
	if err := os.WriteFile(binaryPath, client.artifactPayload, 0o700); err != nil {
		t.Fatalf("write uploaded run executable: %v", err)
	}
	command := exec.Command(binaryPath)
	command.Env = append(os.Environ(), "RUN_MODE=smoke")
	smokeOutput, err := command.CombinedOutput()
	if err != nil {
		t.Fatalf("execute generated run package smoke mode: %v output=%s", err, smokeOutput)
	}
	var summary map[string]any
	if err := json.Unmarshal(smokeOutput, &summary); err != nil {
		t.Fatalf("decode generated package smoke output: %v body=%s", err, smokeOutput)
	}
	if summary["status"] != "ok" || summary["mode"] != "smoke" {
		t.Fatalf("expected generated package to run smoke mode, got %+v", summary)
	}
	if summary["platformUrl"] != "https://scum.npc0.com" {
		t.Fatalf("expected generated executable to use compiled platform URL, got %+v", summary)
	}
	joinedProgress := make([]string, 0, len(client.progressRequests))
	for _, request := range client.progressRequests {
		joinedProgress = append(joinedProgress, request.Progress.Message)
	}
	progress := strings.Join(joinedProgress, "\n")
	for _, stage := range []string{"git_sync:", "env_check:", "deps_download:", "build_compile:", "package_finalize:"} {
		if !strings.Contains(progress, stage) {
			t.Fatalf("expected real progress stage %q in %q", stage, progress)
		}
	}
}

func TestWorkerDistributionBuildCrossCompilesWindowsAMD64Run(t *testing.T) {
	client := newFakeWorkerClient()
	cfg := workerTestConfig(t)
	cfg.BuildSourceRoot = ".."
	worker, err := NewWorker(cfg, client)
	if err != nil {
		t.Fatalf("new worker: %v", err)
	}
	worker.state.SessionToken = "session-token"
	assignment := protocol.RunJobAssignment{JobID: "job-distribution-build-windows", ServerInstanceID: "server-build-windows", RunEndpointID: "run-builder", Capability: protocol.RunCapabilityDistributionBuild, TargetKey: "distribution/run", InputRef: "input://distribution-build/windows", IdempotencyKey: "distribution-build:windows", State: "running", LeaseToken: "lease-windows", Attempt: 1}
	client.claimJob = assignment
	client.buildInput = protocol.DistributionBuildInputResponse{JobID: assignment.JobID, ComponentKind: "run", ServerInstanceID: assignment.ServerInstanceID, PluginID: "game.scum", RunEndpointID: "server-run-server-build-windows", TargetOS: "windows", TargetArch: "amd64", TargetRelease: "run-release-windows", PlatformURL: "https://scum.npc0.com", PackageFormat: "raw-executable", ArtifactID: "artifact-built-windows-run", OutputFilename: "run.exe", SecretRef: "secret://runtime-keys/server-build-windows/run/current", KeyGeneration: 1, AuthKey: "test-component-key"}

	result := worker.executeDistributionBuild(context.Background(), assignment)
	if result.State != lifecycleResultStateSucceeded || result.ResultRef != "artifact://artifact-built-windows-run" {
		t.Fatalf("expected successful Windows build, got %+v", result)
	}
	if len(client.artifactPayload) < 1024 || !bytes.HasPrefix(client.artifactPayload, []byte("MZ")) {
		t.Fatalf("expected Windows PE executable payload, got %d bytes", len(client.artifactPayload))
	}
}

func TestDistributionBuildIsolationUsesPluginJobWorkspaceAndDistinctPackageState(t *testing.T) {
	workspaceRoot := t.TempDir()
	firstAssignment := protocol.RunJobAssignment{JobID: "job-distribution-build-scum-alpha", ServerInstanceID: "scum-alpha", RunEndpointID: "run-test"}
	secondAssignment := protocol.RunJobAssignment{JobID: "job-distribution-build-scum-beta", ServerInstanceID: "scum-beta", RunEndpointID: "run-test"}
	firstInput := protocol.DistributionBuildInputResponse{
		JobID:            firstAssignment.JobID,
		ComponentKind:    "run",
		ServerInstanceID: firstAssignment.ServerInstanceID,
		PluginID:         "game.scum",
		RunEndpointID:    firstAssignment.RunEndpointID,
		ProfileKey:       "run-local",
		TargetOS:         "linux",
		TargetArch:       "amd64",
		PlatformURL:      "https://scum.npc0.com",
		PackageFormat:    "raw-executable",
		ArtifactID:       "artifact-run-dist-scum-alpha",
		OutputFilename:   "run",
		SecretRef:        "secret://runtime-keys/scum-alpha/run/current",
		KeyGeneration:    1,
		AuthKey:          "alpha-component-key",
	}
	secondInput := firstInput
	secondInput.JobID = secondAssignment.JobID
	secondInput.ServerInstanceID = secondAssignment.ServerInstanceID
	secondInput.ArtifactID = "artifact-run-dist-scum-beta"
	secondInput.SecretRef = "secret://runtime-keys/scum-beta/run/current"
	secondInput.AuthKey = "beta-component-key"

	firstWorkspace := distributionBuildWorkspace(workspaceRoot, firstInput.PluginID, firstAssignment.JobID)
	secondWorkspace := distributionBuildWorkspace(workspaceRoot, secondInput.PluginID, secondAssignment.JobID)
	if firstWorkspace == secondWorkspace {
		t.Fatalf("expected same-plugin builds to use distinct job workspaces")
	}
	if filepath.Dir(firstWorkspace) != filepath.Dir(secondWorkspace) || filepath.Base(filepath.Dir(firstWorkspace)) != "game-scum" {
		t.Fatalf("expected workspaces under the same plugin queue directory, first=%s second=%s", firstWorkspace, secondWorkspace)
	}
	firstFlags := buildRunLDFlags(firstInput, "https://scum.npc0.com")
	secondFlags := buildRunLDFlags(secondInput, "https://scum.npc0.com")
	if !strings.Contains(firstFlags, "BuildServerInstanceID=scum-alpha") || !strings.Contains(firstFlags, "BuildRegistrationToken=alpha-component-key") {
		t.Fatalf("expected first build flags to carry first server identity, got %q", firstFlags)
	}
	if strings.Contains(firstFlags, "BuildComponentKey=run-local") || !strings.Contains(firstFlags, "BuildComponentKey=") {
		t.Fatalf("expected run component identity to stay separate from lifecycle profile, got %q", firstFlags)
	}
	if !strings.Contains(secondFlags, "BuildServerInstanceID=scum-beta") || !strings.Contains(secondFlags, "BuildRegistrationToken=beta-component-key") {
		t.Fatalf("expected second build flags to carry second server identity, got %q", secondFlags)
	}
	if firstFlags == secondFlags {
		t.Fatalf("expected same-plugin run builds to stay per-server")
	}

	client := newFakeWorkerClient()
	worker := &Worker{cfg: workerTestConfig(t), client: client}
	worker.state.RunEndpointID = "run-test"
	worker.state.SessionToken = "session-token"
	artifactDir := t.TempDir()
	firstArtifactPath := filepath.Join(artifactDir, "alpha.bin")
	secondArtifactPath := filepath.Join(artifactDir, "beta.bin")
	if err := os.WriteFile(firstArtifactPath, []byte("alpha archive"), 0o600); err != nil {
		t.Fatalf("write first artifact: %v", err)
	}
	if err := os.WriteFile(secondArtifactPath, []byte("beta archive"), 0o600); err != nil {
		t.Fatalf("write second artifact: %v", err)
	}
	client.buildInput = firstInput
	if err := worker.uploadDistributionArtifact(context.Background(), firstAssignment, firstInput.ArtifactID, firstArtifactPath); err != nil {
		t.Fatalf("upload first artifact: %v", err)
	}
	client.artifactPayload = nil
	client.buildInput = secondInput
	if err := worker.uploadDistributionArtifact(context.Background(), secondAssignment, secondInput.ArtifactID, secondArtifactPath); err != nil {
		t.Fatalf("upload second artifact: %v", err)
	}
	if len(client.artifactOpenRequests) != 2 {
		t.Fatalf("expected two artifact transfer opens, got %+v", client.artifactOpenRequests)
	}
	if client.artifactOpenRequests[0].ArtifactID != firstInput.ArtifactID || client.artifactOpenRequests[0].OwnerID != firstAssignment.JobID {
		t.Fatalf("first artifact upload used wrong scope: %+v", client.artifactOpenRequests[0])
	}
	if client.artifactOpenRequests[1].ArtifactID != secondInput.ArtifactID || client.artifactOpenRequests[1].OwnerID != secondAssignment.JobID {
		t.Fatalf("second artifact upload used wrong scope: %+v", client.artifactOpenRequests[1])
	}
}

func TestPrepareDistributionSourceCopiesTrustedRunSourceIntoWorkspace(t *testing.T) {
	sourceRoot := t.TempDir()
	if err := os.WriteFile(filepath.Join(sourceRoot, "go.mod"), []byte("module example.test/trusted\n\ngo 1.24\n"), 0o600); err != nil {
		t.Fatalf("write go.mod: %v", err)
	}
	if err := os.WriteFile(filepath.Join(sourceRoot, "main.go"), []byte("package main\nfunc main() {}\n"), 0o600); err != nil {
		t.Fatalf("write main.go: %v", err)
	}
	workspace := t.TempDir()
	worker := &Worker{cfg: workerTestConfig(t)}
	worker.cfg.BuildSourceRoot = sourceRoot
	seed := base64.StdEncoding.EncodeToString([]byte(`[{"path":"actions/install.json","content":"{}"}]`))

	prepared, err := worker.prepareDistributionSource(context.Background(), workspace, protocol.DistributionBuildInputResponse{ComponentKind: "run", WorkspaceSeed: seed})
	if err != nil {
		t.Fatalf("prepare trusted run source: %v", err)
	}
	if prepared != filepath.Join(workspace, "source") {
		t.Fatalf("expected isolated source under workspace, got %s", prepared)
	}
	if _, err := os.Stat(filepath.Join(prepared, "main.go")); err != nil {
		t.Fatalf("expected copied source file: %v", err)
	}
	seedConfig, err := os.ReadFile(filepath.Join(prepared, "config", "workspace_seed_generated.go"))
	if err != nil || !strings.Contains(string(seedConfig), seed) {
		t.Fatalf("expected generated workspace seed config, body=%q err=%v", seedConfig, err)
	}
	if err := os.WriteFile(filepath.Join(prepared, "main.go"), []byte("package main\n// isolated mutation\nfunc main() {}\n"), 0o600); err != nil {
		t.Fatalf("mutate isolated copy: %v", err)
	}
	original, err := os.ReadFile(filepath.Join(sourceRoot, "main.go"))
	if err != nil || strings.Contains(string(original), "isolated mutation") {
		t.Fatalf("trusted source was mutated, body=%q err=%v", original, err)
	}
}

func TestValidateDistributionBuildInputRejectsLegacyClientManagerBuilds(t *testing.T) {
	assignment := protocol.RunJobAssignment{JobID: "job-build", ServerInstanceID: "server-build", RunEndpointID: "run-build"}
	input := protocol.DistributionBuildInputResponse{
		JobID: assignment.JobID, ComponentKind: "client-manager", ServerInstanceID: assignment.ServerInstanceID, RunEndpointID: assignment.RunEndpointID,
		PluginID: "game.scum", TargetOS: "linux", TargetArch: "amd64", PackageFormat: "tar.gz", ArtifactID: "artifact-build", OutputFilename: "manager", AuthKey: "key", SourceRevision: "main",
	}
	if err := validateDistributionBuildInput(assignment, input); err == nil || !strings.Contains(err.Error(), "component kind") {
		t.Fatalf("expected legacy component kind to be rejected, got %v", err)
	}
}

func TestValidateDistributionBuildInputAllowsDedicatedRunIdentity(t *testing.T) {
	assignment := protocol.RunJobAssignment{JobID: "job-build", ServerInstanceID: "server-build", RunEndpointID: "run-local-debug"}
	input := protocol.DistributionBuildInputResponse{JobID: assignment.JobID, ComponentKind: "run", ServerInstanceID: assignment.ServerInstanceID, RunEndpointID: "server-run-server-build", PluginID: "game.scum", TargetOS: "windows", TargetArch: "amd64", TargetRelease: "release-1", PlatformURL: "https://scum.npc0.com", PackageFormat: "raw-executable", ArtifactID: "artifact-build", OutputFilename: "run.exe", AuthKey: "key"}
	if err := validateDistributionBuildInput(assignment, input); err != nil {
		t.Fatalf("dedicated Run identity must be accepted for a builder job: %v", err)
	}
	input.WorkspaceSeed = "not-base64"
	if err := validateDistributionBuildInput(assignment, input); err == nil || !strings.Contains(err.Error(), "workspace seed") {
		t.Fatalf("expected invalid run workspace seed rejection, got %v", err)
	}
	input.WorkspaceSeed = ""
	input.ComponentKind = "client-manager"
	if err := validateDistributionBuildInput(assignment, input); err == nil || !strings.Contains(err.Error(), "component kind") {
		t.Fatalf("expected client-manager build to be rejected, got %v", err)
	}
}