package cli

import (
	"context"
	"encoding/json"
	"log/slog"
	"net/http/httptest"
	"os"
	"path/filepath"
	"testing"

	"gitea.mynodes.xyz/ilker/llmgw/internal/config"
	"gitea.mynodes.xyz/ilker/llmgw/internal/mirror"
	"gitea.mynodes.xyz/ilker/llmgw/internal/store"
	"gitea.mynodes.xyz/ilker/llmgw/internal/tlsconf"
)

func TestTheLeaderTellsTheMirrorAndTheStoreWhatTheFirewallSettingsSay(t *testing.T) {
	ctx := context.Background()
	st, err := store.OpenSQLite(ctx, filepath.Join(t.TempDir(), "s.db"))
	if err != nil {
		t.Fatal(err)
	}
	defer st.Close()
	if err := st.PutControlPlane(ctx, store.ControlPlane{URL: "https://10.0.0.150:7443", Name: "ctl02"}); err != nil {
		t.Fatal(err)
	}
	root := t.TempDir()
	srv := httptest.NewServer(mirror.NewAPI(mirror.NewManager(root, slog.New(slog.DiscardHandler)), "http://m:8081").Handler())
	defer srv.Close()
	mc, _ := mirror.NewClient(srv.URL, tlsconf.Config{}, 0)

	cfg := config.Server{Firewall: config.FirewallSettings{Enabled: false}, FirewallNetworks: []string{"192.168.5.0/24"}}
	leader := false
	p := newFirewallPublisher(func() config.Server { return cfg }, st,
		func() []string { return []string{"10.0.0.147", "", "10.0.0.147", "node-by-name"} },
		func() bool { return leader }, slog.New(slog.DiscardHandler))
	p.setMirror(mc)

	p.once(ctx)
	if _, err := st.ClusterState(ctx, firewallStateKey); err == nil {
		t.Error("a standby told the store")
	}
	leader = true
	p.once(ctx)
	var got mirror.FirewallState
	v, err := st.ClusterState(ctx, firewallStateKey)
	if err != nil || json.Unmarshal([]byte(v), &got) != nil {
		t.Fatalf("the store holds %q %v", v, err)
	}
	if got.Enabled || got.Networks[0] != "192.168.5.0/24" || len(got.Toward) != 2 ||
		got.Toward[0] != "10.0.0.147" || got.Toward[1] != "10.0.0.150" {
		t.Errorf("state %+v", got)
	}
	b, err := os.ReadFile(filepath.Join(root, mirror.FirewallFile))
	if err != nil || string(b) != v {
		t.Errorf("the mirror holds %s, the store %s", b, v)
	}
}