// @vitest-environment node
import {expect,it} from 'vitest'
import {mkdtemp,readdir,readFile,rm} from 'node:fs/promises'
import {tmpdir} from 'node:os'
import {join} from 'node:path'
import {randomUUID} from 'node:crypto'
import {ContainerComputerProvider,type ComputerSpecification} from '../../src/runner/computers/container'
import {ComputerMaintenance} from '../../src/runner/computers/maintenance'

it.skipIf(!process.env.YAOYAO_COMPUTER_IMAGE)('migrates a legacy home and keeps real browser and encrypted application authorization through rebuild and restore',async()=>{
  const home=await mkdtemp(join(tmpdir(),'yaoyao-auth-live-'))
  const provider=new ContainerComputerProvider('docker',randomUUID(),home)
  const spec:ComputerSpecification={id:randomUUID(),ownerKey:randomUUID(),imageId:process.env.YAOYAO_COMPUTER_IMAGE!}
  const script=await readFile(new URL('../fixtures/computer_auth.mjs',import.meta.url),'utf8')
  const execute=(argv:string[],user:'cua'|'root'='cua')=>provider.execute(spec,argv,{authorize:()=>{},user,timeout:60000}).catch(error=>{throw new Error(`${argv[0]} ${argv.at(-1)}: ${error.stderr??error.message}`)})
  const maintenance=new ComputerMaintenance({status:()=>[{environmentId:spec.id,status:'free'}]} as any,provider,home)
  let derivedImage:string|undefined
  try{
    // Exercise the real upgrade path from the old workspace-only container.
    const workspace=await (provider as any).workspace(provider.validateSpecification(spec))
    const created=await provider.run('docker',(provider as any).args(provider.validateSpecification(spec),workspace))
    const legacyId=created.stdout.trim();await provider.run('docker',['start',legacyId])
    expect(JSON.parse((await execute(['node','--input-type=module','-e',script,'login'])).stdout)).toEqual({browser:true,encryptedApplicationToken:true})
    await execute(['sh','-c','mkdir -p /root/.config; printf root-fixture > /root/.config/authorization'],'root')
    const identity=(await execute(['cat','/var/lib/dbus/machine-id'])).stdout
    await provider.remove(spec)
    const migrated=await provider.ensure(spec,()=>{})
    expect(migrated.containerId).not.toBe(legacyId)
    expect((await execute(['cat','/etc/machine-id'])).stdout).toBe(identity)
    expect((await execute(['cat','/root/.config/authorization'],'root')).stdout).toBe('root-fixture')
    expect(JSON.parse((await execute(['node','--input-type=module','-e',script,'check'])).stdout).browser).toBe(true)
    await maintenance.rebuild(spec);await provider.ensure(spec,()=>{})
    expect(JSON.parse((await execute(['node','--input-type=module','-e',script,'check'])).stdout).encryptedApplicationToken).toBe(true)
    await provider.stop(spec)
    derivedImage=(await provider.run('docker',['commit',(await provider.inspect(spec))!.containerId],{timeout:60000})).stdout.trim()
    await provider.remove(spec);spec.imageId=derivedImage
    await provider.ensure(spec,()=>{})
    expect(JSON.parse((await execute(['node','--input-type=module','-e',script,'check'])).stdout).browser).toBe(true)
    expect(await readdir(join(home,'computer-backups',spec.id))).toHaveLength(1)
    await maintenance.backup(spec,join(home,'snapshot'))
    await provider.ensure(spec,()=>{})
    await execute(['sh','-c','rm -rf ~/.config/yaoyao-auth-fixture ~/.local/share/keyrings/yaoyao-auth-fixture ~/.config/yaoyao-auth-browser'])
    await maintenance.restore(spec,join(home,'snapshot'))
    await provider.ensure(spec,()=>{})
    expect(JSON.parse((await execute(['node','--input-type=module','-e',script,'check'])).stdout).browser).toBe(true)
    expect((await execute(['cat','/etc/machine-id'])).stdout).toBe(identity)
  }finally{await provider.remove(spec);if(derivedImage)await provider.run('docker',['image','rm',derivedImage]);await rm(home,{recursive:true,force:true})}
},180000)