package persistence

import (
	"os"
	"path/filepath"
	"testing"
)

func TestTxnMoveRejectsSamePath(t *testing.T) {
	dir := t.TempDir()
	txn := NewTransaction(filepath.Join(dir, ".journal"))
	p := filepath.Join(dir, "a.yaml")
	if err := txn.Move(p, p); err == nil {
		t.Fatal("expected Move(path, path) to be rejected")
	}
}

// A path that already received a Replace as a move destination carries an
// after-image in its move-target record; a later Move would silently drop it.
func TestTxnMoveRejectsReplacedMoveDestination(t *testing.T) {
	dir := t.TempDir()
	a := filepath.Join(dir, "a.yaml")
	b := filepath.Join(dir, "b.yaml")
	writeTestFile(t, a, "A")
	writeTestFile(t, b, "B")
	txn := NewTransaction(filepath.Join(dir, ".journal"))
	if err := txn.Move(a, b); err != nil {
		t.Fatal(err)
	}
	if err := txn.Replace(b, []byte("X"), 0644); err != nil {
		t.Fatal(err)
	}
	if err := txn.Move(b, filepath.Join(dir, "c.yaml")); err == nil {
		t.Fatal("expected Move over a replaced move destination to be rejected")
	}
}

// A journal on disk is untrusted input: recovery must not replay a before-image
// at a path outside the journal's data root.
func TestRecoverRejectsEscapingOpPath(t *testing.T) {
	dir := t.TempDir()
	outside := t.TempDir()
	journalDir := filepath.Join(dir, ".journal")
	if err := os.MkdirAll(journalDir, 0700); err != nil {
		t.Fatal(err)
	}
	escape := filepath.Join(outside, "secret.yaml")
	body := `{"version":1,"ops":[{"path":"` + escape + `","kind":"delete","old_exists":false}]}`
	evil := filepath.Join(journalDir, "txn-evil.json")
	if err := os.WriteFile(evil, []byte(body), 0600); err != nil {
		t.Fatal(err)
	}
	if err := Recover(journalDir); err == nil {
		t.Fatal("expected Recover to reject an escaping op path")
	}
	// Fail loud and keep the journal rather than silently touching the path.
	if _, err := os.Stat(evil); err != nil {
		t.Fatalf("journal should be retained on rejection: %v", err)
	}
	if _, err := os.Stat(escape); !os.IsNotExist(err) {
		t.Fatalf("escaping path must not be touched: %v", err)
	}
}

func TestRecoverRejectsEscapingMoveTarget(t *testing.T) {
	dir := t.TempDir()
	outside := t.TempDir()
	journalDir := filepath.Join(dir, ".journal")
	if err := os.MkdirAll(journalDir, 0700); err != nil {
		t.Fatal(err)
	}
	body := `{"version":1,"ops":[{"path":"` + filepath.Join(dir, "a.yaml") + `","kind":"move","move_to":"` + filepath.Join(outside, "b.yaml") + `"}]}`
	if err := os.WriteFile(filepath.Join(journalDir, "txn-evil.json"), []byte(body), 0600); err != nil {
		t.Fatal(err)
	}
	if err := Recover(journalDir); err == nil {
		t.Fatal("expected Recover to reject an escaping move target")
	}
}