package main

import (
	"os"
	"path/filepath"
	"strings"
	"testing"
)

func moduleFixture(t *testing.T) Config {
	root := t.TempDir()
	os.MkdirAll(filepath.Join(root, "comfyui", "ComfyUI"), 0755)
	cfg := defaultConfig()
	cfg.ModulesDir = root
	cfg.AgentUID = 1000
	return cfg
}

func TestModuleRunIsFixedAndLockedDown(t *testing.T) {
	cfg := moduleFixture(t)
	args, err := buildModuleRun(cfg, moduleCatalog, "comfyui")
	if err != nil {
		t.Fatal(err)
	}
	joined := strings.Join(args, " ")
	e, _ := moduleCatalog.Engine("comfyui")
	for _, want := range []string{"--name wxch-mod-comfyui", "--gpus all", "--security-opt no-new-privileges", "--cap-drop ALL", "--ulimit nofile=1048576:1048576", "--user 1000:1000",
		"-p 127.0.0.1:8300:8188", ":/work", "-w /work/ComfyUI", e.ImageRef(), "--disable-api-nodes"} {
		if !strings.Contains(joined, want) {
			t.Errorf("missing %q in: %s", want, joined)
		}
	}
	if !strings.Contains(joined, "@sha256:") {
		t.Error("the image must be pinned by digest")
	}
	for _, bad := range []string{"--privileged", "--network host", "--net=host", "--ipc=host", "--pid", "docker.sock"} {
		if strings.Contains(joined, bad) {
			t.Errorf("must not contain %q", bad)
		}
	}
}

func TestModuleRunRefusals(t *testing.T) {
	cfg := moduleFixture(t)
	if _, err := buildModuleRun(cfg, moduleCatalog, "../etc"); err == nil {
		t.Error("an engine that is not in the catalog was accepted")
	}
	if _, err := buildModuleRun(cfg, moduleCatalog, "whisper"); err == nil {
		t.Error("an engine without a folder was started")
	}
	// a folder that is a link out of the modules folder is refused unless root listed the target
	outside := t.TempDir()
	if err := os.Symlink(outside, filepath.Join(cfg.ModulesDir, "whisper")); err != nil {
		t.Skip("symlinks not available here")
	}
	if _, err := buildModuleRun(cfg, moduleCatalog, "whisper"); err == nil {
		t.Error("a link to an unlisted place was followed")
	}
	cfg.ExtraRoots = []string{outside}
	args, err := buildModuleRun(cfg, moduleCatalog, "whisper")
	if err != nil {
		t.Fatalf("a link into a listed extra root must work: %v", err)
	}
	real, _ := filepath.EvalSymlinks(outside)
	if !strings.Contains(strings.Join(args, " "), real+":"+real+":ro") {
		t.Error("the extra root must be mounted read-only at the same path")
	}
}

func TestModuleOpsNeedAKnownEngine(t *testing.T) {
	cfg := moduleFixture(t)
	for _, op := range []string{"mod_start", "mod_stop", "mod_pull", "mod_logs", "mod_rmi"} {
		if r := handle(cfg, Request{Op: op, Engine: "nope; rm -rf /"}); r.OK {
			t.Errorf("%s accepted an unknown engine", op)
		}
	}
}

func TestHostPortsAvoidVLLMRange(t *testing.T) {
	cfg := defaultConfig()
	for _, e := range moduleCatalog.Engines {
		p := moduleCatalog.HostPort(e.ID)
		if p >= cfg.PortMin && p <= cfg.PortMax {
			t.Errorf("%s publishes on %d, inside the vLLM range", e.ID, p)
		}
	}
}