/**
 * Control-plane network derivation.
 *
 * `trustedSubnets` is what lets celilo reach every segmented tier through a
 * default-DROP FORWARD chain — it is the control plane. It used to be hardcoded
 * to `network.internal.subnet`, which silently assumed the management server
 * lives on the internal LAN. When it doesn't, celilo's own control plane is
 * trusted by nothing and its network is absent from the resolver's split-horizon
 * views (internal names then resolve publicly and can't be hairpinned).
 *
 * These tests pin the derivation: the trusted subnet follows wherever
 * `celilo-mgmt` is actually deployed, and an install that predates
 * celilo-mgmt-as-a-module keeps exactly today's behaviour.
 */

import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
import type { DbClient } from '../db/client';
import { moduleSystems, modules, systemConfig } from '../db/schema';
import { cleanupTestDatabase, setupTestDatabase } from '../test-utils/database';
import { loadControlPlaneSubnet } from './capability-loader';

const INTERNAL = '192.168.0.0/24';
const DMZ = '10.0.10.0/24';
const SECURE_MGMT = '10.0.120.0/24';

describe('control-plane network derivation', () => {
  let db: DbClient;

  function setSubnet(zone: string, cidr: string) {
    db.insert(systemConfig)
      .values({ key: `network.${zone}.subnet`, value: cidr })
      .run();
  }

  function deployCeliloMgmt(zone: string, ip: string) {
    db.insert(modules)
      .values({
        id: 'celilo-mgmt',
        name: 'celilo-mgmt',
        version: '1.0.0',
        manifestData: {},
        sourcePath: '/tmp/celilo-mgmt',
      })
      .run();
    db.insert(moduleSystems)
      .values({
        moduleId: 'celilo-mgmt',
        name: 'main',
        hostname: 'celilo-mgr',
        ipv4Address: ip,
        // biome-ignore lint/suspicious/noExplicitAny: zone is a NetworkZone literal
        zone: zone as any,
        infraType: 'machine',
      })
      .run();
  }

  beforeEach(async () => {
    db = await setupTestDatabase();
  });

  afterEach(async () => {
    await cleanupTestDatabase(db);
  });

  test('celilo-mgmt on the internal network → the internal subnet', () => {
    setSubnet('internal', INTERNAL);
    setSubnet('dmz', DMZ);
    deployCeliloMgmt('internal', '192.168.0.10');

    expect(loadControlPlaneSubnet(db)).toBe(INTERNAL);
  });

  test('celilo-mgmt on secure-mgmt → the secure-mgmt subnet, NOT internal', () => {
    setSubnet('internal', INTERNAL);
    setSubnet('secure-mgmt', SECURE_MGMT);
    deployCeliloMgmt('secure-mgmt', '10.0.120.10');

    // The production case: hardcoding internal here is exactly the bug.
    expect(loadControlPlaneSubnet(db)).toBe(SECURE_MGMT);
  });

  test('celilo-mgmt deployed but its zone has no configured subnet → undefined', () => {
    setSubnet('internal', INTERNAL);
    deployCeliloMgmt('secure-mgmt', '10.0.120.10'); // no network.secure-mgmt.subnet

    expect(loadControlPlaneSubnet(db)).toBeUndefined();
  });

  test('celilo-mgmt not deployed as a module → undefined (caller falls back)', () => {
    setSubnet('internal', INTERNAL);

    expect(loadControlPlaneSubnet(db)).toBeUndefined();
  });

  test('nothing configured at all → undefined, not a throw', () => {
    expect(loadControlPlaneSubnet(db)).toBeUndefined();
  });
});