/**
 * The declared coverage and the aspect that does the covering must agree.
 *
 * `lxc-dns-at-birth` splits ownership: terraform owns birth DNS, the
 * base-module aspect owns ongoing DNS. Terraform injects
 * `lifecycle { ignore_changes = [nameserver] }`, so it can never correct the
 * birth value — a zone the aspect does not cover has NO owner for ongoing DNS
 * and its birth list is permanent. That is why the nameserver composition only
 * strips the public resolvers for a zone the deployed provider's aspect covers
 * (design D5d).
 *
 * Core reads that coverage from the provider's CAPABILITY DATA rather than
 * looking up the provider's manifest, because core naming a capability to find
 * its provider is what the module-business gate exists to stop. The cost of
 * that choice is two lists in one manifest instead of one, and drift between
 * them is not cosmetic: a zone listed as covered but absent from the aspect
 * loses its public resolvers with nothing owning what replaces them.
 *
 * So this test is the thing that makes the choice safe. It is the reason the
 * duplication is acceptable.
 */

import { describe, expect, test } from 'bun:test';
import { existsSync, readFileSync, readdirSync } from 'node:fs';
import { join, resolve } from 'node:path';
import { parse } from 'yaml';

function repoRoot(): string {
  let dir = import.meta.dir;
  for (let i = 0; i < 8; i++) {
    if (existsSync(join(dir, 'modules')) && existsSync(join(dir, 'apps'))) return dir;
    dir = resolve(dir, '..');
  }
  throw new Error('could not locate repo root');
}

interface ProviderManifest {
  provides?: {
    capabilities?: { name: string; data?: { aspect?: { covered_zones?: string[] } } }[];
  };
  base_module_aspect?: { applicable_zones?: string[] };
}

/** Every module declaring a `dns_internal` capability, with its manifest. */
function dnsInternalProviders(): { id: string; manifest: ProviderManifest }[] {
  const modulesDir = join(repoRoot(), 'modules');
  const found: { id: string; manifest: ProviderManifest }[] = [];
  for (const id of readdirSync(modulesDir)) {
    const path = join(modulesDir, id, 'manifest.yml');
    if (!existsSync(path)) continue;
    let manifest: ProviderManifest;
    try {
      manifest = parse(readFileSync(path, 'utf-8')) as ProviderManifest;
    } catch {
      continue;
    }
    if (manifest.provides?.capabilities?.some((c) => c.name === 'dns_internal')) {
      found.push({ id, manifest });
    }
  }
  return found;
}

describe('dns_internal providers declare the coverage their aspect actually has', () => {
  const providers = dnsInternalProviders();

  test('the scan found the providers (sanity — it actually ran)', () => {
    // knot-unbound-internal and technitium. A scan that silently found nothing
    // would make every assertion below vacuously true.
    expect(providers.map((p) => p.id).sort()).toEqual(['knot-unbound-internal', 'technitium']);
  });

  test.each(dnsInternalProviders().map((p) => [p.id, p] as const))(
    '%s: declared covered_zones equals base_module_aspect.applicable_zones',
    (_id, provider) => {
      const capability = provider.manifest.provides?.capabilities?.find(
        (c) => c.name === 'dns_internal',
      );
      const declared = capability?.data?.aspect?.covered_zones;
      const applicable = provider.manifest.base_module_aspect?.applicable_zones;

      expect(declared, 'dns_internal.data.aspect.covered_zones is missing').toBeDefined();
      expect(applicable, 'base_module_aspect.applicable_zones is missing').toBeDefined();
      expect([...(declared ?? [])].sort()).toEqual([...(applicable ?? [])].sort());
    },
  );

  test('no provider claims to cover `external`', () => {
    // An `external` system is a cloud VPS outside the perimeter with no route
    // to a dmz-resident resolver. Its public resolvers are the only working
    // configuration, not a fallback that might mask a split-horizon error, so
    // claiming coverage there would strip the only addresses it can reach.
    for (const provider of providers) {
      const declared =
        provider.manifest.provides?.capabilities?.find((c) => c.name === 'dns_internal')?.data
          ?.aspect?.covered_zones ?? [];
      expect(declared, `${provider.id} claims to cover external`).not.toContain('external');
    }
  });
});