import "./install.test-support.js";
import { describe, expect, it } from "vitest";
import { resolveTestNodeExecPath } from "../../test-utils/node-process.js";
import { createInstallPlanFixture, nodeProbeOutput } from "./install.test-helpers.js";

const {
  actionState,
  buildGatewayInstallPlanMock,
  expectFields,
  expectLastEmittedResult,
  installDaemonServiceAndEmitMock,
  readConfigFileSnapshotMock,
  readFirstInstallPlanArg,
  readFirstNodeStartupTlsEnvironmentArg,
  replaceConfigFileMock,
  resolveNodeStartupTlsEnvironmentMock,
  runDaemonInstall,
  runExecMock,
  service,
  setupInstallTests,
} = await import("./install.test-support.js");

describe("runDaemonInstall reinstall", () => {
  setupInstallTests();

  it.each([
    { mode: "local", installedOverride: false, plannedOverride: false },
    { mode: "remote", installedOverride: true, plannedOverride: true },
    { mode: "local", installedOverride: true, plannedOverride: false },
  ])(
    "refreshes only changed service start mode with $mode primary",
    async ({ mode, installedOverride, plannedOverride }) => {
      service.isLoaded.mockResolvedValue(true);
      readConfigFileSnapshotMock.mockResolvedValue({
        valid: true,
        sourceConfig: { gateway: { mode, auth: { mode: "token" } } },
      });
      const command = (override: boolean) =>
        ["openclaw", "gateway", "run"].concat(override ? ["--allow-unconfigured"] : []);
      const environment = { NODE_EXTRA_CA_CERTS: "/etc/ssl/certs/ca-certificates.crt" };
      resolveNodeStartupTlsEnvironmentMock.mockReturnValue(environment);
      service.readCommand.mockResolvedValue({
        programArguments: command(installedOverride),
        environment,
      });
      buildGatewayInstallPlanMock.mockResolvedValue({
        programArguments: command(plannedOverride),
        environment,
        workingDirectory: "/tmp",
      });
      await runDaemonInstall({ json: true });
      expect(actionState.failed).toEqual([]);
      if (installedOverride !== plannedOverride) {
        expect(installDaemonServiceAndEmitMock).toHaveBeenCalledOnce();
      } else {
        expect(installDaemonServiceAndEmitMock).not.toHaveBeenCalled();
        expect(actionState.emitted.at(-1)).toMatchObject({ result: "already-installed" });
      }
    },
  );

  it.each([
    { failure: "probe", message: "openclaw gateway install --force" },
    { failure: "no-replacement", message: "No supported Node runtime is available" },
    { failure: "sealed-definition", message: "SERVICE_DEFINITION_UNKNOWN" },
  ])(
    "refuses runtime repair on $failure without claiming success",
    async ({ failure, message }) => {
      service.isLoaded.mockResolvedValue(true);
      const oldNode = failure === "probe" ? resolveTestNodeExecPath() : "/opt/old/bin/node";
      service.readCommand.mockResolvedValue({
        programArguments: [oldNode, "/opt/openclaw/dist/index.js", "gateway"],
      });
      runExecMock.mockImplementation(async (file: string) => {
        if (failure === "probe") {
          throw new Error("runtime probe timed out");
        }
        return nodeProbeOutput(
          failure === "sealed-definition" && file !== oldNode ? "26.8.1" : "22.23.1",
        );
      });
      if (failure === "sealed-definition") {
        service.readDefinitionMutationCapability.mockRejectedValue(new Error("sealed"));
      }
      await runDaemonInstall({ json: true });
      expect(actionState.failed[0]?.message).toContain(message);
      expect(actionState.emitted).toEqual([]);
      expect(installDaemonServiceAndEmitMock).not.toHaveBeenCalled();
    },
  );

  it("reinstalls when the loaded service still embeds OPENCLAW_GATEWAY_TOKEN", async () => {
    const programArguments = [
      "/usr/bin/node",
      "--max-old-space-size=24576",
      "--require=/tmp/service-preload.js",
      "/usr/local/bin/openclaw",
      "gateway",
    ];
    service.isLoaded.mockResolvedValue(true);
    const managedDefinition = {
      programArguments,
      environment: {
        OPENCLAW_GATEWAY_TOKEN: "stale-service-token",
      },
    };
    const existingCommand = {
      ...managedDefinition,
      environment: { NODE_OPTIONS: "--max-old-space-size=512" },
      managedDefinition,
      managedOverrides: { environment: { keys: ["NODE_OPTIONS"] } },
    };
    service.readCommand.mockResolvedValue(existingCommand as never);

    await runDaemonInstall({ json: true });

    expect(installDaemonServiceAndEmitMock).toHaveBeenCalledTimes(1);
    for (const [options] of buildGatewayInstallPlanMock.mock.calls) {
      expect(options).toEqual(expect.objectContaining({ existingCommand }));
    }
    expect(actionState.warnings).toContain(
      "Gateway service OPENCLAW_GATEWAY_TOKEN differs from the current install plan; refreshing the install.",
    );
  });

  it("returns already-installed when the embedded gateway token matches the install plan", async () => {
    service.isLoaded.mockResolvedValue(true);
    service.readCommand.mockResolvedValue({
      programArguments: ["openclaw", "gateway", "run"],
      environment: {
        OPENCLAW_GATEWAY_TOKEN: "durable-token",
      },
    } as never);
    buildGatewayInstallPlanMock.mockResolvedValueOnce({
      programArguments: ["openclaw", "gateway", "run"],
      workingDirectory: "/tmp",
      environment: {
        OPENCLAW_GATEWAY_TOKEN: "durable-token",
      },
    });

    await runDaemonInstall({ json: true });

    expect(buildGatewayInstallPlanMock).toHaveBeenCalledTimes(1);
    expect(replaceConfigFileMock).not.toHaveBeenCalled();
    expect(installDaemonServiceAndEmitMock).not.toHaveBeenCalled();
    expectLastEmittedResult("already-installed");
  });

  it("preserves managed base wrapper, environment, and provenance during forced reinstall", async () => {
    for (const key of ["OPENAI_API_KEY", "OPENCLAW_WRAPPER"]) {
      delete process.env[key];
    }
    const environment = {
      OPENAI_API_KEY: "managed-service-key",
      OPENCLAW_WRAPPER: "/usr/local/bin/openclaw-doppler",
    };
    const environmentValueSources = {
      OPENAI_API_KEY: "file",
      OPENCLAW_WRAPPER: "inline",
    };
    service.isLoaded.mockResolvedValue(false);
    service.readCommand.mockResolvedValue({
      programArguments: ["/operator/drop-in-wrapper", "gateway", "run"],
      environment: {
        OPENAI_API_KEY: "operator-drop-in-key",
        OPENCLAW_WRAPPER: "/operator/drop-in-wrapper",
      },
      environmentValueSources: { OPENAI_API_KEY: "inline" },
      managedDefinition: {
        programArguments: [environment.OPENCLAW_WRAPPER, "gateway", "run"],
        environment,
        environmentValueSources,
      },
    } as never);

    await runDaemonInstall({ json: true, force: true });

    expect(service.readCommand).toHaveBeenCalledTimes(1);
    const installPlanArg = readFirstInstallPlanArg();
    expectFields(installPlanArg, {
      wrapperPath: environment.OPENCLAW_WRAPPER,
      existingEnvironment: environment,
      existingEnvironmentValueSources: environmentValueSources,
    });
    expectFields(installPlanArg.env, environment);
    expect(installDaemonServiceAndEmitMock).toHaveBeenCalledTimes(1);
  });

  it("preserves generated-service CA trust without unsafe overrides during forced reinstall", async () => {
    const extraCaCerts = "/opt/openclaw/corporate-ca.pem";
    const programArguments = [
      "/usr/bin/node",
      "--max-old-space-size=24576",
      "--require=/tmp/service-preload.js",
      "/usr/local/bin/openclaw",
      "gateway",
    ];
    for (const key of [
      "NODE_EXTRA_CA_CERTS",
      "NODE_TLS_REJECT_UNAUTHORIZED",
      "HTTPS_PROXY",
      "NODE_OPTIONS",
      "BASH_ENV",
      "LD_PRELOAD",
    ]) {
      delete process.env[key];
    }
    service.isLoaded.mockResolvedValue(true);
    service.readCommand.mockResolvedValue({
      programArguments,
      environment: {
        NODE_EXTRA_CA_CERTS: extraCaCerts,
        NODE_TLS_REJECT_UNAUTHORIZED: "0",
        HTTPS_PROXY: "https://attacker.invalid",
        NODE_OPTIONS: "--require /tmp/untrusted.js",
        BASH_ENV: "/tmp/untrusted.sh",
        LD_PRELOAD: "/tmp/untrusted.so",
      },
      environmentValueSources: {
        NODE_EXTRA_CA_CERTS: "file",
      },
    } as never);
    buildGatewayInstallPlanMock.mockImplementationOnce(async (params) => {
      const plan = await createInstallPlanFixture(params);
      return {
        ...plan,
        environment: {
          ...plan.environment,
          NODE_EXTRA_CA_CERTS: params?.env?.NODE_EXTRA_CA_CERTS ?? "/etc/ssl/cert.pem",
        },
      };
    });
    installDaemonServiceAndEmitMock.mockImplementationOnce(async (params?: unknown) => {
      await (params as { install: () => Promise<void> }).install();
    });

    await runDaemonInstall({ json: true, force: true });

    const installPlanArg = readFirstInstallPlanArg();
    expect(installPlanArg.existingCommand).toEqual(expect.objectContaining({ programArguments }));
    const installEnv = installPlanArg.env as Record<string, string | undefined>;
    expect(installEnv.NODE_EXTRA_CA_CERTS).toBe(extraCaCerts);
    expect(installEnv.NODE_TLS_REJECT_UNAUTHORIZED).toBeUndefined();
    expect(installEnv.HTTPS_PROXY).toBeUndefined();
    expect(installEnv.NODE_OPTIONS).toBeUndefined();
    expect(installEnv.BASH_ENV).toBeUndefined();
    expect(installEnv.LD_PRELOAD).toBeUndefined();
    expectFields(installPlanArg.existingEnvironmentValueSources, {
      NODE_EXTRA_CA_CERTS: "file",
    });
    const installCalls = service.install.mock.calls as unknown as Array<
      [{ environment?: Record<string, string | undefined> }]
    >;
    expect(installCalls[0]?.[0].environment?.NODE_EXTRA_CA_CERTS).toBe(extraCaCerts);
  });

  it("reinstalls when wrapper command matches but wrapper env is missing", async () => {
    service.isLoaded.mockResolvedValue(true);
    service.readCommand.mockResolvedValue({
      programArguments: ["/usr/local/bin/openclaw-doppler", "gateway", "run"],
      environment: {},
    } as never);

    await runDaemonInstall({
      json: true,
      wrapper: "/usr/local/bin/openclaw-doppler",
    });

    expect(installDaemonServiceAndEmitMock).toHaveBeenCalledTimes(1);
    expect(actionState.warnings).toContain(
      "Gateway service OPENCLAW_WRAPPER differs from the current wrapper install plan; refreshing the install.",
    );
  });

  it("reinstalls when the embedded gateway token differs from the install plan", async () => {
    service.isLoaded.mockResolvedValue(true);
    service.readCommand.mockResolvedValue({
      programArguments: ["openclaw", "gateway", "run"],
      environment: {
        OPENCLAW_GATEWAY_TOKEN: "stale-service-token",
      },
    } as never);
    buildGatewayInstallPlanMock.mockResolvedValueOnce({
      programArguments: ["openclaw", "gateway", "run"],
      workingDirectory: "/tmp",
      environment: {
        OPENCLAW_GATEWAY_TOKEN: "fresh-token",
      },
    });

    await runDaemonInstall({ json: true });

    expect(installDaemonServiceAndEmitMock).toHaveBeenCalledTimes(1);
    expect(actionState.warnings).toContain(
      "Gateway service OPENCLAW_GATEWAY_TOKEN differs from the current install plan; refreshing the install.",
    );
  });

  it.each([
    { name: "an env file", source: "file", operatorOwned: false },
    { name: "an operator-only drop-in", source: "inline", operatorOwned: true },
  ])("does not reinstall when OPENCLAW_GATEWAY_TOKEN comes from $name", async (testCase) => {
    service.isLoaded.mockResolvedValue(true);
    const programArguments = ["openclaw", "gateway", "run"];
    service.readCommand.mockResolvedValue({
      programArguments,
      environment: { OPENCLAW_GATEWAY_TOKEN: "operator-token" },
      environmentValueSources: { OPENCLAW_GATEWAY_TOKEN: testCase.source },
      ...(testCase.operatorOwned && {
        managedDefinition: { programArguments, environment: {} },
      }),
    } as never);

    await runDaemonInstall({ json: true });

    expect(buildGatewayInstallPlanMock).not.toHaveBeenCalled();
    expect(installDaemonServiceAndEmitMock).not.toHaveBeenCalled();
    expectLastEmittedResult("already-installed");
  });

  it("reinstalls when an existing service is missing the nvm TLS CA bundle", async () => {
    service.isLoaded.mockResolvedValue(true);
    resolveNodeStartupTlsEnvironmentMock.mockReturnValue({
      NODE_EXTRA_CA_CERTS: "/etc/ssl/certs/ca-certificates.crt",
      NODE_USE_SYSTEM_CA: undefined,
    });
    service.readCommand.mockResolvedValue({
      programArguments: ["openclaw", "gateway", "run"],
      environment: {},
    } as never);

    await runDaemonInstall({ json: true });

    expect(installDaemonServiceAndEmitMock).toHaveBeenCalledTimes(1);
  });

  it("reinstalls when the installed service still runs from nvm even if the installer runtime does not", async () => {
    service.isLoaded.mockResolvedValue(true);
    resolveNodeStartupTlsEnvironmentMock.mockImplementation(({ execPath }) => ({
      NODE_EXTRA_CA_CERTS:
        typeof execPath === "string" && execPath.includes("/.nvm/")
          ? "/etc/ssl/certs/ca-certificates.crt"
          : undefined,
      NODE_USE_SYSTEM_CA: undefined,
    }));
    service.readCommand.mockResolvedValue({
      programArguments: ["/home/test/.nvm/versions/node/v22.19.0/bin/node", "dist/entry.js"],
      environment: {},
    } as never);

    await runDaemonInstall({ json: true });

    expect(installDaemonServiceAndEmitMock).toHaveBeenCalledTimes(1);
    expectFields(readFirstNodeStartupTlsEnvironmentArg(), {
      execPath: "/home/test/.nvm/versions/node/v22.19.0/bin/node",
    });
  });

  it("reuses env-backed service secrets during forced reinstall when the current shell is missing them", async () => {
    service.isLoaded.mockResolvedValue(true);
    service.readCommand.mockResolvedValue({
      programArguments: ["openclaw", "gateway", "run"],
      environment: {
        OPENAI_API_KEY: "service-openai-key",
      },
    } as never);
    delete process.env.OPENAI_API_KEY;
    process.env.NODE_OPTIONS = "--require /tmp/untrusted.js";
    await runDaemonInstall({ json: true, force: true });

    expectFields(readFirstInstallPlanArg().env, {
      OPENAI_API_KEY: "service-openai-key",
    });
    expect(installDaemonServiceAndEmitMock).toHaveBeenCalledTimes(1);
  });

  it("does not reuse stale service control env during forced reinstall", async () => {
    service.isLoaded.mockResolvedValue(true);
    service.readCommand.mockResolvedValue({
      programArguments: ["openclaw", "gateway", "run"],
      environment: {
        OPENCLAW_STATE_DIR: "/tmp/openclaw-doctor-manual",
        OPENCLAW_CONFIG_PATH: "/tmp/openclaw-doctor-manual/openclaw.json",
        OPENCLAW_GATEWAY_TOKEN: "stale-service-token",
        PATH: "/tmp/doctor-bin:/usr/bin",
        NODE_OPTIONS: "--require /tmp/evil.js",
        OPENAI_API_KEY: "service-openai-key",
      },
    } as never);

    delete process.env.OPENAI_API_KEY;
    await runDaemonInstall({ json: true, force: true });

    expectFields(readFirstInstallPlanArg().env, {
      OPENAI_API_KEY: "service-openai-key",
    });
    const env = readFirstInstallPlanArg().env as Record<string, string | undefined>;
    expect(env.OPENCLAW_STATE_DIR).toBeUndefined();
    expect(env.OPENCLAW_CONFIG_PATH).toBeUndefined();
    expect(env.OPENCLAW_GATEWAY_TOKEN).toBeUndefined();
    expect(env.NODE_OPTIONS).toBeUndefined();
    expect(env.PATH).not.toContain("/tmp/doctor-bin");
    expect(installDaemonServiceAndEmitMock).toHaveBeenCalledTimes(1);
  });
});