package platform

import (
	"fmt"
	"strings"
	"testing"
)

// mockServer creates a Server with SSH and Copy hooks for testing.
// The sshCalls slice records all SSH invocations.
func mockServer() (*Server, *[][]string) {
	sshCalls := &[][]string{}
	s := &Server{
		IP:   "10.0.0.1",
		Name: "test-server",
		sshHook: func(args ...string) (string, error) {
			*sshCalls = append(*sshCalls, args)
			return "", nil
		},
		copyHook: func(local, remote string) error {
			return nil
		},
	}
	return s, sshCalls
}

// --- StartService tests ---

func TestStartServiceMinimal(t *testing.T) {
	s, calls := mockServer()
	svc := &Service{
		Name:  "my-app",
		Image: "my-app:latest",
	}

	err := StartService(s, svc)
	if err != nil {
		t.Fatalf("StartService: %v", err)
	}
	if len(*calls) != 1 {
		t.Fatalf("SSH called %d times, want 1", len(*calls))
	}

	args := (*calls)[0]
	// Should contain: docker run -d --name my-app my-app:latest
	joined := strings.Join(args, " ")
	if !strings.Contains(joined, "docker run -d --name my-app") {
		t.Errorf("args = %q, want to contain %q", joined, "docker run -d --name my-app")
	}
	if !strings.HasSuffix(joined, "my-app:latest") {
		t.Errorf("args should end with image, got %q", joined)
	}
}

func TestStartServiceWithPorts(t *testing.T) {
	s, calls := mockServer()
	svc := &Service{
		Name:  "web",
		Image: "nginx:latest",
		Ports: []Port{
			{Host: 80, Container: 8080},
			{Host: 443, Container: 8443, Bind: "0.0.0.0"},
		},
	}

	err := StartService(s, svc)
	if err != nil {
		t.Fatalf("StartService: %v", err)
	}

	args := (*calls)[0]
	joined := strings.Join(args, " ")

	if !strings.Contains(joined, "-p 80:8080") {
		t.Errorf("args missing port mapping 80:8080, got %q", joined)
	}
	if !strings.Contains(joined, "-p 0.0.0.0:443:8443") {
		t.Errorf("args missing port mapping 0.0.0.0:443:8443, got %q", joined)
	}
}

func TestStartServiceWithVolumes(t *testing.T) {
	s, calls := mockServer()
	svc := &Service{
		Name:  "db",
		Image: "postgres:latest",
		Volumes: []Mount{
			{Source: "/data/pg", Target: "/var/lib/postgresql/data"},
		},
	}

	err := StartService(s, svc)
	if err != nil {
		t.Fatalf("StartService: %v", err)
	}

	args := (*calls)[0]
	joined := strings.Join(args, " ")
	if !strings.Contains(joined, "-v /data/pg:/var/lib/postgresql/data") {
		t.Errorf("args missing volume mount, got %q", joined)
	}
}

func TestStartServiceWithEnv(t *testing.T) {
	s, calls := mockServer()
	svc := &Service{
		Name:  "app",
		Image: "app:latest",
		Env: map[string]string{
			"PORT": "8080",
		},
	}

	err := StartService(s, svc)
	if err != nil {
		t.Fatalf("StartService: %v", err)
	}

	args := (*calls)[0]
	joined := strings.Join(args, " ")
	if !strings.Contains(joined, "-e PORT=8080") {
		t.Errorf("args missing env var, got %q", joined)
	}
}

func TestStartServiceWithNetwork(t *testing.T) {
	s, calls := mockServer()
	svc := &Service{
		Name:    "app",
		Image:   "app:latest",
		Network: "my-network",
	}

	err := StartService(s, svc)
	if err != nil {
		t.Fatalf("StartService: %v", err)
	}

	args := (*calls)[0]
	joined := strings.Join(args, " ")
	if !strings.Contains(joined, "--network my-network") {
		t.Errorf("args missing network, got %q", joined)
	}
}

func TestStartServiceWithRestart(t *testing.T) {
	s, calls := mockServer()
	svc := &Service{
		Name:    "app",
		Image:   "app:latest",
		Restart: "unless-stopped",
	}

	err := StartService(s, svc)
	if err != nil {
		t.Fatalf("StartService: %v", err)
	}

	args := (*calls)[0]
	joined := strings.Join(args, " ")
	if !strings.Contains(joined, "--restart unless-stopped") {
		t.Errorf("args missing restart policy, got %q", joined)
	}
}

func TestStartServiceWithHealthcheck(t *testing.T) {
	s, calls := mockServer()
	svc := &Service{
		Name:  "app",
		Image: "app:latest",
		Healthcheck: &Healthcheck{
			Cmd:         "curl -f http://localhost/health",
			Interval:    "30s",
			Timeout:     "10s",
			Retries:     3,
			StartPeriod: "5s",
		},
	}

	err := StartService(s, svc)
	if err != nil {
		t.Fatalf("StartService: %v", err)
	}

	args := (*calls)[0]
	joined := strings.Join(args, " ")
	if !strings.Contains(joined, "--health-cmd") {
		t.Errorf("args missing --health-cmd, got %q", joined)
	}
	if !strings.Contains(joined, "--health-interval 30s") {
		t.Errorf("args missing --health-interval, got %q", joined)
	}
	if !strings.Contains(joined, "--health-timeout 10s") {
		t.Errorf("args missing --health-timeout, got %q", joined)
	}
	if !strings.Contains(joined, "--health-retries 3") {
		t.Errorf("args missing --health-retries, got %q", joined)
	}
	if !strings.Contains(joined, "--health-start-period 5s") {
		t.Errorf("args missing --health-start-period, got %q", joined)
	}
}

func TestStartServiceWithResources(t *testing.T) {
	s, calls := mockServer()
	svc := &Service{
		Name:  "app",
		Image: "app:latest",
		Resources: &Resources{
			CPUs:   "0.5",
			Memory: "512m",
		},
	}

	err := StartService(s, svc)
	if err != nil {
		t.Fatalf("StartService: %v", err)
	}

	args := (*calls)[0]
	joined := strings.Join(args, " ")
	if !strings.Contains(joined, "--cpus 0.5") {
		t.Errorf("args missing --cpus, got %q", joined)
	}
	if !strings.Contains(joined, "--memory 512m") {
		t.Errorf("args missing --memory, got %q", joined)
	}
}

func TestStartServiceWithLogging(t *testing.T) {
	s, calls := mockServer()
	svc := &Service{
		Name:  "app",
		Image: "app:latest",
		Logging: &LogConfig{
			Driver: "json-file",
			Options: map[string]string{
				"max-size": "10m",
			},
		},
	}

	err := StartService(s, svc)
	if err != nil {
		t.Fatalf("StartService: %v", err)
	}

	args := (*calls)[0]
	joined := strings.Join(args, " ")
	if !strings.Contains(joined, "--log-driver json-file") {
		t.Errorf("args missing --log-driver, got %q", joined)
	}
	if !strings.Contains(joined, "--log-opt max-size=10m") {
		t.Errorf("args missing --log-opt, got %q", joined)
	}
}

func TestStartServiceWithPrivileged(t *testing.T) {
	s, calls := mockServer()
	svc := &Service{
		Name:       "app",
		Image:      "app:latest",
		Privileged: true,
	}

	err := StartService(s, svc)
	if err != nil {
		t.Fatalf("StartService: %v", err)
	}

	args := (*calls)[0]
	joined := strings.Join(args, " ")
	if !strings.Contains(joined, "--privileged") {
		t.Errorf("args missing --privileged, got %q", joined)
	}
}

func TestStartServiceWithCommand(t *testing.T) {
	s, calls := mockServer()
	svc := &Service{
		Name:    "app",
		Image:   "app:latest",
		Command: []string{"serve", "--port=8080"},
	}

	err := StartService(s, svc)
	if err != nil {
		t.Fatalf("StartService: %v", err)
	}

	args := (*calls)[0]
	joined := strings.Join(args, " ")
	// Command should come after image
	if !strings.HasSuffix(joined, "app:latest serve --port=8080") {
		t.Errorf("args should end with image and command, got %q", joined)
	}
}

func TestStartServiceSSHFailure(t *testing.T) {
	s := &Server{
		IP: "10.0.0.1",
		sshHook: func(args ...string) (string, error) {
			return "", fmt.Errorf("ssh connection failed")
		},
	}
	svc := &Service{
		Name:  "app",
		Image: "app:latest",
	}

	err := StartService(s, svc)
	if err == nil {
		t.Fatal("expected error when SSH fails")
	}
	if !strings.Contains(err.Error(), "ssh connection failed") {
		t.Errorf("error = %q, want to contain %q", err.Error(), "ssh connection failed")
	}
}

func TestStartServiceFullSpec(t *testing.T) {
	s, calls := mockServer()
	svc := &Service{
		Name:    "full-app",
		Image:   "myregistry/full-app:v1.2.3",
		Command: []string{"start"},
		Ports: []Port{
			{Host: 80, Container: 8080},
		},
		Volumes: []Mount{
			{Source: "/data", Target: "/app/data"},
		},
		Env: map[string]string{
			"ENV": "prod",
		},
		Network:    "app-net",
		Restart:    "always",
		Privileged: false,
		Healthcheck: &Healthcheck{
			Cmd:      "curl -f http://localhost/health",
			Interval: "15s",
			Timeout:  "5s",
			Retries:  5,
		},
		Resources: &Resources{
			CPUs:   "2",
			Memory: "1g",
		},
		Logging: &LogConfig{
			Driver: "json-file",
		},
	}

	err := StartService(s, svc)
	if err != nil {
		t.Fatalf("StartService: %v", err)
	}

	args := (*calls)[0]
	// Verify the first few args are always docker run -d --name
	if args[0] != "docker" || args[1] != "run" || args[2] != "-d" || args[3] != "--name" || args[4] != "full-app" {
		t.Errorf("first args = %v, want [docker run -d --name full-app]", args[:5])
	}
}

// --- StopService tests ---

func TestStopService(t *testing.T) {
	s, calls := mockServer()

	err := StopService(s, "my-app")
	if err != nil {
		t.Fatalf("StopService: %v", err)
	}
	if len(*calls) != 1 {
		t.Fatalf("SSH called %d times, want 1", len(*calls))
	}

	args := (*calls)[0]
	if len(args) != 4 || args[0] != "docker" || args[1] != "rm" || args[2] != "-f" || args[3] != "my-app" {
		t.Errorf("args = %v, want [docker rm -f my-app]", args)
	}
}

func TestStopServiceSSHFailure(t *testing.T) {
	s := &Server{
		IP: "10.0.0.1",
		sshHook: func(args ...string) (string, error) {
			return "", fmt.Errorf("container not found")
		},
	}

	err := StopService(s, "missing-app")
	if err == nil {
		t.Fatal("expected error when SSH fails")
	}
}

// --- UploadImage tests ---

func TestUploadImageEmptyPath(t *testing.T) {
	s, calls := mockServer()

	name, err := UploadImage(s, "")
	if err != nil {
		t.Fatalf("UploadImage: %v", err)
	}
	if name != "" {
		t.Errorf("name = %q, want empty", name)
	}
	if len(*calls) != 0 {
		t.Errorf("SSH called %d times, want 0 for empty path", len(*calls))
	}
}

func TestUploadImageExtractsName(t *testing.T) {
	s, _ := mockServer()

	name, err := UploadImage(s, "/tmp/my-app.tar.gz")
	if err != nil {
		t.Fatalf("UploadImage: %v", err)
	}
	if name != "my-app" {
		t.Errorf("name = %q, want %q", name, "my-app")
	}
}

func TestUploadImageCopyFailure(t *testing.T) {
	s := &Server{
		IP: "10.0.0.1",
		copyHook: func(local, remote string) error {
			return fmt.Errorf("upload failed")
		},
		sshHook: func(args ...string) (string, error) {
			return "", nil
		},
	}

	_, err := UploadImage(s, "/tmp/my-app.tar.gz")
	if err == nil {
		t.Fatal("expected error when Copy fails")
	}
}

func TestUploadImageLoadFailure(t *testing.T) {
	s := &Server{
		IP: "10.0.0.1",
		copyHook: func(local, remote string) error {
			return nil
		},
		sshHook: func(args ...string) (string, error) {
			joined := strings.Join(args, " ")
			if strings.Contains(joined, "gunzip") || strings.Contains(joined, "docker load") {
				return "", fmt.Errorf("docker load failed")
			}
			return "", nil
		},
	}

	_, err := UploadImage(s, "/tmp/bad-image.tar.gz")
	if err == nil {
		t.Fatal("expected error when docker load fails")
	}
	if !strings.Contains(err.Error(), "docker load") {
		t.Errorf("error = %q, want to contain %q", err.Error(), "docker load")
	}
}

// --- WaitForHealthy tests ---

func TestWaitForHealthyImmediateHealthy(t *testing.T) {
	s := &Server{
		IP: "10.0.0.1",
		sshHook: func(args ...string) (string, error) {
			return "healthy", nil
		},
	}

	err := WaitForHealthy(s, "my-app", 30)
	if err != nil {
		t.Fatalf("WaitForHealthy: %v", err)
	}
}

func TestWaitForHealthyUnhealthy(t *testing.T) {
	s := &Server{
		IP: "10.0.0.1",
		sshHook: func(args ...string) (string, error) {
			joined := strings.Join(args, " ")
			if strings.Contains(joined, "inspect") {
				return "unhealthy", nil
			}
			// For docker logs call
			return "error: container crashed", nil
		},
	}

	err := WaitForHealthy(s, "my-app", 30)
	if err == nil {
		t.Fatal("expected error for unhealthy container")
	}
	if !strings.Contains(err.Error(), "unhealthy") {
		t.Errorf("error = %q, want to contain %q", err.Error(), "unhealthy")
	}
}

func TestWaitForHealthyTimeout(t *testing.T) {
	s := &Server{
		IP: "10.0.0.1",
		sshHook: func(args ...string) (string, error) {
			return "starting", nil
		},
	}

	// Use 0 timeout to trigger immediate timeout
	err := WaitForHealthy(s, "my-app", 0)
	if err == nil {
		t.Fatal("expected timeout error")
	}
	if !strings.Contains(err.Error(), "timeout") {
		t.Errorf("error = %q, want to contain %q", err.Error(), "timeout")
	}
}

func TestWaitForHealthyInspectError(t *testing.T) {
	attempt := 0
	s := &Server{
		IP: "10.0.0.1",
		sshHook: func(args ...string) (string, error) {
			attempt++
			if attempt == 1 {
				// First attempt: inspect fails (container not ready)
				return "", fmt.Errorf("container not found")
			}
			// Second attempt: healthy
			return "healthy", nil
		},
	}

	err := WaitForHealthy(s, "my-app", 30)
	if err != nil {
		t.Fatalf("WaitForHealthy: %v", err)
	}
}

// --- BackupContainer tests ---

func TestBackupContainer(t *testing.T) {
	s, calls := mockServer()

	BackupContainer(s, "my-app")

	if len(*calls) != 3 {
		t.Fatalf("SSH called %d times, want 3", len(*calls))
	}

	// First: remove old backup
	args0 := (*calls)[0]
	if len(args0) < 4 || args0[3] != "my-app-backup" {
		t.Errorf("first call should remove old backup, got %v", args0)
	}

	// Second: stop current container
	args1 := (*calls)[1]
	if len(args1) < 3 || args1[0] != "docker" || args1[1] != "stop" || args1[2] != "my-app" {
		t.Errorf("second call should stop container, got %v", args1)
	}

	// Third: rename to backup
	args2 := (*calls)[2]
	if len(args2) < 4 || args2[0] != "docker" || args2[1] != "rename" || args2[2] != "my-app" || args2[3] != "my-app-backup" {
		t.Errorf("third call should rename, got %v", args2)
	}
}

// --- Rollback tests ---

func TestRollbackSuccess(t *testing.T) {
	s, calls := mockServer()

	err := Rollback(s, "my-app")
	if err != nil {
		t.Fatalf("Rollback: %v", err)
	}

	// Should make calls: inspect backup, remove current, rename backup, start
	if len(*calls) < 3 {
		t.Fatalf("SSH called %d times, want at least 3", len(*calls))
	}

	// First call: inspect the backup
	if (*calls)[0][0] != "docker" || (*calls)[0][1] != "inspect" {
		t.Errorf("first call should inspect backup, got %v", (*calls)[0])
	}
}

func TestRollbackNoBackup(t *testing.T) {
	s := &Server{
		IP: "10.0.0.1",
		sshHook: func(args ...string) (string, error) {
			if len(args) >= 2 && args[1] == "inspect" {
				return "", fmt.Errorf("no such container")
			}
			return "", nil
		},
	}

	err := Rollback(s, "my-app")
	if err != nil {
		t.Fatalf("Rollback with no backup should return nil, got: %v", err)
	}
}

func TestRollbackRenameFailure(t *testing.T) {
	callNum := 0
	s := &Server{
		IP: "10.0.0.1",
		sshHook: func(args ...string) (string, error) {
			callNum++
			if len(args) >= 2 && args[1] == "rename" {
				return "", fmt.Errorf("rename failed")
			}
			return "", nil
		},
	}

	err := Rollback(s, "my-app")
	if err == nil {
		t.Fatal("expected error when rename fails")
	}
	if !strings.Contains(err.Error(), "rename") {
		t.Errorf("error = %q, want to contain %q", err.Error(), "rename")
	}
}

func TestRollbackStartFailure(t *testing.T) {
	s := &Server{
		IP: "10.0.0.1",
		sshHook: func(args ...string) (string, error) {
			if len(args) >= 2 && args[1] == "start" {
				return "", fmt.Errorf("start failed")
			}
			return "", nil
		},
	}

	err := Rollback(s, "my-app")
	if err == nil {
		t.Fatal("expected error when start fails")
	}
	if !strings.Contains(err.Error(), "start") {
		t.Errorf("error = %q, want to contain %q", err.Error(), "start")
	}
}

// --- RemoveContainer tests ---

func TestRemoveContainer(t *testing.T) {
	s, calls := mockServer()

	RemoveContainer(s, "old-container")

	if len(*calls) != 1 {
		t.Fatalf("SSH called %d times, want 1", len(*calls))
	}

	args := (*calls)[0]
	if len(args) != 4 || args[0] != "docker" || args[1] != "rm" || args[2] != "-f" || args[3] != "old-container" {
		t.Errorf("args = %v, want [docker rm -f old-container]", args)
	}
}

// --- ConfigureInsecureRegistry tests ---

func TestConfigureInsecureRegistryAlreadyConfigured(t *testing.T) {
	callCount := 0
	s := &Server{
		IP:   "10.0.0.1",
		Name: "test-server",
		sshHook: func(args ...string) (string, error) {
			callCount++
			if len(args) >= 2 && args[0] == "cat" {
				return `{"insecure-registries":["10.0.0.5:5000"]}`, nil
			}
			return "", nil
		},
	}

	ConfigureInsecureRegistry(s, "10.0.0.5:5000")

	// Should only call SSH once (the cat) and skip the rest
	if callCount != 1 {
		t.Errorf("SSH called %d times, want 1 (only cat)", callCount)
	}
}

func TestConfigureInsecureRegistryNewConfig(t *testing.T) {
	sshCalls := [][]string{}
	writeCalled := false
	s := &Server{
		IP:   "10.0.0.1",
		Name: "test-server",
		sshHook: func(args ...string) (string, error) {
			sshCalls = append(sshCalls, args)
			if len(args) >= 2 && args[0] == "cat" {
				return "", fmt.Errorf("file not found")
			}
			return "", nil
		},
		copyHook: func(local, remote string) error {
			writeCalled = true
			return nil
		},
	}

	ConfigureInsecureRegistry(s, "10.0.0.5:5000")

	// Should call cat, then Write (which calls Copy), then restart docker
	if len(sshCalls) < 2 {
		t.Errorf("SSH called %d times, want at least 2 (cat + restart)", len(sshCalls))
	}
	if !writeCalled {
		t.Error("Write was not called to write daemon.json")
	}
}

func TestConfigureInsecureRegistryRestartFailure(t *testing.T) {
	s := &Server{
		IP:   "10.0.0.1",
		Name: "test-server",
		sshHook: func(args ...string) (string, error) {
			if len(args) >= 1 && args[0] == "cat" {
				return "old-config", nil // different from expected
			}
			if len(args) >= 1 && args[0] == "bash" {
				return "", fmt.Errorf("systemctl restart failed")
			}
			return "", nil
		},
		copyHook: func(local, remote string) error {
			return nil
		},
	}

	// Should not panic, just log warning
	ConfigureInsecureRegistry(s, "10.0.0.5:5000")
}

// --- WaitForRegistry tests ---

func TestWaitForRegistry(t *testing.T) {
	s, calls := mockServer()

	WaitForRegistry(s, "10.0.0.5:5000")

	if len(*calls) != 1 {
		t.Fatalf("SSH called %d times, want 1", len(*calls))
	}

	args := (*calls)[0]
	joined := strings.Join(args, " ")
	if !strings.Contains(joined, "curl") {
		t.Errorf("WaitForRegistry should use curl, got %q", joined)
	}
	if !strings.Contains(joined, "10.0.0.5:5000") {
		t.Errorf("WaitForRegistry should reference host, got %q", joined)
	}
}

func TestWaitForRegistrySSHFailure(t *testing.T) {
	s := &Server{
		IP:   "10.0.0.1",
		Name: "test-server",
		sshHook: func(args ...string) (string, error) {
			return "", fmt.Errorf("registry not ready after 60s")
		},
	}

	// Should not panic, just log warning
	WaitForRegistry(s, "10.0.0.5:5000")
}

// --- SyncSecrets tests ---

func TestSyncSecretsEmpty(t *testing.T) {
	from := &Server{
		IP:   "10.0.0.1",
		Name: "manager",
		sshHook: func(args ...string) (string, error) {
			if len(args) >= 1 && args[0] == "ls" {
				return "", nil // empty listing
			}
			return "", nil
		},
	}

	to := []*Server{
		{IP: "10.0.0.2", Name: "worker-1"},
	}

	// Should not panic or error with empty secrets
	SyncSecrets(from, to)
}

func TestSyncSecretsListError(t *testing.T) {
	from := &Server{
		IP:   "10.0.0.1",
		Name: "manager",
		sshHook: func(args ...string) (string, error) {
			if len(args) >= 1 && args[0] == "ls" {
				return "", fmt.Errorf("permission denied")
			}
			return "", nil
		},
	}

	to := []*Server{
		{IP: "10.0.0.2", Name: "worker-1"},
	}

	// Should not panic, just log warning
	SyncSecrets(from, to)
}

func TestSyncSecretsTransfersFiles(t *testing.T) {
	workerCalls := [][]string{}
	from := &Server{
		IP:   "10.0.0.1",
		Name: "manager",
		sshHook: func(args ...string) (string, error) {
			if len(args) >= 1 && args[0] == "ls" {
				return "auth.key  vapid.pub  ssh_key", nil
			}
			if len(args) >= 1 && args[0] == "base64" {
				return "dGVzdA==", nil // "test" in base64
			}
			return "", nil
		},
	}

	worker := &Server{
		IP:   "10.0.0.2",
		Name: "worker-1",
		sshHook: func(args ...string) (string, error) {
			workerCalls = append(workerCalls, args)
			return "", nil
		},
	}

	SyncSecrets(from, []*Server{worker})

	// Worker should have received calls: mkdir, then bash for each file
	if len(workerCalls) < 2 {
		t.Fatalf("worker SSH called %d times, want at least 2", len(workerCalls))
	}

	// First call should create /etc/secrets directory
	if workerCalls[0][0] != "mkdir" {
		t.Errorf("first worker call = %v, want mkdir", workerCalls[0])
	}

	// Check that the mode handling works: vapid.pub should get 644
	foundPub := false
	foundKey := false
	foundSshKey := false
	for _, call := range workerCalls {
		joined := strings.Join(call, " ")
		if strings.Contains(joined, "vapid.pub") && strings.Contains(joined, "644") {
			foundPub = true
		}
		if strings.Contains(joined, "auth.key") && strings.Contains(joined, "600") {
			foundKey = true
		}
		if strings.Contains(joined, "ssh_key") && strings.Contains(joined, "644") {
			foundSshKey = true
		}
	}
	if !foundPub {
		t.Error("vapid.pub should be transferred with mode 644")
	}
	if !foundKey {
		t.Error("auth.key should be transferred with mode 600")
	}
	if !foundSshKey {
		t.Error("ssh_key should be transferred with mode 644")
	}
}

func TestSyncSecretsBase64ReadError(t *testing.T) {
	from := &Server{
		IP:   "10.0.0.1",
		Name: "manager",
		sshHook: func(args ...string) (string, error) {
			if len(args) >= 1 && args[0] == "ls" {
				return "secret.key", nil
			}
			if len(args) >= 1 && args[0] == "base64" {
				return "", fmt.Errorf("read error")
			}
			return "", nil
		},
	}

	workerCalls := 0
	worker := &Server{
		IP:   "10.0.0.2",
		Name: "worker-1",
		sshHook: func(args ...string) (string, error) {
			workerCalls++
			return "", nil
		},
	}

	// Should not panic, just skip the failed file
	SyncSecrets(from, []*Server{worker})
}

func TestSyncSecretsEmptyBase64(t *testing.T) {
	from := &Server{
		IP:   "10.0.0.1",
		Name: "manager",
		sshHook: func(args ...string) (string, error) {
			if len(args) >= 1 && args[0] == "ls" {
				return "empty.key", nil
			}
			if len(args) >= 1 && args[0] == "base64" {
				return "", nil // empty b64
			}
			return "", nil
		},
	}

	workerBashCalls := 0
	worker := &Server{
		IP:   "10.0.0.2",
		Name: "worker-1",
		sshHook: func(args ...string) (string, error) {
			if len(args) >= 1 && args[0] == "bash" {
				workerBashCalls++
			}
			return "", nil
		},
	}

	SyncSecrets(from, []*Server{worker})

	// Empty b64 should be skipped, so no bash call for file transfer
	if workerBashCalls != 0 {
		t.Errorf("worker bash calls = %d, want 0 for empty b64", workerBashCalls)
	}
}

func TestSyncSecretsMultipleWorkers(t *testing.T) {
	from := &Server{
		IP:   "10.0.0.1",
		Name: "manager",
		sshHook: func(args ...string) (string, error) {
			if len(args) >= 1 && args[0] == "ls" {
				return "secret.key", nil
			}
			if len(args) >= 1 && args[0] == "base64" {
				return "c2VjcmV0", nil
			}
			return "", nil
		},
	}

	worker1Calls := 0
	worker2Calls := 0

	w1 := &Server{
		IP:   "10.0.0.2",
		Name: "worker-1",
		sshHook: func(args ...string) (string, error) {
			worker1Calls++
			return "", nil
		},
	}
	w2 := &Server{
		IP:   "10.0.0.3",
		Name: "worker-2",
		sshHook: func(args ...string) (string, error) {
			worker2Calls++
			return "", nil
		},
	}

	SyncSecrets(from, []*Server{w1, w2})

	if worker1Calls == 0 {
		t.Error("worker-1 should have received calls")
	}
	if worker2Calls == 0 {
		t.Error("worker-2 should have received calls")
	}
}

func TestSyncSecretsPublicKeyMode(t *testing.T) {
	from := &Server{
		IP:   "10.0.0.1",
		Name: "manager",
		sshHook: func(args ...string) (string, error) {
			if len(args) >= 1 && args[0] == "ls" {
				return "vapid_public_key.pem", nil
			}
			if len(args) >= 1 && args[0] == "base64" {
				return "a2V5", nil
			}
			return "", nil
		},
	}

	workerCalls := [][]string{}
	worker := &Server{
		IP:   "10.0.0.2",
		Name: "worker-1",
		sshHook: func(args ...string) (string, error) {
			workerCalls = append(workerCalls, args)
			return "", nil
		},
	}

	SyncSecrets(from, []*Server{worker})

	// Find the bash call that writes the file
	found644 := false
	for _, call := range workerCalls {
		joined := strings.Join(call, " ")
		if strings.Contains(joined, "vapid_public_key.pem") && strings.Contains(joined, "644") {
			found644 = true
		}
	}
	if !found644 {
		t.Error("_public_key.pem files should get mode 644")
	}
}

// --- StartService with nil optional fields ---

func TestStartServiceNilHealthcheck(t *testing.T) {
	s, _ := mockServer()
	svc := &Service{
		Name:        "app",
		Image:       "app:latest",
		Healthcheck: nil,
	}

	err := StartService(s, svc)
	if err != nil {
		t.Fatalf("StartService with nil healthcheck: %v", err)
	}
}

func TestStartServiceNilResources(t *testing.T) {
	s, _ := mockServer()
	svc := &Service{
		Name:      "app",
		Image:     "app:latest",
		Resources: nil,
	}

	err := StartService(s, svc)
	if err != nil {
		t.Fatalf("StartService with nil resources: %v", err)
	}
}

func TestStartServiceNilLogging(t *testing.T) {
	s, _ := mockServer()
	svc := &Service{
		Name:    "app",
		Image:   "app:latest",
		Logging: nil,
	}

	err := StartService(s, svc)
	if err != nil {
		t.Fatalf("StartService with nil logging: %v", err)
	}
}

func TestStartServicePartialHealthcheck(t *testing.T) {
	s, calls := mockServer()
	svc := &Service{
		Name:  "app",
		Image: "app:latest",
		Healthcheck: &Healthcheck{
			Cmd: "curl -f http://localhost/health",
			// No interval, timeout, retries, or start period
		},
	}

	err := StartService(s, svc)
	if err != nil {
		t.Fatalf("StartService: %v", err)
	}

	args := (*calls)[0]
	joined := strings.Join(args, " ")
	if !strings.Contains(joined, "--health-cmd") {
		t.Errorf("args missing --health-cmd, got %q", joined)
	}
	// Should NOT contain --health-interval, --health-timeout, etc.
	if strings.Contains(joined, "--health-interval") {
		t.Errorf("args should not contain --health-interval when not set, got %q", joined)
	}
	if strings.Contains(joined, "--health-retries") {
		t.Errorf("args should not contain --health-retries when zero, got %q", joined)
	}
}

func TestStartServicePartialResources(t *testing.T) {
	s, calls := mockServer()
	svc := &Service{
		Name:  "app",
		Image: "app:latest",
		Resources: &Resources{
			CPUs: "1",
			// No memory
		},
	}

	err := StartService(s, svc)
	if err != nil {
		t.Fatalf("StartService: %v", err)
	}

	args := (*calls)[0]
	joined := strings.Join(args, " ")
	if !strings.Contains(joined, "--cpus 1") {
		t.Errorf("args missing --cpus, got %q", joined)
	}
	if strings.Contains(joined, "--memory") {
		t.Errorf("args should not contain --memory when not set, got %q", joined)
	}
}

// --- BuildImage tests ---

func TestBuildImageSuccess(t *testing.T) {
	sshCalls := [][]string{}
	copyCalls := []struct{ local, remote string }{}
	s := &Server{
		IP:   "10.0.0.1",
		Name: "test-server",
		sshHook: func(args ...string) (string, error) {
			sshCalls = append(sshCalls, args)
			return "", nil
		},
		copyHook: func(local, remote string) error {
			copyCalls = append(copyCalls, struct{ local, remote string }{local, remote})
			return nil
		},
	}

	name, err := BuildImage(s, "test-app", ".")
	if err != nil {
		t.Fatalf("BuildImage: %v", err)
	}
	if name != "test-app" {
		t.Errorf("name = %q, want %q", name, "test-app")
	}

	// Verify SSH calls include: rm, mkdir, tar extract, docker build, rm cleanup
	if len(sshCalls) < 4 {
		t.Fatalf("SSH called %d times, want at least 4", len(sshCalls))
	}

	// First call: clean build dir
	if sshCalls[0][0] != "rm" {
		t.Errorf("first SSH call should be rm, got %v", sshCalls[0])
	}

	// Second call: mkdir
	if sshCalls[1][0] != "mkdir" {
		t.Errorf("second SSH call should be mkdir, got %v", sshCalls[1])
	}

	// Verify Copy was called (upload archive)
	if len(copyCalls) < 1 {
		t.Fatal("Copy was not called to upload archive")
	}
	if !strings.HasSuffix(copyCalls[0].local, "test-app.tar.gz") {
		t.Errorf("Copy local = %q, want to end with test-app.tar.gz", copyCalls[0].local)
	}
}

func TestBuildImageCleanFails(t *testing.T) {
	s := &Server{
		IP: "10.0.0.1",
		sshHook: func(args ...string) (string, error) {
			if len(args) >= 1 && args[0] == "rm" {
				return "", fmt.Errorf("permission denied")
			}
			return "", nil
		},
	}

	_, err := BuildImage(s, "test-app", ".")
	if err == nil {
		t.Fatal("expected error when clean build dir fails")
	}
	if !strings.Contains(err.Error(), "clean build dir") {
		t.Errorf("error = %q, want to contain %q", err.Error(), "clean build dir")
	}
}

func TestBuildImageMkdirFails(t *testing.T) {
	callNum := 0
	s := &Server{
		IP: "10.0.0.1",
		sshHook: func(args ...string) (string, error) {
			callNum++
			if len(args) >= 1 && args[0] == "mkdir" {
				return "", fmt.Errorf("disk full")
			}
			return "", nil
		},
	}

	_, err := BuildImage(s, "test-app", ".")
	if err == nil {
		t.Fatal("expected error when mkdir fails")
	}
	if !strings.Contains(err.Error(), "create build dir") {
		t.Errorf("error = %q, want to contain %q", err.Error(), "create build dir")
	}
}

func TestBuildImageUploadArchiveFails(t *testing.T) {
	s := &Server{
		IP: "10.0.0.1",
		sshHook: func(args ...string) (string, error) {
			return "", nil
		},
		copyHook: func(local, remote string) error {
			return fmt.Errorf("upload failed")
		},
	}

	_, err := BuildImage(s, "test-app", ".")
	if err == nil {
		t.Fatal("expected error when upload fails")
	}
	if !strings.Contains(err.Error(), "upload archive") {
		t.Errorf("error = %q, want to contain %q", err.Error(), "upload archive")
	}
}

func TestBuildImageExtractFails(t *testing.T) {
	s := &Server{
		IP: "10.0.0.1",
		sshHook: func(args ...string) (string, error) {
			if len(args) >= 1 && args[0] == "tar" {
				return "", fmt.Errorf("tar extract failed")
			}
			return "", nil
		},
		copyHook: func(local, remote string) error {
			return nil
		},
	}

	_, err := BuildImage(s, "test-app", ".")
	if err == nil {
		t.Fatal("expected error when tar extract fails")
	}
	if !strings.Contains(err.Error(), "extract archive") {
		t.Errorf("error = %q, want to contain %q", err.Error(), "extract archive")
	}
}

func TestBuildImageDockerBuildFails(t *testing.T) {
	s := &Server{
		IP: "10.0.0.1",
		sshHook: func(args ...string) (string, error) {
			joined := strings.Join(args, " ")
			if strings.Contains(joined, "docker build") {
				return "", fmt.Errorf("build failed")
			}
			return "", nil
		},
		copyHook: func(local, remote string) error {
			return nil
		},
	}

	_, err := BuildImage(s, "test-app", ".")
	if err == nil {
		t.Fatal("expected error when docker build fails")
	}
	if !strings.Contains(err.Error(), "remote docker build") {
		t.Errorf("error = %q, want to contain %q", err.Error(), "remote docker build")
	}
}

func TestBuildImageWithSubdirectorySource(t *testing.T) {
	sshCalls := [][]string{}
	s := &Server{
		IP: "10.0.0.1",
		sshHook: func(args ...string) (string, error) {
			sshCalls = append(sshCalls, args)
			return "", nil
		},
		copyHook: func(local, remote string) error {
			return nil
		},
	}

	name, err := BuildImage(s, "test-app", "./cmd/main")
	if err != nil {
		t.Fatalf("BuildImage: %v", err)
	}
	if name != "test-app" {
		t.Errorf("name = %q, want %q", name, "test-app")
	}
}

func TestBuildImageStripsLeadingDotSlash(t *testing.T) {
	sshCalls := [][]string{}
	s := &Server{
		IP: "10.0.0.1",
		sshHook: func(args ...string) (string, error) {
			sshCalls = append(sshCalls, args)
			return "", nil
		},
		copyHook: func(local, remote string) error {
			return nil
		},
	}

	_, err := BuildImage(s, "my-app", "./web")
	if err != nil {
		t.Fatalf("BuildImage: %v", err)
	}

	// Verify docker build command references the correct name
	found := false
	for _, call := range sshCalls {
		joined := strings.Join(call, " ")
		if strings.Contains(joined, "docker build -t my-app") {
			found = true
		}
	}
	if !found {
		t.Error("docker build command should reference the correct image name")
	}
}

func TestStartServiceLoggingDriverOnly(t *testing.T) {
	s, calls := mockServer()
	svc := &Service{
		Name:  "app",
		Image: "app:latest",
		Logging: &LogConfig{
			Driver: "syslog",
			// No options
		},
	}

	err := StartService(s, svc)
	if err != nil {
		t.Fatalf("StartService: %v", err)
	}

	args := (*calls)[0]
	joined := strings.Join(args, " ")
	if !strings.Contains(joined, "--log-driver syslog") {
		t.Errorf("args missing --log-driver, got %q", joined)
	}
	if strings.Contains(joined, "--log-opt") {
		t.Errorf("args should not contain --log-opt when options is nil, got %q", joined)
	}
}