gunnar-core 3.0.0

//! The repository catalog: namespaces, both hash kinds, and persistence over a
//! real control database on disk rather than only in memory.

mod common;

use std::sync::Arc;

use common::Fixture;
use gunnar_core::{AuthTable, HashKind, NewRepo, RepoCatalog, RepoRef, Visibility, DEFAULT_BRANCH};
// `point_head_at` writes through a repository's OWN git store, which did not
// move: the certificate-identity plan moved the two control DOCUMENTS, not a repository's refs.
use gunnar_store::git_storage_trait::GitServe;

#[test]
fn a_repository_needs_a_namespace_that_exists() {
    let fx = Fixture::new();
    let path = RepoRef::new("acme", "widget").expect("legal");

    // A typo in a push URL must not silently become a tenant.
    let err = fx
        .catalog
        .create(NewRepo::new(path.clone()))
        .expect_err("no namespace yet");
    assert!(format!("{err}").contains("no such namespace"), "{err}");

    fx.catalog.create_namespace("acme").expect("create");
    let repo = fx
        .catalog
        .create(NewRepo::new(path.clone()))
        .expect("create");
    assert_eq!(repo.namespace, "acme");
    assert_eq!(repo.name, "widget");
    assert_eq!(repo.default_branch, DEFAULT_BRANCH);
    assert_eq!(repo.visibility, Visibility::Private);
    assert_eq!(repo.hash_kind, HashKind::Sha256, "sha256 is the default");

    // Twice is an error, not a silent overwrite.
    assert!(fx.catalog.create(NewRepo::new(path.clone())).is_err());
    assert_eq!(fx.catalog.list(None).expect("list").len(), 1);
}

/// Both hash kinds, side by side. sha256 is not inferred from a green sha1
/// (the verification rule).
#[test]
fn both_hash_kinds_are_stored_and_kept_apart() {
    let fx = Fixture::new();
    let old = fx.repo_with("acme", "legacy", HashKind::Sha1, Visibility::Private);
    let new = fx.repo_with("acme", "modern", HashKind::Sha256, Visibility::Private);

    assert_eq!(old.hash_kind, HashKind::Sha1);
    assert_eq!(new.hash_kind, HashKind::Sha256);
    assert_eq!(
        gix_hash::Kind::from(old.hash_kind),
        gix_hash::Kind::Sha1,
        "the conversion the object store is opened with must not collapse the two"
    );
    assert_eq!(gix_hash::Kind::from(new.hash_kind), gix_hash::Kind::Sha256);
    assert_eq!(old.hash_kind.to_string(), "sha1");
    assert_eq!(new.hash_kind.to_string(), "sha256");

    // …and they survive a reload as themselves.
    assert_eq!(
        fx.catalog.open(&old.path()).expect("open").hash_kind,
        HashKind::Sha1
    );
    assert_eq!(
        fx.catalog.open(&new.path()).expect("open").hash_kind,
        HashKind::Sha256
    );
}

#[test]
fn open_list_and_delete() {
    let fx = Fixture::new();
    fx.repo("acme", "one");
    fx.repo("acme", "two");
    fx.repo("other", "three");

    assert_eq!(fx.catalog.list(None).expect("list").len(), 3);
    assert_eq!(fx.catalog.list(Some("acme")).expect("list").len(), 2);
    assert_eq!(fx.catalog.list(Some("nope")).expect("list").len(), 0);
    assert_eq!(fx.catalog.counts().expect("counts"), (2, 3));

    let path = RepoRef::new("acme", "one").expect("legal");
    assert!(fx.catalog.contains(&path).expect("contains"));
    let gone = fx.catalog.delete(&path).expect("delete");
    assert_eq!(gone.name, "one");
    assert!(!fx.catalog.contains(&path).expect("contains"));
    assert!(fx.catalog.open(&path).is_err());
    assert!(
        fx.catalog.delete(&path).is_err(),
        "deleting twice is an error"
    );
    assert_eq!(fx.catalog.list(None).expect("list").len(), 2);
}

/// A path that parses is not a repository that exists. The SSH layer has to be
/// able to tell those apart, and `open` is where it does.
#[test]
fn a_legal_path_that_is_not_in_the_catalog_is_not_a_repository() {
    let fx = Fixture::new();
    fx.repo("acme", "widget");
    // Already unquoted: `gunnar_ssh::command` takes git's single quotes off
    // before the sandbox ever sees the argument.
    let path = gunnar_core::resolve_repo_path("acme/nothing.git").expect("legal path");
    let err = fx.catalog.open(&path).expect_err("not catalogued");
    assert!(format!("{err}").contains("no such repository"), "{err}");
    assert!(!err.is_path_rejection(), "a miss is not a path rejection");
}

#[test]
fn a_namespace_is_not_deleted_out_from_under_its_repositories() {
    let fx = Fixture::new();
    fx.repo("acme", "one");
    fx.repo("acme", "two");

    let err = fx
        .catalog
        .delete_namespace("acme", false)
        .expect_err("not empty");
    assert!(format!("{err}").contains("still holds 2"), "{err}");
    assert_eq!(fx.catalog.list(None).expect("list").len(), 2);

    let taken = fx.catalog.delete_namespace("acme", true).expect("delete");
    assert_eq!(taken.len(), 2);
    assert!(fx.catalog.list(None).expect("list").is_empty());
    assert!(fx.catalog.namespace("acme").expect("read").is_none());
    assert!(fx.catalog.delete_namespace("acme", true).is_err());
}

#[test]
fn namespaces_are_validated_like_every_other_path_component() {
    let fx = Fixture::new();
    assert!(fx.catalog.create_namespace("acme").is_ok());
    assert!(fx.catalog.create_namespace("team/sub").is_ok());
    assert!(
        fx.catalog.create_namespace("acme").is_err(),
        "no duplicates"
    );
    for bad in [
        "", "..", "../etc", "a/../b", ".hidden", "-flag", "ns\0", "café", "a/b/c/d",
    ] {
        assert!(
            fx.catalog.create_namespace(bad).is_err(),
            "{bad:?} must not become a namespace"
        );
    }
    assert_eq!(fx.catalog.namespaces().expect("list").len(), 2);
}

#[test]
fn the_default_branch_must_be_a_full_ref_name() {
    let fx = Fixture::new();
    fx.catalog.create_namespace("acme").expect("ns");
    let path = RepoRef::new("acme", "widget").expect("legal");

    for bad in [
        "main",
        "refs/heads/",
        "refs/tags/v1",
        "refs/heads/..",
        "refs/heads/a b",
    ] {
        assert!(
            fx.catalog
                .create(NewRepo::new(path.clone()).default_branch(bad))
                .is_err(),
            "{bad:?} must not be a default branch"
        );
    }
    let repo = fx
        .catalog
        .create(NewRepo::new(path.clone()).default_branch("refs/heads/trunk"))
        .expect("create");
    assert_eq!(repo.default_branch, "refs/heads/trunk");

    let moved = fx
        .catalog
        .set_default_branch(&path, "refs/heads/release")
        .expect("set");
    assert_eq!(moved.default_branch, "refs/heads/release");
    assert!(fx.catalog.set_default_branch(&path, "release").is_err());
    assert_eq!(
        fx.catalog.open(&path).expect("open").default_branch,
        "refs/heads/release"
    );
}

/// **This round trip is exactly the assertion that let the 2026-08-06 defect
/// ship**, and it is left directly above this test on purpose.
///
/// `set_default_branch` wrote the catalog, `open` read the same value back, and
/// the test above went green — while the *repository's* `HEAD`, which is what
/// the reference advertisement resolves, still named the branch `init_bare` had
/// written and nobody could clone the repository. The catalog was never wrong.
/// It was only ever half the answer.
///
/// So this test is about the other half: the projection, and specifically about
/// it reporting **whether it moved**. A projection that always claims to have
/// moved logs a repair on every open of every healthy repository, and one that
/// never claims to logs nothing on the open that actually fixed something —
/// either way the log stops being evidence.
#[test]
fn head_is_a_projection_of_the_catalogs_default_branch_and_says_when_it_moved() {
    // `MemGitServe` is the conformance suite's control backend — the only
    // in-repository `GitServe` there is, both real ones living in znippy and
    // edda. It is used here for the same reason `MemRefStore` was: this test is
    // about the projection, not about a backend.
    //
    // The read goes through `head()` and not through `refs()`, because the `GitServe` HEAD ruling
    // settled that `HEAD` is **not** a row: reading it out of the ref stream
    // would be asserting the defect this suite now catches.
    let git = gunnar_store::mem::MemGitServe::new(gix_hash::Kind::Sha256);
    let head = |git: &gunnar_store::mem::MemGitServe| -> Option<String> {
        git.head().expect("head").and_then(|row| row.symref_target)
    };

    // A store with no HEAD at all: the projection has to write one.
    assert_eq!(head(&git), None);
    assert!(
        gunnar_core::point_head_at(&git, "refs/heads/master").expect("point"),
        "writing HEAD where there was none is a move and must be reported as one"
    );
    assert_eq!(head(&git).as_deref(), Some("refs/heads/master"));

    // Already correct: no write, and it says so.
    assert!(
        !gunnar_core::point_head_at(&git, "refs/heads/master").expect("point"),
        "HEAD already named the default branch, so nothing moved and nothing may claim to"
    );

    // Moved somewhere else: a move again.
    assert!(gunnar_core::point_head_at(&git, "refs/heads/trunk").expect("point"));
    assert_eq!(head(&git).as_deref(), Some("refs/heads/trunk"));

    // The same validation the catalog applies, so the two cannot diverge on
    // what a legal default branch is.
    for bad in ["trunk", "refs/tags/v1", "refs/heads/..", ""] {
        assert!(
            gunnar_core::point_head_at(&git, bad).is_err(),
            "{bad:?} must not be projectable onto HEAD"
        );
    }
    assert_eq!(
        head(&git).as_deref(),
        Some("refs/heads/trunk"),
        "a refused name must leave HEAD where it was"
    );
}

/// The catalog is a blob plus a pointer, so a second handle over the same
/// store sees the same state, which is what makes it storage rather than a
/// cache.
#[test]
fn a_second_handle_over_the_same_stores_sees_the_same_catalog() {
    let fx = Fixture::new();
    fx.repo("acme", "widget");

    let second = RepoCatalog::new(Arc::clone(&fx.store)).expect("open");
    assert_eq!(second.list(None).expect("list").len(), 1);
    second
        .create(NewRepo::new(RepoRef::new("acme", "other").expect("legal")))
        .expect("create through the second handle");
    assert_eq!(fx.catalog.list(None).expect("list").len(), 2);

    // The catalog and the identity table are separate documents under separate
    // names, and must not overwrite each other.
    assert_ne!(fx.catalog.ref_name(), fx.auth.ref_name());
    assert!(fx
        .store
        .read_doc(fx.catalog.ref_name())
        .expect("read")
        .is_some());
}

/// Over a **real control database on a real disk**, not only the in-memory
/// backend: everything is closed, the file is reopened, and the catalog and the
/// identity table are still there.
///
/// This replaces the Arrow-IPC-ref-log restart test that stood here before the
/// certificate-identity plan moved these two documents out of the git object
/// store. The claim is the same one and it is the one that matters — *a restart
/// does not lose the control plane* — asserted against the storage that now
/// holds it.
#[test]
fn the_catalog_survives_a_restart_of_the_control_database() {
    let dir = tempfile::tempdir().expect("temp dir");
    let path = dir.path().join("control.redb");

    {
        let store = gunnar_core::open_control_store(&path).expect("open");
        let catalog = RepoCatalog::new(Arc::clone(&store)).expect("catalog");
        let auth = AuthTable::new(store).expect("auth");
        catalog.create_namespace("acme").expect("ns");
        catalog
            .create(
                NewRepo::new(RepoRef::new("acme", "widget").expect("legal"))
                    .hash_kind(HashKind::Sha1)
                    .visibility(Visibility::Public),
            )
            .expect("create");
        auth.add_principal(
            gunnar_core::Principal::new("ada", "Ada", gunnar_core::PrincipalKind::User)
                .expect("id"),
        )
        .expect("add");
    }

    // Reopen the file: the restart.
    let store = gunnar_core::open_control_store(&path).expect("reopen");
    let catalog = RepoCatalog::new(Arc::clone(&store)).expect("catalog");
    let auth = AuthTable::new(Arc::clone(&store)).expect("auth");

    let repos = catalog.list(None).expect("list");
    assert_eq!(repos.len(), 1, "the catalog did not survive the restart");
    assert_eq!(repos[0].name, "widget");
    assert_eq!(repos[0].hash_kind, HashKind::Sha1);
    assert_eq!(repos[0].visibility, Visibility::Public);
    assert_eq!(catalog.namespaces().expect("list").len(), 1);
    assert_eq!(auth.principals().expect("list").len(), 1);

    // The control plane's audit trail survived it too, and it is what a ref log used to give
    // away for free: three changes above the namespace, in order.
    let history = auth.history().expect("history");
    assert_eq!(
        history.len(),
        1,
        "one principal was added, so the identity table has exactly one version"
    );
    assert_eq!(
        catalog.history().expect("history").len(),
        2,
        "a namespace and a repository are two changes to the catalog"
    );
}

/// An empty catalog and a broken one must not look the same. A storage fault
/// that reads as "no repositories" is the failure mode that silently opens a
/// server up (see `Error::CorruptDocument`).
#[test]
fn a_corrupt_catalog_document_is_an_error_not_an_empty_catalog() {
    let fx = Fixture::new();
    fx.repo("acme", "widget");

    // Point the catalog document at something that is not a catalog, through
    // the real compare-and-swap: a write another writer could have made.
    let junk = fx.store.put_blob(b"not json at all").expect("write");
    let current = fx.store.read_doc(fx.catalog.ref_name()).expect("read");
    assert!(fx
        .store
        .commit_doc(fx.catalog.ref_name(), current, junk)
        .expect("commit"));

    let err = fx.catalog.list(None).expect_err("must not read as empty");
    assert!(format!("{err}").contains("unusable"), "{err}");
}

/// ★ **An account's explode quota round-trips through the control document,
/// and "unset" is not the same answer as "unlimited".**
///
/// The quota is what a plan buys (2026-08-30): a bigger exploded read
/// cache means more objects are already inflated and reads are fast; a smaller
/// one means more reads re-inflate their own delta chain out of the pack.
/// Three states have to survive a reload and stay distinct, because two of
/// them look alike in every spelling that uses a magic value:
///
/// | stored | means |
/// |---|---|
/// | `None` | take the server's default — `min(10 % of /data, 8 GiB)` |
/// | `Some(0)` | **unlimited**, decided by an admin |
/// | `Some(n)` | this many bytes |
///
/// A namespace written before this field existed must load as `None` and not
/// as `Some(0)`, or every account on an upgraded appliance silently becomes
/// unlimited — which is the shape of the bug this asserts against.
///
/// Seen RED by making `explode_budget_bytes` a `u64` with `0` for "unset": the
/// unlimited row and the default row become the same value and the third
/// assertion below cannot be written at all.
#[test]
fn an_accounts_explode_quota_survives_a_reload_and_unset_is_not_unlimited() {
    let fx = Fixture::new();
    fx.catalog.create_namespace("acme").expect("create");

    // A fresh namespace is on the server's default, not on a number.
    assert_eq!(
        fx.catalog.namespace_explode_budget("acme").expect("read"),
        None,
        "a new account was born with a hard-coded quota instead of the server default"
    );

    let set = fx
        .catalog
        .set_namespace_explode_budget("acme", Some(64 << 30))
        .expect("set");
    assert_eq!(set.explode_budget_bytes, Some(64 << 30));
    assert_eq!(
        fx.catalog.namespace_explode_budget("acme").expect("read"),
        Some(64 << 30),
        "the quota did not survive the write"
    );
    // And it is on the row every lister sees, not only on the one returned.
    let listed = fx
        .catalog
        .namespaces()
        .expect("list")
        .into_iter()
        .find(|ns| ns.name == "acme")
        .expect("acme is listed");
    assert_eq!(listed.explode_budget_bytes, Some(64 << 30));

    // Unlimited is a decision.
    fx.catalog
        .set_namespace_explode_budget("acme", Some(0))
        .expect("set");
    assert_eq!(
        fx.catalog.namespace_explode_budget("acme").expect("read"),
        Some(0),
        "`unlimited` was stored as `unset`"
    );

    // And back to the default, which is a different answer again.
    fx.catalog
        .set_namespace_explode_budget("acme", None)
        .expect("clear");
    assert_eq!(
        fx.catalog.namespace_explode_budget("acme").expect("read"),
        None,
        "clearing a quota left the account unlimited instead of on the default"
    );

    // A namespace that is not there is refused BY NAME rather than silently
    // creating one or answering "the default".
    let err = fx
        .catalog
        .set_namespace_explode_budget("nobody", Some(1 << 30))
        .expect_err("no such namespace");
    assert!(format!("{err}").contains("no such namespace"), "{err}");
}