resync_flush_test.go

// SPDX-License-Identifier: Apache-2.0

package git

import (
	"context"
	"os"
	"path/filepath"
	"testing"

	gogit "github.com/go-git/go-git/v6"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
	"k8s.io/apimachinery/pkg/runtime/schema"

	v1alpha3 "github.com/ConfigButler/gitops-reverser/api/v1alpha3"
	"github.com/ConfigButler/gitops-reverser/internal/manifestanalyzer"
	"github.com/ConfigButler/gitops-reverser/internal/telemetry"
	"github.com/ConfigButler/gitops-reverser/internal/types"
	"github.com/ConfigButler/gitops-reverser/internal/typeset"
)

// configMapMapper resolves v1/ConfigMap to a served, allowed resource, so the resync
// planner treats ConfigMap documents as watched, resolved, sweepable managed members.
func configMapMapper() typeset.Lookup {
	return typeset.NewSnapshotRegistry(typeset.Snapshot{Entries: []typeset.Entry{{
		GVK:        schema.GroupVersionKind{Group: "", Version: "v1", Kind: "ConfigMap"},
		GVR:        schema.GroupVersionResource{Group: "", Version: "v1", Resource: "configmaps"},
		Namespaced: true,
		Allowed:    true,
	}}})
}

// desiredCM builds a desired ConfigMap snapshot entry for the default namespace.
func desiredCM(name, color string) manifestanalyzer.DesiredResource {
	return manifestanalyzer.DesiredResource{
		Resource: types.ResourceIdentifier{
			Group: "", Version: "v1", Resource: "configmaps", Namespace: "default", Name: name,
		},
		Object: &unstructured.Unstructured{Object: map[string]interface{}{
			"apiVersion": "v1",
			"kind":       "ConfigMap",
			"metadata":   map[string]interface{}{"name": name, "namespace": "default"},
			"data":       map[string]interface{}{"color": color},
		}},
	}
}

// cmManifest renders the canonical ConfigMap YAML used to seed the worktree.
func cmManifest(name, color string) string {
	return "apiVersion: v1\nkind: ConfigMap\n" +
		"metadata:\n  name: " + name + "\n  namespace: default\n" +
		"data:\n  color: " + color + "\n"
}

// applyResyncViaWorktree drives the M8 resync apply for tests: it folds the desired
// snapshot over the worktree at base "" with the given mapper. A nil mapper makes the
// store structure-only (no resolved mappings), so no managed drop is ever planned.
func applyResyncViaWorktree(
	t *testing.T,
	writer *contentWriter,
	mapper typeset.Lookup,
	worktree *gogit.Worktree,
	desired ...manifestanalyzer.DesiredResource,
) (ResyncStats, bool) {
	t.Helper()
	w := &BranchWorker{contentWriter: writer, mapper: mapper}
	stats, changed, err := w.applyResyncToWorktree(
		context.Background(),
		worktree,
		"",
		ResolvedTargetMetadata{PruneMode: v1alpha3.PruneAlways},
		desired,
		nil,
	)
	require.NoError(t, err)
	return stats, changed
}

// A desired resource with no managed document in Git is created at its canonical
// placement path during resync.
func TestResync_CreatesMissingResource(t *testing.T) {
	writer := newContentWriter(types.SensitiveResourcePolicy{})
	worktree := newWorktreeForTest(t)
	root := worktree.Filesystem().Root()

	stats, changed := applyResyncViaWorktree(t, writer, configMapMapper(), worktree, desiredCM("api", "green"))
	require.True(t, changed, "a missing resource must be created")
	assert.Equal(t, 1, stats.Created)
	assert.Equal(t, 0, stats.Deleted)

	id := desiredCM("api", "green").Resource
	canonical := filepath.Join(root, writer.filePathForIdentifier(id))
	got, err := os.ReadFile(canonical)
	require.NoError(t, err)
	assert.Contains(t, string(got), "color: green")
}

// A managed document that differs from its desired resource is patched in place,
// preserving hand-authored formatting (the file-agnostic-placement guarantee).
func TestResync_UpdatesDriftedResourceInPlace(t *testing.T) {
	writer := newContentWriter(types.SensitiveResourcePolicy{})
	worktree := newWorktreeForTest(t)

	seeded := "apiVersion: v1\nkind: ConfigMap\n" +
		"metadata:\n  name: app\n  namespace: default\n" +
		"data:\n  # operator note kept across edits\n  color: blue\n"
	full := seedPlacedManifest(t, worktree, "apps/app.yaml", seeded)

	stats, changed := applyResyncViaWorktree(t, writer, configMapMapper(), worktree, desiredCM("app", "green"))
	require.True(t, changed, "a drifted resource must be updated")
	assert.Equal(t, 1, stats.Updated)
	assert.Equal(t, 0, stats.Created)
	assert.Equal(t, 0, stats.Deleted)

	got, err := os.ReadFile(full)
	require.NoError(t, err)
	assert.Contains(t, string(got), "color: green", "the field is rewritten")
	assert.Contains(t, string(got), "operator note kept", "the comment survives the in-place patch")
}

// A resync over a mirror already matching the cluster changes nothing and creates no
// commit-worthy diff.
func TestResync_InSyncResourceIsNoOp(t *testing.T) {
	writer := newContentWriter(types.SensitiveResourcePolicy{})
	worktree := newWorktreeForTest(t)
	seedPlacedManifest(t, worktree, "apps/app.yaml", cmManifest("app", "blue"))

	stats, changed := applyResyncViaWorktree(t, writer, configMapMapper(), worktree, desiredCM("app", "blue"))
	assert.False(t, changed, "an in-sync resource is not rewritten")
	assert.Zero(t, stats.Created)
	assert.Zero(t, stats.Updated)
	assert.Zero(t, stats.Deleted)
}

// The core M8 behavior: a watched, resolved managed document absent from the desired
// snapshot is a managed drop. Its file is deleted (mark-and-sweep).
func TestResync_DropsManagedResourceAbsentFromCluster(t *testing.T) {
	reader, err := telemetry.InitTestExporter()
	require.NoError(t, err)

	writer := newContentWriter(types.SensitiveResourcePolicy{})
	worktree := newWorktreeForTest(t)
	keepFull := seedPlacedManifest(t, worktree, "apps/keep.yaml", cmManifest("keep", "blue"))
	dropFull := seedPlacedManifest(t, worktree, "apps/drop.yaml", cmManifest("drop", "blue"))

	// Desired snapshot holds only "keep"; "drop" left the cluster.
	stats, changed := applyResyncViaWorktree(t, writer, configMapMapper(), worktree, desiredCM("keep", "blue"))
	require.True(t, changed, "the orphaned managed resource must be swept")
	assert.Equal(t, 1, stats.Deleted)

	_, keepErr := os.Stat(keepFull)
	require.NoError(t, keepErr, "the still-present resource is retained")
	_, dropErr := os.Stat(dropFull)
	assert.True(t, os.IsNotExist(dropErr), "the orphaned resource's file is deleted")

	count, ok := telemetry.CollectInt64Sum(reader, "gitopsreverser_resync_sweep_deletes_total",
		map[string]string{"group": "", "version": "v1", "resource": "configmaps"})
	require.True(t, ok)
	assert.Equal(t, int64(1), count)
}

// A manifest a human moved off its canonical path is still swept by content identity
// when it is absent from the cluster — the moved-manifest disease M8 cures: the sweep
// targets the document's real RecordRef, not a regenerated canonical path.
func TestResync_DropsMovedManifestByContentIdentity(t *testing.T) {
	writer := newContentWriter(types.SensitiveResourcePolicy{})
	worktree := newWorktreeForTest(t)
	movedFull := seedPlacedManifest(t, worktree, "legacy/moved.yaml", cmManifest("app", "blue"))

	stats, changed := applyResyncViaWorktree(t, writer, configMapMapper(), worktree)
	require.True(t, changed, "the moved orphan must be swept")
	assert.Equal(t, 1, stats.Deleted)
	_, statErr := os.Stat(movedFull)
	assert.True(t, os.IsNotExist(statErr), "the moved manifest is deleted at its real path, not orphaned")
}

// An empty desired snapshot (the cluster genuinely holds no watched resources) sweeps
// every managed resolved document — the authoritative "empty cluster, empty mirror".
func TestResync_EmptyClusterSweepsAllManaged(t *testing.T) {
	writer := newContentWriter(types.SensitiveResourcePolicy{})
	worktree := newWorktreeForTest(t)
	aFull := seedPlacedManifest(t, worktree, "apps/a.yaml", cmManifest("a", "x"))
	bFull := seedPlacedManifest(t, worktree, "apps/b.yaml", cmManifest("b", "y"))

	stats, changed := applyResyncViaWorktree(t, writer, configMapMapper(), worktree)
	require.True(t, changed)
	assert.Equal(t, 2, stats.Deleted)
	for _, full := range []string{aFull, bFull} {
		_, err := os.Stat(full)
		assert.True(t, os.IsNotExist(err), "every managed document is swept")
	}
}

// twoTypeMapper resolves both ConfigMap and Secret as served, allowed members, so a
// whole-folder sweep would drop either — isolating the scope as the only thing that
// protects the sibling type in the per-type sweep test.
func twoTypeMapper() typeset.Lookup {
	return typeset.NewSnapshotRegistry(typeset.Snapshot{Entries: []typeset.Entry{
		{
			GVK:        schema.GroupVersionKind{Group: "", Version: "v1", Kind: "ConfigMap"},
			GVR:        schema.GroupVersionResource{Group: "", Version: "v1", Resource: "configmaps"},
			Namespaced: true, Allowed: true,
		},
		{
			GVK:        schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Secret"},
			GVR:        schema.GroupVersionResource{Group: "", Version: "v1", Resource: "secrets"},
			Namespaced: true, Allowed: true,
		},
	}})
}

// secretManifest renders a plain (unencrypted) Secret used only to prove a per-type sweep
// leaves a sibling type alone; it is never upserted, so no encryption is involved.
func secretManifest(name string) string {
	return "apiVersion: v1\nkind: Secret\n" +
		"metadata:\n  name: " + name + "\n  namespace: default\n" +
		"data:\n  k: dg==\n"
}

// The M12 per-type sweep: a scoped resync with an empty desired set drops only the
// removed type's documents and leaves every sibling type exactly as Git holds it — even
// though under a whole-folder resync the sibling would also be an orphan.
func TestResync_ScopedSweepDropsOnlyTargetType(t *testing.T) {
	writer := newContentWriter(types.SensitiveResourcePolicy{})
	worktree := newWorktreeForTest(t)
	cmFull := seedPlacedManifest(t, worktree, "apps/cm.yaml", cmManifest("cfg", "blue"))
	secretFull := seedPlacedManifest(t, worktree, "apps/secret.yaml", secretManifest("sec"))

	w := &BranchWorker{contentWriter: writer, mapper: twoTypeMapper()}
	scope := &ResyncScope{GVR: schema.GroupVersionResource{Group: "", Version: "v1", Resource: "configmaps"}}
	stats, changed, err := w.applyResyncToWorktree(
		context.Background(),
		worktree,
		"",
		ResolvedTargetMetadata{PruneMode: v1alpha3.PruneAlways},
		nil,
		scope,
	)
	require.NoError(t, err)
	require.True(t, changed, "the removed type's document is swept")
	assert.Equal(t, 1, stats.Deleted, "exactly the configmap is swept, not the secret")

	_, cmErr := os.Stat(cmFull)
	assert.True(t, os.IsNotExist(cmErr), "the removed type's document is deleted")
	_, secErr := os.Stat(secretFull)
	assert.NoError(t, secErr, "a sibling type's document is never touched by a per-type sweep")
}

// Without a mapper the store is structure-only: no document resolves to a watched
// resource, so an empty desired snapshot sweeps nothing. This preserves the no-cluster
// safety promise — a resync can never drop what it could not classify as watched.
func TestResync_StructureOnlyNeverDrops(t *testing.T) {
	writer := newContentWriter(types.SensitiveResourcePolicy{})
	worktree := newWorktreeForTest(t)
	full := seedPlacedManifest(t, worktree, "apps/app.yaml", cmManifest("app", "blue"))

	stats, changed := applyResyncViaWorktree(t, writer, nil, worktree)
	assert.False(t, changed, "a structure-only resync drops nothing")
	assert.Zero(t, stats.Deleted)
	_, err := os.Stat(full)
	assert.NoError(t, err, "the unclassified document is left in place")
}

// One resync folds creates, in-place updates, and managed drops together over the same
// content-derived store, and reports each in its stats.
func TestResync_FoldsCreateUpdateDropTogether(t *testing.T) {
	writer := newContentWriter(types.SensitiveResourcePolicy{})
	worktree := newWorktreeForTest(t)
	root := worktree.Filesystem().Root()
	keepFull := seedPlacedManifest(t, worktree, "apps/keep.yaml", cmManifest("keep", "blue"))
	dropFull := seedPlacedManifest(t, worktree, "apps/drop.yaml", cmManifest("drop", "blue"))

	stats, changed := applyResyncViaWorktree(t, writer, configMapMapper(), worktree,
		desiredCM("keep", "green"), // drift -> update
		desiredCM("fresh", "red"),  // missing -> create
		// "drop" omitted -> managed drop
	)
	require.True(t, changed)
	assert.Equal(t, 1, stats.Created, "fresh is created")
	assert.Equal(t, 1, stats.Updated, "keep is updated")
	assert.Equal(t, 1, stats.Deleted, "drop is swept")

	keep, err := os.ReadFile(keepFull)
	require.NoError(t, err)
	assert.Contains(t, string(keep), "color: green")

	_, dropErr := os.Stat(dropFull)
	assert.True(t, os.IsNotExist(dropErr))

	// Placement: the existing ConfigMaps under apps/ do not decide where a genuinely new
	// one goes. With no declared policy and no kustomize root, the create lands at the
	// canonical path — the same answer the live-event path gives, which is the point: a
	// resync must not place a resource anywhere a steady-state create would not.
	_, siblingErr := os.Stat(filepath.Join(root, "apps", "fresh.yaml"))
	assert.True(t, os.IsNotExist(siblingErr), "apps/ is not inferred from the siblings")
	_, freshErr := os.Stat(filepath.Join(root, "default", "configmaps", "fresh.yaml"))
	assert.NoError(t, freshErr, "the created resource lands at the canonical path")
}

// A fail-safe placement refusal during resync is counted in PlacementSkipped, not
// silently swallowed between Created and the planner's Skipped view. Here a bundling
// default routes both a Secret and a ConfigMap in the same namespace to one cold
// "all.yaml"; the writer refuses to co-mingle encrypted and plaintext documents, so
// one of the two is skipped fail-safe — and that skip must show up in the stats.
func TestResync_UnsafePlacementCountsAsPlacementSkipped(t *testing.T) {
	enc := &stubEncryptor{result: []byte(
		"apiVersion: v1\nkind: Secret\nmetadata:\n  name: cred\n  namespace: app\n" +
			"data:\n  k: ENC[AES256,data:x,iv:y,tag:z]\nsops:\n  version: 3.9.0\n")}
	writer := newContentWriter(types.SensitiveResourcePolicy{})
	writer.setEncryptor(enc, "test-scope")
	worktree := newWorktreeForTest(t)

	policy := &manifestanalyzer.PlacementPolicy{Default: "all.yaml"}
	desired := []manifestanalyzer.DesiredResource{
		{
			Resource: types.NewResourceIdentifier("", "v1", "secrets", "app", "cred"),
			Object: &unstructured.Unstructured{Object: map[string]interface{}{
				"apiVersion": "v1", "kind": "Secret",
				"metadata": map[string]interface{}{"name": "cred", "namespace": "app"},
			}},
		},
		{
			Resource: types.NewResourceIdentifier("", "v1", "configmaps", "app", "cache"),
			Object: &unstructured.Unstructured{Object: map[string]interface{}{
				"apiVersion": "v1", "kind": "ConfigMap",
				"metadata": map[string]interface{}{"name": "cache", "namespace": "app"},
			}},
		},
	}

	w := &BranchWorker{contentWriter: writer, mapper: twoTypeMapper()}
	stats, _, err := w.applyResyncToWorktree(
		context.Background(),
		worktree,
		"",
		ResolvedTargetMetadata{Placement: policy, PruneMode: v1alpha3.PruneAlways},
		desired,
		nil,
	)
	require.NoError(t, err)

	assert.Equal(t, 1, stats.PlacementSkipped,
		"the resource refused fail-safe to avoid co-mingling must be counted, not vanish")
	assert.Equal(t, 1, stats.Created, "the other resource is still written")
}

// A sensitive (SOPS) resource that the resync re-encrypts is counted as Updated, not
// Skipped. The planner marks an encrypted document PlanSkip (it cannot patch it in
// place), but applyUpsert re-encrypts and commits it — so stats must come from the
// actual apply, or status would report a real Secret update as skipped and the commit
// message count would omit it.
func TestResync_SensitiveUpdateCountsAsUpdatedNotSkipped(t *testing.T) {
	enc := &stubEncryptor{result: []byte(
		"apiVersion: v1\nkind: Secret\nmetadata:\n  name: app\n  namespace: default\n" +
			"data:\n  k: ENC[AES256,data:NEW,iv:cc,tag:dd]\nsops:\n  version: 3.9.0\n  mac: NEW\n")}
	writer := newContentWriter(types.SensitiveResourcePolicy{})
	writer.setEncryptor(enc, "test-scope")
	worktree := newWorktreeForTest(t)

	// An already-encrypted Secret in Git whose encrypted bytes differ from the new render.
	seeded := "apiVersion: v1\nkind: Secret\nmetadata:\n  name: app\n  namespace: default\n" +
		"data:\n  k: ENC[AES256,data:OLD,iv:aa,tag:bb]\nsops:\n  version: 3.9.0\n  mac: OLD\n"
	full := seedPlacedManifest(t, worktree, "secrets/app.sops.yaml", seeded)

	secretsMapper := typeset.NewSnapshotRegistry(typeset.Snapshot{Entries: []typeset.Entry{{
		GVK:        schema.GroupVersionKind{Group: "", Version: "v1", Kind: "Secret"},
		GVR:        schema.GroupVersionResource{Group: "", Version: "v1", Resource: "secrets"},
		Namespaced: true,
		Allowed:    true,
	}}})
	desired := manifestanalyzer.DesiredResource{
		Resource: types.ResourceIdentifier{
			Group: "", Version: "v1", Resource: "secrets", Namespace: "default", Name: "app",
		},
		Object: &unstructured.Unstructured{Object: map[string]interface{}{
			"apiVersion": "v1",
			"kind":       "Secret",
			"metadata":   map[string]interface{}{"name": "app", "namespace": "default"},
			"data":       map[string]interface{}{"k": "dg=="},
		}},
	}

	w := &BranchWorker{contentWriter: writer, mapper: secretsMapper}
	stats, changed, err := w.applyResyncToWorktree(
		context.Background(),
		worktree,
		"",
		ResolvedTargetMetadata{PruneMode: v1alpha3.PruneAlways},
		[]manifestanalyzer.DesiredResource{desired},
		nil,
	)
	require.NoError(t, err)
	require.True(t, changed, "the secret is re-encrypted")
	assert.Equal(t, 1, stats.Updated, "a re-encrypted sensitive resource is Updated, not Skipped")
	assert.Zero(t, stats.Created)
	assert.Zero(t, stats.Deleted)

	got, err := os.ReadFile(full)
	require.NoError(t, err)
	assert.Equal(t, string(enc.result), string(got), "the secret is re-encrypted in place")
}

// Sweeping one document from a multi-document file removes only that document and keeps
// the file when a managed sibling survives.
func TestResync_DropsOneDocFromMultiDocKeepsSiblings(t *testing.T) {
	writer := newContentWriter(types.SensitiveResourcePolicy{})
	worktree := newWorktreeForTest(t)
	root := worktree.Filesystem().Root()
	rel := "apps/multi.yaml"
	full := filepath.Join(root, rel)
	seedPlacedManifest(t, worktree, rel, cmManifest("keep", "blue")+"---\n"+cmManifest("drop", "blue"))

	stats, changed := applyResyncViaWorktree(t, writer, configMapMapper(), worktree, desiredCM("keep", "blue"))
	require.True(t, changed)
	assert.Equal(t, 1, stats.Deleted)

	got, err := os.ReadFile(full)
	require.NoError(t, err)
	assert.Contains(t, string(got), "name: keep", "the surviving managed sibling is kept")
	assert.NotContains(t, string(got), "name: drop", "the orphaned document is removed")
}