package permissions

import (
	"bytes"
	"context"
	"encoding/json"
	"fmt"
	"reflect"
	"sort"
	"strings"
	"testing"

	"github.com/nexuscrm/shared/pkg/constants"
	cp "github.com/pingcap-inc/nexuscrm-contract/pkg/controlplane"
)

func TestPermissionSetDefinitionLifecycleCreateNoopAndFreshProjection(t *testing.T) {
	_, lifecycle, err := NewPermissionSetDefinitionManagedLifecycleRegistration()
	if err != nil {
		t.Fatal(err)
	}
	request := permissionSetDefinitionManagedRequestForTest(t, "exact_match")
	lifecycleRequest := cp.NewComponentManagedItemLifecycleRequest(request)
	store := newPermissionSetDefinitionLifecycleMemoryStore()

	plan, err := lifecycle.Lifecycle().Plan(context.Background(), cp.ComponentManagedScopeItem, lifecycleRequest, store)
	if err != nil {
		t.Fatal(err)
	}
	if len(plan.Targets()) != 2 ||
		plan.Estimate().DesiredItems != 6 ||
		plan.Estimate().DeltaRows != 6 ||
		len(plan.Effects()) != 1 {
		t.Fatalf("create plan = targets %v, estimate %#v, effects %#v", plan.Targets(), plan.Estimate(), plan.Effects())
	}
	result, err := lifecycle.Lifecycle().Mutate(context.Background(), cp.ComponentManagedScopeItem, lifecycleRequest, plan, store)
	if err != nil {
		t.Fatal(err)
	}
	if result.Disposition != cp.ComponentManagedMutationDesiredProjectionStaged {
		t.Fatalf("create disposition = %q", result.Disposition)
	}
	if len(store.locks) == 0 || store.locks[0].Table != "_System_CustomPermission" {
		t.Fatalf("create mutate lock order = %#v, want _System_CustomPermission first", store.locks)
	}
	projection, err := lifecycle.Lifecycle().Project(context.Background(), cp.ComponentManagedScopeItem, lifecycleRequest, store)
	if err != nil {
		t.Fatal(err)
	}
	if !bytes.Equal(projection.Expected, projection.Live) {
		t.Fatalf("fresh projection differs:\n%s\n%s", projection.Expected, projection.Live)
	}

	store.resetMutations()
	plan, err = lifecycle.Lifecycle().Plan(context.Background(), cp.ComponentManagedScopeItem, lifecycleRequest, store)
	if err != nil {
		t.Fatal(err)
	}
	result, err = lifecycle.Lifecycle().Mutate(context.Background(), cp.ComponentManagedScopeItem, lifecycleRequest, plan, store)
	if err != nil {
		t.Fatal(err)
	}
	if result.Disposition != cp.ComponentManagedMutationNoChange ||
		len(store.inserts)+len(store.updates)+len(store.deletes) != 0 {
		t.Fatalf("no-op disposition/mutations = %q/%d", result.Disposition, len(store.inserts)+len(store.updates)+len(store.deletes))
	}
}

func TestPermissionSetDefinitionLifecycleAcceptsHistoricalSimpleFieldNames(t *testing.T) {
	_, lifecycle, err := NewPermissionSetDefinitionManagedLifecycleRegistration()
	if err != nil {
		t.Fatal(err)
	}
	request := cp.NewComponentManagedItemLifecycleRequest(
		permissionSetDefinitionManagedRequestForTest(t, ""),
	)
	store := newPermissionSetDefinitionLifecycleMemoryStore()
	createPlan, err := lifecycle.Lifecycle().Plan(
		context.Background(),
		cp.ComponentManagedScopeItem,
		request,
		store,
	)
	if err != nil {
		t.Fatal(err)
	}
	if _, err := lifecycle.Lifecycle().Mutate(
		context.Background(),
		cp.ComponentManagedScopeItem,
		request,
		createPlan,
		store,
	); err != nil {
		t.Fatal(err)
	}
	if got := store.rows["FieldPermissions"][0]["Field"]; got != "Account.Name" {
		t.Fatalf("created FieldPermissions.Field = %v, want Account.Name", got)
	}

	store.rows["FieldPermissions"][0]["Field"] = "Name"
	store.resetMutations()
	plan, err := lifecycle.Lifecycle().Plan(
		context.Background(),
		cp.ComponentManagedScopeItem,
		request,
		store,
	)
	if err != nil {
		t.Fatalf("historical simple Field plan failed: %v", err)
	}
	result, err := lifecycle.Lifecycle().Mutate(
		context.Background(),
		cp.ComponentManagedScopeItem,
		request,
		plan,
		store,
	)
	if err != nil {
		t.Fatalf("historical simple Field mutation failed: %v", err)
	}
	if result.Disposition != cp.ComponentManagedMutationNoChange ||
		len(store.inserts)+len(store.updates)+len(store.deletes) != 0 {
		t.Fatalf(
			"historical simple Field reapply = %q, mutations %d",
			result.Disposition,
			len(store.inserts)+len(store.updates)+len(store.deletes),
		)
	}
	projection, err := lifecycle.Lifecycle().Project(
		context.Background(),
		cp.ComponentManagedScopeItem,
		request,
		store,
	)
	if err != nil {
		t.Fatalf("historical simple Field projection failed: %v", err)
	}
	if !bytes.Equal(projection.Expected, projection.Live) {
		t.Fatalf("historical simple Field projection differs:\n%s\n%s", projection.Expected, projection.Live)
	}

	store.rows["PermissionSet"][0]["OwnerPack"] = nil
	store.resetMutations()
	adoptRequest := cp.NewComponentManagedItemLifecycleRequest(
		permissionSetDefinitionManagedRequestForTest(t, "exact_match"),
	)
	adoptPlan, err := lifecycle.Lifecycle().Plan(
		context.Background(),
		cp.ComponentManagedScopeItem,
		adoptRequest,
		store,
	)
	if err != nil {
		t.Fatalf("historical simple Field adoption plan failed: %v", err)
	}
	adoptResult, err := lifecycle.Lifecycle().Mutate(
		context.Background(),
		cp.ComponentManagedScopeItem,
		adoptRequest,
		adoptPlan,
		store,
	)
	if err != nil {
		t.Fatalf("historical simple Field adoption failed: %v", err)
	}
	if adoptResult.Disposition != cp.ComponentManagedMutationSafeProjectionStaged ||
		len(store.updates) != 1 ||
		store.updates[0].Table != "PermissionSet" ||
		store.updates[0].Values["OwnerPack"] != "sales" {
		t.Fatalf(
			"historical simple Field adoption = %q, updates %#v",
			adoptResult.Disposition,
			store.updates,
		)
	}
}

func TestPermissionSetDefinitionLifecycleAdoptsOnlyAnExactUnassignedDefinition(t *testing.T) {
	_, lifecycle, err := NewPermissionSetDefinitionManagedLifecycleRegistration()
	if err != nil {
		t.Fatal(err)
	}
	request := permissionSetDefinitionManagedRequestForTest(t, "exact_match")
	lifecycleRequest := cp.NewComponentManagedItemLifecycleRequest(request)
	store := newPermissionSetDefinitionLifecycleMemoryStore()
	createdPlan, err := lifecycle.Lifecycle().Plan(context.Background(), cp.ComponentManagedScopeItem, lifecycleRequest, store)
	if err != nil {
		t.Fatal(err)
	}
	if _, err := lifecycle.Lifecycle().Mutate(context.Background(), cp.ComponentManagedScopeItem, lifecycleRequest, createdPlan, store); err != nil {
		t.Fatal(err)
	}
	store.rows["PermissionSet"][0]["OwnerPack"] = nil
	store.resetMutations()

	adoptPlan, err := lifecycle.Lifecycle().Plan(context.Background(), cp.ComponentManagedScopeItem, lifecycleRequest, store)
	if err != nil {
		t.Fatal(err)
	}
	result, err := lifecycle.Lifecycle().Mutate(context.Background(), cp.ComponentManagedScopeItem, lifecycleRequest, adoptPlan, store)
	if err != nil {
		t.Fatal(err)
	}
	if result.Disposition != cp.ComponentManagedMutationSafeProjectionStaged ||
		len(store.updates) != 1 ||
		store.updates[0].Table != "PermissionSet" ||
		store.updates[0].Values["OwnerPack"] != "sales" ||
		len(store.inserts)+len(store.deletes) != 0 {
		t.Fatalf("adoption disposition/mutations = %q/%#v/%#v/%#v", result.Disposition, store.inserts, store.updates, store.deletes)
	}

	store.rows["PermissionSet"][0]["OwnerPack"] = nil
	store.rows["PermissionSetAssignment"] = []cp.ComponentRow{{
		"Id": "assignment-1", "PermissionSetId": store.rows["PermissionSet"][0]["Id"], "IsDeleted": false,
	}}
	if _, err := lifecycle.Lifecycle().Plan(context.Background(), cp.ComponentManagedScopeItem, lifecycleRequest, store); err == nil ||
		!strings.Contains(err.Error(), "assignment") {
		t.Fatalf("assigned adoption error = %v", err)
	}
	store.rows["PermissionSetAssignment"] = nil
	withoutAdoption := permissionSetDefinitionManagedRequestForTest(t, "")
	if _, err := lifecycle.Lifecycle().Plan(
		context.Background(),
		cp.ComponentManagedScopeItem,
		cp.NewComponentManagedItemLifecycleRequest(withoutAdoption),
		store,
	); err == nil || !strings.Contains(err.Error(), "adoptionMode exact_match") {
		t.Fatalf("implicit adoption error = %v", err)
	}
}

func TestPermissionSetDefinitionLifecycleIgnoresAssignmentVolumeForManagedReapply(t *testing.T) {
	_, lifecycle, err := NewPermissionSetDefinitionManagedLifecycleRegistration()
	if err != nil {
		t.Fatal(err)
	}
	for _, test := range []struct {
		name    string
		deleted bool
	}{
		{name: "active assignments", deleted: false},
		{name: "deleted assignment history", deleted: true},
	} {
		t.Run(test.name, func(t *testing.T) {
			request := permissionSetDefinitionManagedRequestForTest(t, "exact_match")
			itemRequest := cp.NewComponentManagedItemLifecycleRequest(request)
			store := newPermissionSetDefinitionLifecycleMemoryStore()
			createPlan, err := lifecycle.Lifecycle().Plan(
				context.Background(),
				cp.ComponentManagedScopeItem,
				itemRequest,
				store,
			)
			if err != nil {
				t.Fatal(err)
			}
			if _, err := lifecycle.Lifecycle().Mutate(
				context.Background(),
				cp.ComponentManagedScopeItem,
				itemRequest,
				createPlan,
				store,
			); err != nil {
				t.Fatal(err)
			}
			rootID := store.rows["PermissionSet"][0]["Id"]
			for index := 0; index <= permissionSetDefinitionManagedMaximumRows; index++ {
				store.rows["PermissionSetAssignment"] = append(store.rows["PermissionSetAssignment"], cp.ComponentRow{
					"Id":              fmt.Sprintf("assignment-%03d", index),
					"PermissionSetId": rootID,
					"IsDeleted":       test.deleted,
				})
			}
			plan, err := lifecycle.Lifecycle().Plan(
				context.Background(),
				cp.ComponentManagedScopeItem,
				itemRequest,
				store,
			)
			if err != nil {
				t.Fatalf("managed reapply plan failed: %v", err)
			}
			result, err := lifecycle.Lifecycle().Mutate(
				context.Background(),
				cp.ComponentManagedScopeItem,
				itemRequest,
				plan,
				store,
			)
			if err != nil {
				t.Fatalf("managed reapply mutation failed: %v", err)
			}
			if result.Disposition != cp.ComponentManagedMutationNoChange {
				t.Fatalf("managed reapply disposition = %q", result.Disposition)
			}
			projection, err := lifecycle.Lifecycle().Project(
				context.Background(),
				cp.ComponentManagedScopeItem,
				itemRequest,
				store,
			)
			if err != nil {
				t.Fatalf("managed reapply projection failed: %v", err)
			}
			if !bytes.Equal(projection.Expected, projection.Live) {
				t.Fatalf("managed reapply projection differs: %s / %s", projection.Expected, projection.Live)
			}
			if test.deleted {
				return
			}
			store.rows["PermissionSet"][0]["OwnerPack"] = nil
			if _, err := lifecycle.Lifecycle().Plan(
				context.Background(),
				cp.ComponentManagedScopeItem,
				itemRequest,
				store,
			); err == nil || !strings.Contains(err.Error(), "active assignment") {
				t.Fatalf("assigned adoption error = %v", err)
			}
			store.rows["PermissionSet"][0]["OwnerPack"] = "sales"
			setRequest, err := cp.NewComponentManagedSetLifecycleRequest(cp.ComponentManagedSetRequest{
				PackName: "sales",
				Kind:     permissionSetDefinitionComponentKind,
			}, nil)
			if err != nil {
				t.Fatal(err)
			}
			if _, err := lifecycle.Lifecycle().Plan(
				context.Background(),
				cp.ComponentManagedScopeSet,
				setRequest,
				store,
			); err == nil || !strings.Contains(err.Error(), "active assignment") {
				t.Fatalf("assigned retirement error = %v", err)
			}
		})
	}
}

func TestPermissionSetDefinitionLifecycleRepairsCanonicalCaseAndSoftDeleteDrift(t *testing.T) {
	_, lifecycle, err := NewPermissionSetDefinitionManagedLifecycleRegistration()
	if err != nil {
		t.Fatal(err)
	}
	request := permissionSetDefinitionManagedRequestForTest(t, "")
	lifecycleRequest := cp.NewComponentManagedItemLifecycleRequest(request)
	store := newPermissionSetDefinitionLifecycleMemoryStore()
	plan, err := lifecycle.Lifecycle().Plan(context.Background(), cp.ComponentManagedScopeItem, lifecycleRequest, store)
	if err != nil {
		t.Fatal(err)
	}
	if _, err := lifecycle.Lifecycle().Mutate(context.Background(), cp.ComponentManagedScopeItem, lifecycleRequest, plan, store); err != nil {
		t.Fatal(err)
	}
	store.rows["PermissionSet"][0]["Name"] = "sales_operator"
	store.rows["_System_PermissionSetPermission"][0]["PermissionApiName"] = "apienabled"
	store.rows["ObjectPermissions"][0]["IsDeleted"] = true
	store.resetMutations()

	repairPlan, err := lifecycle.Lifecycle().Plan(context.Background(), cp.ComponentManagedScopeItem, lifecycleRequest, store)
	if err != nil {
		t.Fatal(err)
	}
	result, err := lifecycle.Lifecycle().Mutate(context.Background(), cp.ComponentManagedScopeItem, lifecycleRequest, repairPlan, store)
	if err != nil {
		t.Fatal(err)
	}
	if result.Disposition != cp.ComponentManagedMutationDesiredProjectionStaged {
		t.Fatalf("repair disposition = %q", result.Disposition)
	}
	projection, err := lifecycle.Lifecycle().Project(context.Background(), cp.ComponentManagedScopeItem, lifecycleRequest, store)
	if err != nil {
		t.Fatal(err)
	}
	if !bytes.Equal(projection.Expected, projection.Live) {
		t.Fatalf("repaired projection differs:\n%s\n%s", projection.Expected, projection.Live)
	}
}

func TestPermissionSetDefinitionLifecycleRejectsNegativeEdgesAndAssignedRetirement(t *testing.T) {
	_, lifecycle, err := NewPermissionSetDefinitionManagedLifecycleRegistration()
	if err != nil {
		t.Fatal(err)
	}
	request := permissionSetDefinitionManagedRequestForTest(t, "")
	itemRequest := cp.NewComponentManagedItemLifecycleRequest(request)
	store := newPermissionSetDefinitionLifecycleMemoryStore()
	plan, err := lifecycle.Lifecycle().Plan(context.Background(), cp.ComponentManagedScopeItem, itemRequest, store)
	if err != nil {
		t.Fatal(err)
	}
	if _, err := lifecycle.Lifecycle().Mutate(context.Background(), cp.ComponentManagedScopeItem, itemRequest, plan, store); err != nil {
		t.Fatal(err)
	}
	rootID := store.rows["PermissionSet"][0]["Id"]
	store.rows["PermissionSetTabSetting"] = []cp.ComponentRow{{
		"Id": "tab-setting-1", "PermissionSetId": rootID,
	}}
	if _, err := lifecycle.Lifecycle().Plan(context.Background(), cp.ComponentManagedScopeItem, itemRequest, store); err == nil ||
		!strings.Contains(err.Error(), "PermissionSetTabSetting") {
		t.Fatalf("negative-edge plan error = %v", err)
	}
	store.rows["PermissionSetTabSetting"] = nil
	store.rows["_System_PermissionSetAssignmentPolicyClaim"] = []cp.ComponentRow{{
		"Id": "policy-claim-1", "PermissionSetId": rootID,
	}}
	if _, err := lifecycle.Lifecycle().Plan(context.Background(), cp.ComponentManagedScopeItem, itemRequest, store); err != nil {
		t.Fatalf("retained claimed definition plan: %v", err)
	}
	claimedSetRequest, err := cp.NewComponentManagedSetLifecycleRequest(cp.ComponentManagedSetRequest{
		PackName: "sales",
		Kind:     permissionSetDefinitionComponentKind,
	}, nil)
	if err != nil {
		t.Fatal(err)
	}
	if _, err := lifecycle.Lifecycle().Plan(context.Background(), cp.ComponentManagedScopeSet, claimedSetRequest, store); err == nil ||
		!strings.Contains(err.Error(), "assignment policy claim") {
		t.Fatalf("claimed retirement error = %v", err)
	}
	store.rows["_System_PermissionSetAssignmentPolicyClaim"] = nil
	store.rows["PermissionSetAssignment"] = []cp.ComponentRow{{
		"Id": "assignment-1", "PermissionSetId": rootID, "IsDeleted": false,
	}}
	setRequest, err := cp.NewComponentManagedSetLifecycleRequest(cp.ComponentManagedSetRequest{
		PackName: "sales",
		Kind:     permissionSetDefinitionComponentKind,
	}, nil)
	if err != nil {
		t.Fatal(err)
	}
	if _, err := lifecycle.Lifecycle().Plan(context.Background(), cp.ComponentManagedScopeSet, setRequest, store); err == nil ||
		!strings.Contains(err.Error(), "assignment") {
		t.Fatalf("assigned retirement error = %v", err)
	}
}

func TestPermissionSetDefinitionLifecycleRechecksClaimBeforeRetirementMutation(t *testing.T) {
	_, lifecycle, err := NewPermissionSetDefinitionManagedLifecycleRegistration()
	if err != nil {
		t.Fatal(err)
	}
	itemRequest := cp.NewComponentManagedItemLifecycleRequest(
		permissionSetDefinitionManagedRequestForTest(t, ""),
	)
	store := newPermissionSetDefinitionLifecycleMemoryStore()
	itemPlan, err := lifecycle.Lifecycle().Plan(
		context.Background(), cp.ComponentManagedScopeItem, itemRequest, store,
	)
	if err != nil {
		t.Fatal(err)
	}
	if _, err := lifecycle.Lifecycle().Mutate(
		context.Background(), cp.ComponentManagedScopeItem, itemRequest, itemPlan, store,
	); err != nil {
		t.Fatal(err)
	}
	setRequest, err := cp.NewComponentManagedSetLifecycleRequest(cp.ComponentManagedSetRequest{
		PackName: "sales",
		Kind:     permissionSetDefinitionComponentKind,
	}, nil)
	if err != nil {
		t.Fatal(err)
	}
	retirePlan, err := lifecycle.Lifecycle().Plan(
		context.Background(), cp.ComponentManagedScopeSet, setRequest, store,
	)
	if err != nil {
		t.Fatal(err)
	}
	rootID := store.rows["PermissionSet"][0]["Id"]
	store.rows["_System_PermissionSetAssignmentPolicyClaim"] = []cp.ComponentRow{{
		"Id": "policy-claim-1", "PermissionSetId": rootID,
	}}

	if _, err := lifecycle.Lifecycle().Mutate(
		context.Background(), cp.ComponentManagedScopeSet, setRequest, retirePlan, store,
	); err == nil || !strings.Contains(err.Error(), "cannot retire while an assignment policy claim exists") {
		t.Fatalf("locked claimed retirement error = %v", err)
	}
}

func TestPermissionSetDefinitionLifecycleRejectsParentControlledObjectGrant(t *testing.T) {
	_, lifecycle, err := NewPermissionSetDefinitionManagedLifecycleRegistration()
	if err != nil {
		t.Fatal(err)
	}
	request := permissionSetDefinitionManagedRequestForTest(t, "")
	store := newPermissionSetDefinitionLifecycleMemoryStore()
	store.rows["_System_Object"][0]["SharingModel"] = string(constants.SharingModelControlledByParent)
	if _, err := lifecycle.Lifecycle().Plan(
		context.Background(),
		cp.ComponentManagedScopeItem,
		cp.NewComponentManagedItemLifecycleRequest(request),
		store,
	); err == nil || !strings.Contains(err.Error(), "parent-controlled") {
		t.Fatalf("parent-controlled object plan error = %v", err)
	}
	if _, err := resolvePermissionSetDefinitionDependencies(
		context.Background(),
		store,
		permissionSetDefinitionProjection{
			FieldPermissions: []permissionSetDefinitionFieldGrant{{
				Object: "Account",
				Field:  "Name",
				Read:   true,
			}},
		},
		false,
	); err != nil {
		t.Fatalf("parent-controlled field-only dependency resolution failed: %v", err)
	}
}

func TestPermissionSetDefinitionLifecycleRetiresAndRestoresStableRoot(t *testing.T) {
	_, lifecycle, err := NewPermissionSetDefinitionManagedLifecycleRegistration()
	if err != nil {
		t.Fatal(err)
	}
	request := permissionSetDefinitionManagedRequestForTest(t, "")
	itemRequest := cp.NewComponentManagedItemLifecycleRequest(request)
	store := newPermissionSetDefinitionLifecycleMemoryStore()
	plan, err := lifecycle.Lifecycle().Plan(context.Background(), cp.ComponentManagedScopeItem, itemRequest, store)
	if err != nil {
		t.Fatal(err)
	}
	if _, err := lifecycle.Lifecycle().Mutate(context.Background(), cp.ComponentManagedScopeItem, itemRequest, plan, store); err != nil {
		t.Fatal(err)
	}
	rootID := store.rows["PermissionSet"][0]["Id"]
	setRequest, err := cp.NewComponentManagedSetLifecycleRequest(cp.ComponentManagedSetRequest{
		PackName: "sales",
		Kind:     permissionSetDefinitionComponentKind,
	}, nil)
	if err != nil {
		t.Fatal(err)
	}
	retirePlan, err := lifecycle.Lifecycle().Plan(context.Background(), cp.ComponentManagedScopeSet, setRequest, store)
	if err != nil {
		t.Fatal(err)
	}
	result, err := lifecycle.Lifecycle().Mutate(context.Background(), cp.ComponentManagedScopeSet, setRequest, retirePlan, store)
	if err != nil {
		t.Fatal(err)
	}
	root := store.rows["PermissionSet"][0]
	if result.Disposition != cp.ComponentManagedMutationDesiredProjectionStaged ||
		root["Id"] != rootID ||
		root["IsActive"] != false ||
		root["IsDeleted"] != true ||
		len(store.rows["_System_PermissionSetPermission"]) != 0 ||
		len(store.rows["PermissionSetCustomPermission"]) != 0 ||
		!permissionSetDefinitionAllRowsDeleted(store.rows["ObjectPermissions"]) ||
		!permissionSetDefinitionAllRowsDeleted(store.rows["FieldPermissions"]) {
		t.Fatalf("retired state = disposition %q, root %#v, rows %#v", result.Disposition, root, store.rows)
	}
	setProjection, err := lifecycle.Lifecycle().Project(context.Background(), cp.ComponentManagedScopeSet, setRequest, store)
	if err != nil {
		t.Fatal(err)
	}
	if !bytes.Equal(setProjection.Expected, setProjection.Live) {
		t.Fatalf("retired set projection differs: %s / %s", setProjection.Expected, setProjection.Live)
	}

	restorePlan, err := lifecycle.Lifecycle().Plan(context.Background(), cp.ComponentManagedScopeItem, itemRequest, store)
	if err != nil {
		t.Fatal(err)
	}
	restoreSetRequest, err := cp.NewComponentManagedSetLifecycleRequest(cp.ComponentManagedSetRequest{
		PackName: "sales",
		Kind:     permissionSetDefinitionComponentKind,
	}, []string{"Sales_Operator"})
	if err != nil {
		t.Fatal(err)
	}
	restoreSetPlan, err := lifecycle.Lifecycle().Plan(
		context.Background(),
		cp.ComponentManagedScopeSet,
		restoreSetRequest,
		store,
	)
	if err != nil {
		t.Fatalf("set preflight rejected same-owner restore: %v", err)
	}
	if _, err := lifecycle.Lifecycle().Mutate(context.Background(), cp.ComponentManagedScopeItem, itemRequest, restorePlan, store); err != nil {
		t.Fatal(err)
	}
	if _, err := lifecycle.Lifecycle().Mutate(
		context.Background(),
		cp.ComponentManagedScopeSet,
		restoreSetRequest,
		restoreSetPlan,
		store,
	); err != nil {
		t.Fatal(err)
	}
	if store.rows["PermissionSet"][0]["Id"] != rootID {
		t.Fatalf("restore replaced stable root ID: %#v", store.rows["PermissionSet"][0])
	}
	projection, err := lifecycle.Lifecycle().Project(context.Background(), cp.ComponentManagedScopeItem, itemRequest, store)
	if err != nil {
		t.Fatal(err)
	}
	if !bytes.Equal(projection.Expected, projection.Live) {
		t.Fatalf("restored projection differs:\n%s\n%s", projection.Expected, projection.Live)
	}
}

func TestPermissionSetDefinitionLifecycleSetValidatesRetainedRootsBeforeRetirement(t *testing.T) {
	_, lifecycle, err := NewPermissionSetDefinitionManagedLifecycleRegistration()
	if err != nil {
		t.Fatal(err)
	}
	newStore := func() *permissionSetDefinitionLifecycleMemoryStore {
		store := newPermissionSetDefinitionLifecycleMemoryStore()
		store.rows["PermissionSet"] = []cp.ComponentRow{
			{
				"Id":               "permission-set-retained",
				"Name":             "Retained_Set",
				"Label":            "Retained Set",
				"Description":      nil,
				"IsActive":         true,
				"IsCustom":         true,
				"IsDeleted":        false,
				"ProfileId":        nil,
				"IsOwnedByProfile": false,
				"OwnerPack":        "sales",
			},
			{
				"Id":               "permission-set-stale",
				"Name":             "Stale_Set",
				"Label":            "Stale Set",
				"Description":      nil,
				"IsActive":         true,
				"IsCustom":         true,
				"IsDeleted":        false,
				"ProfileId":        nil,
				"IsOwnedByProfile": false,
				"OwnerPack":        "sales",
			},
		}
		return store
	}
	setRequest, err := cp.NewComponentManagedSetLifecycleRequest(cp.ComponentManagedSetRequest{
		PackName: "sales",
		Kind:     permissionSetDefinitionComponentKind,
	}, []string{"Retained_Set"})
	if err != nil {
		t.Fatal(err)
	}
	addRetainedNegativeEdge := func(store *permissionSetDefinitionLifecycleMemoryStore) {
		store.rows["PermissionSetTabSetting"] = []cp.ComponentRow{{
			"Id":              "tab-setting-retained",
			"PermissionSetId": "permission-set-retained",
		}}
	}
	assertNoRetirement := func(t *testing.T, store *permissionSetDefinitionLifecycleMemoryStore) {
		t.Helper()
		if len(store.inserts)+len(store.updates)+len(store.deletes) != 0 {
			t.Fatalf("retained-root validation allowed mutations: inserts=%#v updates=%#v deletes=%#v", store.inserts, store.updates, store.deletes)
		}
		if store.rows["PermissionSet"][1]["IsActive"] != true ||
			store.rows["PermissionSet"][1]["IsDeleted"] != false {
			t.Fatalf("stale root mutated before retained-root validation: %#v", store.rows["PermissionSet"][1])
		}
	}

	t.Run("plan", func(t *testing.T) {
		store := newStore()
		addRetainedNegativeEdge(store)
		if _, err := lifecycle.Lifecycle().Plan(
			context.Background(),
			cp.ComponentManagedScopeSet,
			setRequest,
			store,
		); err == nil || !strings.Contains(err.Error(), "PermissionSetTabSetting") {
			t.Fatalf("retained-root plan error = %v", err)
		}
		assertNoRetirement(t, store)
	})

	t.Run("mutate", func(t *testing.T) {
		store := newStore()
		plan, err := lifecycle.Lifecycle().Plan(
			context.Background(),
			cp.ComponentManagedScopeSet,
			setRequest,
			store,
		)
		if err != nil {
			t.Fatal(err)
		}
		addRetainedNegativeEdge(store)
		store.resetMutations()
		if _, err := lifecycle.Lifecycle().Mutate(
			context.Background(),
			cp.ComponentManagedScopeSet,
			setRequest,
			plan,
			store,
		); err == nil || !strings.Contains(err.Error(), "PermissionSetTabSetting") {
			t.Fatalf("retained-root mutate error = %v", err)
		}
		assertNoRetirement(t, store)
	})

	t.Run("plan retired retained root", func(t *testing.T) {
		store := newStore()
		store.rows["PermissionSet"][0]["IsActive"] = false
		store.rows["PermissionSet"][0]["IsDeleted"] = true
		if _, err := lifecycle.Lifecycle().Plan(
			context.Background(),
			cp.ComponentManagedScopeSet,
			setRequest,
			store,
		); err != nil {
			t.Fatalf("retired retained-root plan error = %v", err)
		}
		assertNoRetirement(t, store)
	})

	t.Run("mutate retired retained root", func(t *testing.T) {
		store := newStore()
		plan, err := lifecycle.Lifecycle().Plan(
			context.Background(),
			cp.ComponentManagedScopeSet,
			setRequest,
			store,
		)
		if err != nil {
			t.Fatal(err)
		}
		store.rows["PermissionSet"][0]["IsActive"] = false
		store.rows["PermissionSet"][0]["IsDeleted"] = true
		store.resetMutations()
		if _, err := lifecycle.Lifecycle().Mutate(
			context.Background(),
			cp.ComponentManagedScopeSet,
			setRequest,
			plan,
			store,
		); err == nil || !strings.Contains(err.Error(), "active root state") {
			t.Fatalf("retired retained-root mutate error = %v", err)
		}
		assertNoRetirement(t, store)
	})
}

func TestPermissionSetDefinitionLifecycleSetRejectsCollatedDesiredDuplicates(t *testing.T) {
	_, lifecycle, err := NewPermissionSetDefinitionManagedLifecycleRegistration()
	if err != nil {
		t.Fatal(err)
	}
	request, err := cp.NewComponentManagedSetLifecycleRequest(cp.ComponentManagedSetRequest{
		PackName: "sales",
		Kind:     permissionSetDefinitionComponentKind,
	}, []string{"Sales_Operator", "sales_operator"})
	if err != nil {
		t.Fatal(err)
	}
	if _, err := lifecycle.Lifecycle().Plan(
		context.Background(),
		cp.ComponentManagedScopeSet,
		request,
		newPermissionSetDefinitionLifecycleMemoryStore(),
	); err == nil || !strings.Contains(err.Error(), "collide under database collation") {
		t.Fatalf("collated desired duplicate error = %v", err)
	}
}

func TestPermissionSetDefinitionLifecycleSetRejectsMoreThanMaximumDefinitions(t *testing.T) {
	_, lifecycle, err := NewPermissionSetDefinitionManagedLifecycleRegistration()
	if err != nil {
		t.Fatal(err)
	}
	desired := make([]string, permissionSetDefinitionManagedMaximumRows+1)
	for index := range desired {
		desired[index] = fmt.Sprintf("Permission_Set_%03d", index)
	}
	request, err := cp.NewComponentManagedSetLifecycleRequest(cp.ComponentManagedSetRequest{
		PackName: "sales",
		Kind:     permissionSetDefinitionComponentKind,
	}, desired)
	if err != nil {
		t.Fatal(err)
	}
	if _, err := lifecycle.Lifecycle().Plan(
		context.Background(),
		cp.ComponentManagedScopeSet,
		request,
		newPermissionSetDefinitionLifecycleMemoryStore(),
	); err == nil || !strings.Contains(err.Error(), "maximum is 500") {
		t.Fatalf("oversized desired set error = %v", err)
	}
}

func TestPermissionSetDefinitionLifecycleSetProjectionUsesCollationOrder(t *testing.T) {
	_, lifecycle, err := NewPermissionSetDefinitionManagedLifecycleRegistration()
	if err != nil {
		t.Fatal(err)
	}
	store := newPermissionSetDefinitionLifecycleMemoryStore()
	for index, name := range []string{"Zeta", "alpha"} {
		owner := "sales"
		store.rows["PermissionSet"] = append(store.rows["PermissionSet"], cp.ComponentRow{
			"Id":               fmt.Sprintf("permission-set-%d", index),
			"Name":             name,
			"Label":            name,
			"Description":      nil,
			"IsActive":         true,
			"IsCustom":         true,
			"IsDeleted":        false,
			"ProfileId":        nil,
			"IsOwnedByProfile": false,
			"OwnerPack":        owner,
		})
	}
	request, err := cp.NewComponentManagedSetLifecycleRequest(cp.ComponentManagedSetRequest{
		PackName: "sales",
		Kind:     permissionSetDefinitionComponentKind,
	}, []string{"Zeta", "alpha"})
	if err != nil {
		t.Fatal(err)
	}
	projection, err := lifecycle.Lifecycle().Project(
		context.Background(),
		cp.ComponentManagedScopeSet,
		request,
		store,
	)
	if err != nil {
		t.Fatal(err)
	}
	if !bytes.Equal(projection.Expected, projection.Live) {
		t.Fatalf("collation-ordered set projection differs: %s / %s", projection.Expected, projection.Live)
	}
}

func TestPermissionSetDefinitionLifecycleSetProjectionDoesNotReadActiveGrantGraphs(t *testing.T) {
	_, lifecycle, err := NewPermissionSetDefinitionManagedLifecycleRegistration()
	if err != nil {
		t.Fatal(err)
	}
	store := newPermissionSetDefinitionLifecycleMemoryStore()
	desired := make([]string, permissionSetDefinitionManagedMaximumRows)
	owner := "sales"
	for index := range desired {
		name := fmt.Sprintf("Active_Set_%03d", index)
		id := fmt.Sprintf("permission-set-%03d", index)
		desired[index] = name
		store.rows["PermissionSet"] = append(store.rows["PermissionSet"], cp.ComponentRow{
			"Id":               id,
			"Name":             name,
			"Label":            name,
			"Description":      nil,
			"IsActive":         true,
			"IsCustom":         true,
			"IsDeleted":        false,
			"ProfileId":        nil,
			"IsOwnedByProfile": false,
			"OwnerPack":        owner,
		})
		store.rows["ObjectPermissions"] = append(store.rows["ObjectPermissions"], cp.ComponentRow{
			"Id":       fmt.Sprintf("object-permission-%03d", index),
			"ParentId": id,
			objectPermissionsObjectTypePhysicalColumn: "Account",
			"PermissionsRead":                         true,
			"PermissionsCreate":                       false,
			"PermissionsEdit":                         false,
			"PermissionsDelete":                       false,
			"PermissionsViewAllRecords":               false,
			"PermissionsModifyAllRecords":             false,
			"IsDeleted":                               false,
		})
	}
	request, err := cp.NewComponentManagedSetLifecycleRequest(cp.ComponentManagedSetRequest{
		PackName: owner,
		Kind:     permissionSetDefinitionComponentKind,
	}, desired)
	if err != nil {
		t.Fatal(err)
	}
	projection, err := lifecycle.Lifecycle().Project(
		context.Background(),
		cp.ComponentManagedScopeSet,
		request,
		store,
	)
	if err != nil {
		t.Fatal(err)
	}
	if !bytes.Equal(projection.Expected, projection.Live) {
		t.Fatalf("active set projection differs: %s / %s", projection.Expected, projection.Live)
	}
	for _, query := range store.reads {
		switch query.Table {
		case "_System_PermissionSetPermission", "PermissionSetCustomPermission",
			"ObjectPermissions", "FieldPermissions", "PermissionSetAssignment":
			t.Fatalf("active set projection read aggregate table %s", query.Table)
		}
	}
}

func TestPermissionSetDefinitionLifecycleProjectsMaximumGrantReplacementTombstone(t *testing.T) {
	_, lifecycle, err := NewPermissionSetDefinitionManagedLifecycleRegistration()
	if err != nil {
		t.Fatal(err)
	}
	store := newPermissionSetDefinitionLifecycleMemoryStore()
	for index := 0; index <= permissionSetDefinitionManagedMaximumRows; index++ {
		name := fmt.Sprintf("Object_%03d", index)
		store.rows["_System_Object"] = append(store.rows["_System_Object"], cp.ComponentRow{
			"Id":           fmt.Sprintf("object-%03d", index),
			"ApiName":      name,
			"SharingModel": string(constants.SharingModelPrivate),
			"IsDeleted":    false,
		})
	}
	initial := make([]permissionSetDefinitionObjectGrant, permissionSetDefinitionManagedMaximumRows)
	for index := range initial {
		initial[index] = permissionSetDefinitionObjectGrant{Object: fmt.Sprintf("Object_%03d", index), Read: true}
	}
	initialRequest := permissionSetDefinitionManagedObjectRequestForTest(t, initial)
	initialLifecycleRequest := cp.NewComponentManagedItemLifecycleRequest(initialRequest)
	initialPlan, err := lifecycle.Lifecycle().Plan(
		context.Background(),
		cp.ComponentManagedScopeItem,
		initialLifecycleRequest,
		store,
	)
	if err != nil {
		t.Fatal(err)
	}
	if _, err := lifecycle.Lifecycle().Mutate(
		context.Background(),
		cp.ComponentManagedScopeItem,
		initialLifecycleRequest,
		initialPlan,
		store,
	); err != nil {
		t.Fatal(err)
	}

	replacement := append([]permissionSetDefinitionObjectGrant(nil), initial[1:]...)
	replacement = append(replacement, permissionSetDefinitionObjectGrant{Object: "Object_500", Read: true})
	replacementRequest := permissionSetDefinitionManagedObjectRequestForTest(t, replacement)
	replacementLifecycleRequest := cp.NewComponentManagedItemLifecycleRequest(replacementRequest)
	replacementPlan, err := lifecycle.Lifecycle().Plan(
		context.Background(),
		cp.ComponentManagedScopeItem,
		replacementLifecycleRequest,
		store,
	)
	if err != nil {
		t.Fatal(err)
	}
	if _, err := lifecycle.Lifecycle().Mutate(
		context.Background(),
		cp.ComponentManagedScopeItem,
		replacementLifecycleRequest,
		replacementPlan,
		store,
	); err != nil {
		t.Fatal(err)
	}
	if got := len(store.rows["ObjectPermissions"]); got != permissionSetDefinitionManagedMaximumRows+1 {
		t.Fatalf("physical object permission rows = %d, want 501 including one tombstone", got)
	}
	projection, err := lifecycle.Lifecycle().Project(
		context.Background(),
		cp.ComponentManagedScopeItem,
		replacementLifecycleRequest,
		store,
	)
	if err != nil {
		t.Fatal(err)
	}
	if !bytes.Equal(projection.Expected, projection.Live) {
		t.Fatalf("replacement projection differs:\n%s\n%s", projection.Expected, projection.Live)
	}
}

func TestPermissionSetDefinitionLifecycleRejectsUnprojectableTombstoneGrowth(t *testing.T) {
	state := &permissionSetDefinitionState{
		Objects: make(map[string]permissionSetDefinitionObjectRow, permissionSetDefinitionManagedMaximumRows+1),
		Fields:  make(map[string]permissionSetDefinitionFieldRow, permissionSetDefinitionManagedMaximumRows+1),
	}
	for index := 0; index <= permissionSetDefinitionManagedMaximumRows; index++ {
		deleted := index < permissionSetDefinitionManagedMaximumRows
		object := fmt.Sprintf("Object_%04d", index)
		state.Objects[strings.ToLower(object)] = permissionSetDefinitionObjectRow{
			ID:      fmt.Sprintf("object-permission-%04d", index),
			Grant:   permissionSetDefinitionObjectGrant{Object: object, Read: true},
			Deleted: deleted,
		}
		field := fmt.Sprintf("Field_%04d", index)
		grant := permissionSetDefinitionFieldGrant{Object: "Account", Field: field, Read: true}
		state.Fields[permissionSetDefinitionFieldGrantKey(grant)] = permissionSetDefinitionFieldRow{
			ID:      fmt.Sprintf("field-permission-%04d", index),
			Grant:   grant,
			Deleted: deleted,
		}
	}
	t.Run("object permission", func(t *testing.T) {
		err := validatePermissionSetDefinitionStoredGrantCapacity(permissionSetDefinitionProjection{
			Name:              "Bounded_Set",
			ObjectPermissions: []permissionSetDefinitionObjectGrant{{Object: "New_Object", Read: true}},
		}, state)
		if err == nil || !strings.Contains(err.Error(), "ObjectPermissions") {
			t.Fatalf("object tombstone capacity error = %v", err)
		}
	})
	t.Run("field permission", func(t *testing.T) {
		err := validatePermissionSetDefinitionStoredGrantCapacity(permissionSetDefinitionProjection{
			Name:              "Bounded_Set",
			ObjectPermissions: []permissionSetDefinitionObjectGrant{{Object: "Object_0500", Read: true}},
			FieldPermissions:  []permissionSetDefinitionFieldGrant{{Object: "Account", Field: "New_Field", Read: true}},
		}, state)
		if err == nil || !strings.Contains(err.Error(), "FieldPermissions") {
			t.Fatalf("field tombstone capacity error = %v", err)
		}
	})
}

func TestPermissionSetDefinitionLifecycleSetBudgetCoversDisjointMaximumOwnerSets(t *testing.T) {
	_, lifecycle, err := NewPermissionSetDefinitionManagedLifecycleRegistration()
	if err != nil {
		t.Fatal(err)
	}
	store := newPermissionSetDefinitionLifecycleMemoryStore()
	desired := make([]string, permissionSetDefinitionManagedMaximumRows)
	for index := range desired {
		desired[index] = fmt.Sprintf("New_%03d", index)
		name := fmt.Sprintf("Old_%03d", index)
		owner := "sales"
		store.rows["PermissionSet"] = append(store.rows["PermissionSet"], cp.ComponentRow{
			"Id":               fmt.Sprintf("permission-set-%03d", index),
			"Name":             name,
			"Label":            name,
			"Description":      nil,
			"IsActive":         false,
			"IsCustom":         true,
			"IsDeleted":        true,
			"ProfileId":        nil,
			"IsOwnedByProfile": false,
			"OwnerPack":        owner,
		})
	}
	request, err := cp.NewComponentManagedSetLifecycleRequest(cp.ComponentManagedSetRequest{
		PackName: "sales",
		Kind:     permissionSetDefinitionComponentKind,
	}, desired)
	if err != nil {
		t.Fatal(err)
	}
	plan, err := lifecycle.Lifecycle().Plan(
		context.Background(),
		cp.ComponentManagedScopeSet,
		request,
		store,
	)
	if err != nil {
		t.Fatal(err)
	}
	if len(plan.Targets()) != 1001 {
		t.Fatalf("disjoint maximum exact-set targets = %d, want 1001", len(plan.Targets()))
	}
	if err := lifecycle.ValidatePlanCapabilities(plan); err != nil {
		t.Fatalf("maximum disjoint owner-set plan exceeds registration budget: %v", err)
	}
}

func TestPermissionSetDefinitionLifecycleMaximumNoopFitsHostMeter(t *testing.T) {
	_, lifecycle, err := NewPermissionSetDefinitionManagedLifecycleRegistration()
	if err != nil {
		t.Fatal(err)
	}
	request, store := permissionSetDefinitionMaximumNoopFixtureForTest(t)
	metered := &permissionSetDefinitionLifecycleMeteredStore{
		permissionSetDefinitionLifecycleMemoryStore: store,
		maximumCurrentItems:                         lifecycle.Budget().MaxCurrentItems,
	}
	lifecycleRequest := cp.NewComponentManagedItemLifecycleRequest(request)
	plan, err := lifecycle.Lifecycle().Plan(
		context.Background(),
		cp.ComponentManagedScopeItem,
		lifecycleRequest,
		metered,
	)
	if err != nil {
		t.Fatalf("maximum locked plan failed: %v", err)
	}
	result, err := lifecycle.Lifecycle().Mutate(
		context.Background(),
		cp.ComponentManagedScopeItem,
		lifecycleRequest,
		plan,
		metered,
	)
	if err != nil {
		t.Fatalf("maximum no-op mutation failed after %d current items: %v", metered.currentItems, err)
	}
	if result.Disposition != cp.ComponentManagedMutationNoChange {
		t.Fatalf("maximum no-op disposition = %q", result.Disposition)
	}
	// Each Plan/Mutate pass reads the root, desired dependency catalogs,
	// current grants, and CustomPermission catalog rows needed to project IDs.
	const (
		rootRows                    = 1
		dependencyCatalogRows       = 499 + 500 + 2*500 + 500
		currentGrantRows            = 499 + 500 + 2*500 + 2*500
		customProjectionCatalogRows = 500
		rowsPerPlanOrMutate         = rootRows + dependencyCatalogRows + currentGrantRows + customProjectionCatalogRows
		expectedCurrentItems        = 2 * rowsPerPlanOrMutate
	)
	if metered.currentItems != expectedCurrentItems {
		t.Fatalf(
			"maximum locked Plan+Mutate current items = %d, want %d",
			metered.currentItems,
			expectedCurrentItems,
		)
	}
	if metered.currentItems > lifecycle.Budget().MaxCurrentItems {
		t.Fatalf(
			"maximum locked Plan+Mutate used %d current items, budget is %d",
			metered.currentItems,
			lifecycle.Budget().MaxCurrentItems,
		)
	}
}

func permissionSetDefinitionManagedRequestForTest(t *testing.T, adoptionMode string) cp.ComponentManagedRequest {
	t.Helper()
	adoption := ""
	if adoptionMode != "" {
		adoption = fmt.Sprintf(`,"adoptionMode":%q`, adoptionMode)
	}
	payload := []byte(fmt.Sprintf(`{
		"schema":"nexuscrm.permission-set-definition/v1",
		"label":"Sales Operator",
		"description":"Bounded sales access",
		"active":true%s,
		"systemPermissions":["ApiEnabled","ViewSetup"],
		"customPermissions":["Can_Export"],
		"objectPermissions":[{
			"object":"Account","read":true,"create":true,"edit":true,"delete":false,
			"viewAllRecords":false,"modifyAllRecords":false
		}],
		"fieldPermissions":[{"object":"Account","field":"Name","read":true,"edit":true}]
	}`, adoption))
	build := &permissionSetDefinitionBuildContext{packName: "sales"}
	component := cp.ManifestComponent{
		Kind:          permissionSetDefinitionComponentKind,
		BusinessKey:   "Sales_Operator",
		Manageability: cp.ManageabilityLocked,
		Payload:       append([]byte(nil), payload...),
	}
	if err := buildPermissionSetDefinition(build, cp.ComponentBuildRequest{
		PackName:  "sales",
		Component: component,
		Payload:   payload,
	}); err != nil {
		t.Fatal(err)
	}
	return cp.ComponentManagedRequest{
		PackName:           "sales",
		Component:          component,
		Payload:            payload,
		ExpectedProjection: append([]byte(nil), build.managed[0].ExpectedProjection...),
	}
}

func permissionSetDefinitionManagedObjectRequestForTest(
	t *testing.T,
	grants []permissionSetDefinitionObjectGrant,
) cp.ComponentManagedRequest {
	t.Helper()
	payload, err := json.Marshal(permissionSetDefinitionPayload{
		Schema:            permissionSetDefinitionPayloadSchema,
		Label:             "Maximum Object Grants",
		Active:            true,
		SystemPermissions: []string{},
		CustomPermissions: []string{},
		ObjectPermissions: grants,
		FieldPermissions:  []permissionSetDefinitionFieldGrant{},
	})
	if err != nil {
		t.Fatal(err)
	}
	build := &permissionSetDefinitionBuildContext{packName: "sales"}
	component := cp.ManifestComponent{
		Kind:          permissionSetDefinitionComponentKind,
		BusinessKey:   "Maximum_Object_Grants",
		Manageability: cp.ManageabilityLocked,
		Payload:       append([]byte(nil), payload...),
	}
	if err := buildPermissionSetDefinition(build, cp.ComponentBuildRequest{
		PackName:  "sales",
		Component: component,
		Payload:   payload,
	}); err != nil {
		t.Fatal(err)
	}
	return cp.ComponentManagedRequest{
		PackName:           "sales",
		Component:          component,
		Payload:            payload,
		ExpectedProjection: append([]byte(nil), build.managed[0].ExpectedProjection...),
	}
}

func permissionSetDefinitionMaximumNoopFixtureForTest(
	t *testing.T,
) (cp.ComponentManagedRequest, *permissionSetDefinitionLifecycleMemoryStore) {
	t.Helper()
	const (
		rootID      = "maximum-permission-set"
		businessKey = "Maximum_Permission_Set"
		packName    = "sales"
	)
	store := newPermissionSetDefinitionLifecycleMemoryStore()
	payload := permissionSetDefinitionPayload{
		Schema:            permissionSetDefinitionPayloadSchema,
		Label:             "Maximum Permission Set",
		Active:            true,
		SystemPermissions: make([]string, 499),
		CustomPermissions: make([]string, permissionSetDefinitionManagedMaximumRows),
		ObjectPermissions: make([]permissionSetDefinitionObjectGrant, permissionSetDefinitionManagedMaximumRows),
		FieldPermissions:  make([]permissionSetDefinitionFieldGrant, permissionSetDefinitionManagedMaximumRows),
	}
	store.rows["PermissionSet"] = []cp.ComponentRow{{
		"Id":               rootID,
		"Name":             businessKey,
		"Label":            payload.Label,
		"Description":      nil,
		"IsActive":         true,
		"IsCustom":         true,
		"IsDeleted":        false,
		"ProfileId":        nil,
		"IsOwnedByProfile": false,
		"OwnerPack":        packName,
	}}
	for index := range payload.SystemPermissions {
		apiName := fmt.Sprintf("System_%03d", index)
		payload.SystemPermissions[index] = apiName
		store.rows["_System_Permission"] = append(store.rows["_System_Permission"], cp.ComponentRow{
			"Id":                 fmt.Sprintf("system-catalog-%03d", index),
			"ApiName":            apiName,
			"IsActive":           true,
			"RequiresPermission": nil,
		})
		store.rows["_System_PermissionSetPermission"] = append(
			store.rows["_System_PermissionSetPermission"],
			cp.ComponentRow{
				"Id":                fmt.Sprintf("system-grant-%03d", index),
				"PermissionSetId":   rootID,
				"PermissionApiName": apiName,
				"IsEnabled":         true,
			},
		)
	}
	for index := 0; index < permissionSetDefinitionManagedMaximumRows; index++ {
		customName := fmt.Sprintf("Custom_%03d", index)
		customID := fmt.Sprintf("custom-catalog-%03d", index)
		payload.CustomPermissions[index] = customName
		store.rows["_System_CustomPermission"] = append(store.rows["_System_CustomPermission"], cp.ComponentRow{
			"Id": customID, "ApiName": customName, "IsActive": true, "IsDeleted": false,
		})
		store.rows["PermissionSetCustomPermission"] = append(
			store.rows["PermissionSetCustomPermission"],
			cp.ComponentRow{
				"Id":                 fmt.Sprintf("custom-grant-%03d", index),
				"PermissionSetId":    rootID,
				"CustomPermissionId": customID,
			},
		)

		objectName := fmt.Sprintf("Object_%03d", index)
		objectID := fmt.Sprintf("object-catalog-%03d", index)
		payload.ObjectPermissions[index] = permissionSetDefinitionObjectGrant{Object: objectName, Read: true}
		store.rows["_System_Object"] = append(store.rows["_System_Object"], cp.ComponentRow{
			"Id": objectID, "ApiName": objectName, "SharingModel": string(constants.SharingModelPrivate),
			"IsDeleted": false,
		})
		store.rows["ObjectPermissions"] = append(store.rows["ObjectPermissions"], cp.ComponentRow{
			"Id":       fmt.Sprintf("object-grant-%03d", index),
			"ParentId": rootID,
			objectPermissionsObjectTypePhysicalColumn: objectName,
			"PermissionsRead":                         true,
			"PermissionsCreate":                       false,
			"PermissionsEdit":                         false,
			"PermissionsDelete":                       false,
			"PermissionsViewAllRecords":               false,
			"PermissionsModifyAllRecords":             false,
			"IsDeleted":                               false,
		}, cp.ComponentRow{
			"Id":       fmt.Sprintf("object-tombstone-%03d", index),
			"ParentId": rootID,
			objectPermissionsObjectTypePhysicalColumn: fmt.Sprintf("Retired_Object_%03d", index),
			"PermissionsRead":                         true,
			"PermissionsCreate":                       false,
			"PermissionsEdit":                         false,
			"PermissionsDelete":                       false,
			"PermissionsViewAllRecords":               false,
			"PermissionsModifyAllRecords":             false,
			"IsDeleted":                               true,
		})

		fieldObjectName := fmt.Sprintf("Field_Object_%03d", index)
		fieldObjectID := fmt.Sprintf("field-object-catalog-%03d", index)
		fieldName := fmt.Sprintf("Field_%03d", index)
		payload.FieldPermissions[index] = permissionSetDefinitionFieldGrant{
			Object: fieldObjectName,
			Field:  fieldName,
			Read:   true,
		}
		store.rows["_System_Object"] = append(store.rows["_System_Object"], cp.ComponentRow{
			"Id": fieldObjectID, "ApiName": fieldObjectName, "SharingModel": string(constants.SharingModelPrivate),
			"IsDeleted": false,
		})
		store.rows["_System_Field"] = append(store.rows["_System_Field"], cp.ComponentRow{
			"Id":        fmt.Sprintf("field-catalog-%03d", index),
			"ObjectId":  fieldObjectID,
			"ApiName":   fieldName,
			"IsDeleted": false,
		})
		store.rows["FieldPermissions"] = append(store.rows["FieldPermissions"], cp.ComponentRow{
			"Id":       fmt.Sprintf("field-grant-%03d", index),
			"ParentId": rootID,
			objectPermissionsObjectTypePhysicalColumn: fieldObjectName,
			"Field":           fieldObjectName + "." + fieldName,
			"PermissionsRead": true,
			"PermissionsEdit": false,
			"IsDeleted":       false,
		}, cp.ComponentRow{
			"Id":       fmt.Sprintf("field-tombstone-%03d", index),
			"ParentId": rootID,
			objectPermissionsObjectTypePhysicalColumn: "Retired_Field_Object",
			"Field":           fmt.Sprintf("Retired_Field_Object.Retired_Field_%03d", index),
			"PermissionsRead": true,
			"PermissionsEdit": false,
			"IsDeleted":       true,
		})
	}
	raw, err := json.Marshal(payload)
	if err != nil {
		t.Fatal(err)
	}
	build := &permissionSetDefinitionBuildContext{packName: packName}
	component := cp.ManifestComponent{
		Kind:          permissionSetDefinitionComponentKind,
		BusinessKey:   businessKey,
		Manageability: cp.ManageabilityLocked,
		Payload:       append([]byte(nil), raw...),
	}
	if err := buildPermissionSetDefinition(build, cp.ComponentBuildRequest{
		PackName:  packName,
		Component: component,
		Payload:   raw,
	}); err != nil {
		t.Fatal(err)
	}
	return cp.ComponentManagedRequest{
		PackName:           packName,
		Component:          component,
		Payload:            raw,
		ExpectedProjection: append([]byte(nil), build.managed[0].ExpectedProjection...),
	}, store
}

func permissionSetDefinitionAllRowsDeleted(rows []cp.ComponentRow) bool {
	for _, row := range rows {
		if row["IsDeleted"] != true {
			return false
		}
	}
	return true
}

type permissionSetDefinitionLifecycleMemoryStore struct {
	rows              map[string][]cp.ComponentRow
	nextID            int
	reads             []cp.ComponentManagedRowQuery
	inserts           []cp.ComponentManagedInsertBatch
	updates           []cp.ComponentManagedUpdate
	deletes           []cp.ComponentManagedDelete
	locks             []cp.ComponentManagedRowQuery
	timestampSequence int
}

type permissionSetDefinitionLifecycleMeteredStore struct {
	*permissionSetDefinitionLifecycleMemoryStore
	maximumCurrentItems int
	currentItems        int
}

// ReadRows and LockRows mirror the controlplane host meter's cumulative
// returned-row accounting across the locked Plan and Mutate callbacks.
func (s *permissionSetDefinitionLifecycleMeteredStore) ReadRows(
	ctx context.Context,
	query cp.ComponentManagedRowQuery,
) ([]cp.ComponentRow, error) {
	rows, err := s.permissionSetDefinitionLifecycleMemoryStore.ReadRows(ctx, query)
	if err != nil {
		return nil, err
	}
	if err := s.recordCurrentItems(len(rows)); err != nil {
		return nil, err
	}
	return rows, nil
}

func (s *permissionSetDefinitionLifecycleMeteredStore) LockRows(
	ctx context.Context,
	query cp.ComponentManagedRowQuery,
) ([]cp.ComponentRow, error) {
	rows, err := s.permissionSetDefinitionLifecycleMemoryStore.LockRows(ctx, query)
	if err != nil {
		return nil, err
	}
	if err := s.recordCurrentItems(len(rows)); err != nil {
		return nil, err
	}
	return rows, nil
}

func (s *permissionSetDefinitionLifecycleMeteredStore) recordCurrentItems(count int) error {
	s.currentItems += count
	if s.currentItems > s.maximumCurrentItems {
		return fmt.Errorf(
			"managed lifecycle current-item budget exceeded: %d > %d",
			s.currentItems,
			s.maximumCurrentItems,
		)
	}
	return nil
}

func newPermissionSetDefinitionLifecycleMemoryStore() *permissionSetDefinitionLifecycleMemoryStore {
	return &permissionSetDefinitionLifecycleMemoryStore{
		rows: map[string][]cp.ComponentRow{
			"_System_Permission": {
				{"Id": "perm-api", "ApiName": "ApiEnabled", "IsActive": true, "RequiresPermission": nil},
				{"Id": "perm-view", "ApiName": "ViewSetup", "IsActive": true, "RequiresPermission": "ApiEnabled"},
			},
			"_System_CustomPermission": {
				{"Id": "custom-export", "ApiName": "Can_Export", "IsActive": true, "IsDeleted": false},
			},
			"_System_Object": {
				{
					"Id": "object-account", "ApiName": "Account", "SharingModel": string(constants.SharingModelPrivate),
					"IsDeleted": false,
				},
			},
			"_System_Field": {
				{"Id": "field-name", "ObjectId": "object-account", "ApiName": "Name", "IsDeleted": false},
			},
		},
	}
}

func (s *permissionSetDefinitionLifecycleMemoryStore) ReadRows(
	_ context.Context,
	query cp.ComponentManagedRowQuery,
) ([]cp.ComponentRow, error) {
	s.reads = append(s.reads, query)
	return s.read(query)
}

func (s *permissionSetDefinitionLifecycleMemoryStore) LockRows(
	_ context.Context,
	query cp.ComponentManagedRowQuery,
) ([]cp.ComponentRow, error) {
	s.locks = append(s.locks, query)
	return s.read(query)
}

func (s *permissionSetDefinitionLifecycleMemoryStore) read(
	query cp.ComponentManagedRowQuery,
) ([]cp.ComponentRow, error) {
	if err := query.Validate(permissionSetDefinitionManagedMaximumRows); err != nil {
		return nil, err
	}
	rows := make([]cp.ComponentRow, 0, len(s.rows[query.Table]))
	for _, source := range s.rows[query.Table] {
		if !permissionSetDefinitionLifecycleRowMatches(source, query.Equal) {
			continue
		}
		row := make(cp.ComponentRow, len(query.Columns))
		for _, column := range query.Columns {
			if value, ok := source[column]; ok {
				row[column] = value
			}
		}
		rows = append(rows, row)
		if len(rows) > query.MaximumRows {
			return nil, fmt.Errorf("test read exceeded maximum rows %d", query.MaximumRows)
		}
	}
	sort.Slice(rows, func(i, j int) bool {
		for _, order := range query.OrderBy {
			left, right := fmt.Sprint(rows[i][order.Column]), fmt.Sprint(rows[j][order.Column])
			if left != right {
				if order.Direction == cp.ComponentManagedOrderDescending {
					return left > right
				}
				return left < right
			}
		}
		return false
	})
	return rows, nil
}

func (s *permissionSetDefinitionLifecycleMemoryStore) NewID() (string, error) {
	s.nextID++
	return fmt.Sprintf("managed-id-%03d", s.nextID), nil
}

func (s *permissionSetDefinitionLifecycleMemoryStore) InsertRows(
	_ context.Context,
	batch cp.ComponentManagedInsertBatch,
) (int64, error) {
	if err := batch.Validate(permissionSetDefinitionManagedMaximumRows); err != nil {
		return 0, err
	}
	s.inserts = append(s.inserts, batch)
	timestamp := s.nextTimestamp()
	for _, insertion := range batch.Rows {
		row := permissionSetDefinitionCloneRow(insertion.Values)
		for _, column := range batch.CurrentTimestampColumns {
			row[column] = timestamp
		}
		s.rows[batch.Table] = append(s.rows[batch.Table], row)
	}
	return int64(len(batch.Rows)), nil
}

func (s *permissionSetDefinitionLifecycleMemoryStore) UpdateRows(
	_ context.Context,
	update cp.ComponentManagedUpdate,
) (int64, error) {
	if err := update.Validate(permissionSetDefinitionManagedMaximumRows); err != nil {
		return 0, err
	}
	s.updates = append(s.updates, update)
	timestamp := s.nextTimestamp()
	affected := 0
	for _, row := range s.rows[update.Table] {
		if !permissionSetDefinitionLifecycleRowMatches(row, update.Match) {
			continue
		}
		for column, value := range update.Values {
			row[column] = value
		}
		for _, column := range update.CurrentTimestampColumns {
			row[column] = timestamp
		}
		affected++
	}
	if affected > update.MaximumAffectedRows {
		return 0, fmt.Errorf("test update affected %d rows, maximum %d", affected, update.MaximumAffectedRows)
	}
	return int64(affected), nil
}

func (s *permissionSetDefinitionLifecycleMemoryStore) nextTimestamp() string {
	s.timestampSequence++
	return fmt.Sprintf("2026-08-13T08:00:%02dZ", s.timestampSequence)
}

func (s *permissionSetDefinitionLifecycleMemoryStore) DeleteRows(
	_ context.Context,
	deletion cp.ComponentManagedDelete,
) (int64, error) {
	if err := deletion.Validate(permissionSetDefinitionManagedMaximumRows); err != nil {
		return 0, err
	}
	s.deletes = append(s.deletes, deletion)
	kept := s.rows[deletion.Table][:0]
	affected := 0
	for _, row := range s.rows[deletion.Table] {
		if permissionSetDefinitionLifecycleRowMatches(row, deletion.Match) {
			affected++
			continue
		}
		kept = append(kept, row)
	}
	if affected > deletion.MaximumAffectedRows {
		return 0, fmt.Errorf("test delete affected %d rows, maximum %d", affected, deletion.MaximumAffectedRows)
	}
	s.rows[deletion.Table] = kept
	return int64(affected), nil
}

func (*permissionSetDefinitionLifecycleMemoryStore) ActualReceipt() cp.ComponentManagedMutationReceipt {
	return cp.ComponentManagedMutationReceipt{}
}

func (s *permissionSetDefinitionLifecycleMemoryStore) resetMutations() {
	s.inserts = nil
	s.updates = nil
	s.deletes = nil
	s.locks = nil
}

func permissionSetDefinitionLifecycleRowMatches(row, match cp.ComponentRow) bool {
	for column, want := range match {
		got, exists := row[column]
		if !exists {
			return false
		}
		if permissionSetDefinitionLifecycleCollatedColumn(column) {
			gotString, gotOK := got.(string)
			wantString, wantOK := want.(string)
			if gotOK && wantOK && strings.EqualFold(gotString, wantString) {
				continue
			}
		}
		if !reflect.DeepEqual(got, want) {
			return false
		}
	}
	return true
}

func permissionSetDefinitionLifecycleCollatedColumn(column string) bool {
	switch column {
	case "Name", "ApiName", "PermissionApiName", objectPermissionsObjectTypePhysicalColumn, "Field":
		return true
	default:
		return false
	}
}

func permissionSetDefinitionCloneRow(row cp.ComponentRow) cp.ComponentRow {
	clone := make(cp.ComponentRow, len(row))
	for key, value := range row {
		clone[key] = value
	}
	return clone
}