mock_provider "alicloud" {}
mock_provider "external" {}

override_data {
  target = data.alicloud_account.current
  values = {
    id = "5083883504403318"
  }
}

override_data {
  target = data.alicloud_nlb_zones.available
  values = {
    zones = [
      { id = "ap-southeast-1a", local_name = "Singapore Zone A", zone_id = "ap-southeast-1a" },
      { id = "ap-southeast-1b", local_name = "Singapore Zone B", zone_id = "ap-southeast-1b" },
    ]
  }
}

override_data {
  target = data.alicloud_zones.ecs
  values = {
    ids = ["ap-southeast-1a"]
  }
}

override_data {
  target = data.alicloud_images.services
  values = {
    images = [{ id = "ubuntu-test-image", image_id = "ubuntu-test-image" }]
  }
}

override_resource {
  target          = random_id.deployment
  override_during = plan
  values = {
    hex = "0123456789ab"
  }
}

override_resource {
  target          = alicloud_ecs_disk.data
  override_during = plan
  values = {
    id = "d-testdisk123"
  }
}

run "defaults_are_safe" {
  command = plan

  variables {
    port_base = 40000
  }

  assert {
    condition     = var.target_account_id == "5083883504403318"
    error_message = "Unexpected default Alibaba Cloud account."
  }

  assert {
    condition     = var.alicloud_region == "ap-southeast-1"
    error_message = "Unexpected default Alibaba Cloud region."
  }

  assert {
    condition     = var.instance_type == "ecs.c9i.large"
    error_message = "Alibaba Cloud must retain the 2-vCPU/4-GiB ECS type."
  }

  assert {
    condition     = alicloud_instance.services.stopped_mode == "Not-applicable"
    error_message = "A running ECS instance must match the provider's non-stopped mode to avoid perpetual plan drift."
  }

  assert {
    condition     = local.service_zone_id == "ap-southeast-1a" && local.service_vswitch_index == 0
    error_message = "ECS must select a zone supported by both its instance type and the NLB."
  }

  assert {
    condition     = alltrue([for dependency in local.e2e_kafka_dependencies : keys(dependency.dnsRecords) == [local.service_zone_id]])
    error_message = "Alibaba Cloud Kafka dependencies must use an availability zone, not a region, as the DNS-record key."
  }

  assert {
    condition     = local.data_device_path == "/dev/disk/by-id/nvme-Alibaba_Cloud_Elastic_Block_Storage_testdisk123"
    error_message = "Bootstrap must discover the attached ESSD by its stable NVMe disk ID."
  }

  assert {
    condition     = alltrue([for port in values(local.ports) : port >= 20000 && port <= 60239])
    error_message = "All mapped service ports must remain high ports."
  }

  assert {
    condition     = length(distinct(values(local.ports))) == 8
    error_message = "Service ports must be unique."
  }

  assert {
    condition     = alicloud_nlb_load_balancer.services[0].address_type == "Intranet" && alicloud_nlb_load_balancer.services[0].cross_zone_enabled
    error_message = "The shared NLB must be internal and cross-zone enabled."
  }

  assert {
    condition     = alicloud_privatelink_vpc_endpoint_service.services[0].service_resource_type == "nlb" && alicloud_privatelink_vpc_endpoint_service.services[0].auto_accept_connection
    error_message = "PrivateLink must publish the shared NLB and auto-accept approved consumers."
  }

  assert {
    condition     = length(alicloud_nlb_listener.services) == 3
    error_message = "MySQL and both Kafka listeners must share one NLB."
  }

  assert {
    condition     = alltrue([for rule in alicloud_security_group_rule.private_services : rule.cidr_ip == var.vpc_cidr])
    error_message = "Service ingress must remain restricted to the producer VPC."
  }

  assert {
    condition = (
      length(alicloud_oss_bucket.test_data.lifecycle_rule) == 4 &&
      alltrue([
        for rule in alicloud_oss_bucket.test_data.lifecycle_rule :
        rule.id == "expire-test-objects-except-import-after-one-day" ?
        length(rule.filter) == 1 &&
        length(rule.expiration) == 1 &&
        rule.filter[0].not[0].prefix == "import/" &&
        alltrue([for expiration in rule.expiration : expiration.days == 1]) :
        true
      ]) &&
      length([
        for rule in alicloud_oss_bucket.test_data.lifecycle_rule :
        rule if rule.id == "expire-test-objects-except-import-after-one-day"
      ]) == 1 &&
      alltrue([
        for rule in alicloud_oss_bucket.test_data.lifecycle_rule :
        contains([
          "abort-cdc-multipart-uploads-after-one-day",
          "abort-backup-export-multipart-uploads-after-one-day",
          "abort-import-multipart-uploads-after-one-day",
        ], rule.id) ?
        length(rule.abort_multipart_upload) == 1 &&
        alltrue([for upload in rule.abort_multipart_upload : upload.days == 1]) :
        true
      ]) &&
      length([
        for rule in alicloud_oss_bucket.test_data.lifecycle_rule :
        rule if rule.id == "abort-cdc-multipart-uploads-after-one-day" && rule.prefix == "cdc/"
      ]) == 1 &&
      length([
        for rule in alicloud_oss_bucket.test_data.lifecycle_rule :
        rule if rule.id == "abort-backup-export-multipart-uploads-after-one-day" && rule.prefix == "backup-export/"
      ]) == 1 &&
      length([
        for rule in alicloud_oss_bucket.test_data.lifecycle_rule :
        rule if rule.id == "abort-import-multipart-uploads-after-one-day" && rule.prefix == "import/"
      ]) == 1
    )
    error_message = "OSS must expire all objects after one day except import/ and separately abort incomplete multipart uploads for each managed prefix after one day."
  }

  assert {
    condition     = can(regex("^[A-Za-z0-9]+$", alicloud_ram_role.services.role_name)) && can(regex("^[A-Za-z0-9]+$", alicloud_ram_policy.oss.policy_name))
    error_message = "RAM role and policy names must use the portable alphanumeric subset accepted by Alibaba Cloud."
  }

  assert {
    condition     = endswith(local.oss_import_uri, "/import/csv/") && local.oss_public_endpoint == "oss-${var.alicloud_region}.aliyuncs.com"
    error_message = "The OSS import URI must target the import/csv/ prefix and the public endpoint must use the deployment region."
  }

  assert {
    condition = (
      local.e2e_import_sample_data_oss.endpoint == "https://${local.oss_public_endpoint}" &&
      local.e2e_import_sample_data_oss.importedDBTable.database == "test" &&
      local.e2e_import_sample_data_oss.importedDBTable.table == "a" &&
      local.e2e_import_sample_data_oss.customCSVFormat.delimiter == "\"" &&
      local.e2e_import_sample_data_oss.customCSVFormat.escapeChar == "\\" &&
      local.e2e_import_sample_data_oss.customCSVFormat.lineTerminator == "\n" &&
      local.e2e_import_sample_data_oss.customCSVFormat.nullValue == "\\N" &&
      local.e2e_import_sample_data_oss.customCSVFormat.separator == ";" &&
      local.e2e_import_sample_data_oss.customCSVFormat.skipRows == 1 &&
      local.e2e_import_sample_data_oss.customCSVFormat.splitFile == false
    )
    error_message = "OSS import sample output must include the complete CSV/table schema and HTTPS endpoint."
  }

  assert {
    condition = (
      length(file("${path.root}/../../scripts/seeddata/import/csv/test.a.0001.csv")) == 79 &&
      file("${path.root}/../../scripts/seeddata/import/csv/test.a.0001.csv") == "id;name;amount\n1;alice;12.50\n2;bob;3.75\n3;carol;99.99\n4;dave;0.01\n5;erin;42.00\n"
    )
    error_message = "The canonical OSS CSV fixture must remain the 79-byte semicolon-delimited LF file."
  }

  assert {
    condition = (
      file("${path.root}/../../scripts/seeddata/import/csv/test-schema-create.sql") == "CREATE DATABASE IF NOT EXISTS `test`;\n" &&
      file("${path.root}/../../scripts/seeddata/import/csv/test.a-schema.sql") == "CREATE TABLE `test`.`a` (\n  `id` BIGINT NOT NULL,\n  `name` VARCHAR(64) NOT NULL,\n  `amount` DECIMAL(10,2) NOT NULL,\n  PRIMARY KEY (`id`)\n);\n"
    )
    error_message = "The shared import schema fixtures must retain their exact DDL contents."
  }

  assert {
    condition     = can(regex("^[A-Za-z0-9]+$", alicloud_ram_user.import.name)) && can(regex("^[A-Za-z0-9]+$", alicloud_ram_policy.import.policy_name))
    error_message = "OSS import RAM user and policy names must use the portable alphanumeric subset accepted by Alibaba Cloud."
  }
}

run "later_compatible_ecs_zone_is_provisioned" {
  command = plan

  variables {
    port_base = 40000
  }

  override_data {
    target = data.alicloud_nlb_zones.available
    values = {
      zones = [
        { id = "ap-southeast-1a", local_name = "Singapore Zone A", zone_id = "ap-southeast-1a" },
        { id = "ap-southeast-1b", local_name = "Singapore Zone B", zone_id = "ap-southeast-1b" },
        { id = "ap-southeast-1c", local_name = "Singapore Zone C", zone_id = "ap-southeast-1c" },
      ]
    }
  }

  override_data {
    target = data.alicloud_zones.ecs
    values = {
      ids = ["ap-southeast-1c"]
    }
  }

  assert {
    condition     = local.service_zone_id == "ap-southeast-1c" && local.service_vswitch_index == 1
    error_message = "A compatible ECS zone beyond the first two NLB zones must become the service vSwitch."
  }

  assert {
    condition     = alicloud_vswitch.services[1].zone_id == "ap-southeast-1c" && length(alicloud_vswitch.services) == 2
    error_message = "The selected ECS zone must be included in the exact two-zone vSwitch topology."
  }
}

run "output_contracts_are_wired" {
  command = plan

  variables {
    port_base                       = 40000
    desired_state                   = "stopped"
    remove_privatelink_when_stopped = true
  }

  override_resource {
    target          = random_id.deployment
    override_during = plan
    values = {
      hex = "0123456789ab"
    }
  }

  override_resource {
    target          = alicloud_ram_access_key.import
    override_during = plan
    values = {
      id     = "test-access-key"
      secret = "test-secret-key"
    }
  }

  override_resource {
    target          = alicloud_oss_bucket.test_data
    override_during = plan
    values = {
      intranet_endpoint = "oss-ap-southeast-1-internal.aliyuncs.com"
    }
  }

  assert {
    condition = (
      output.object_storage.public_endpoint == local.oss_public_endpoint &&
      output.object_storage.intranet_endpoint == alicloud_oss_bucket.test_data.intranet_endpoint &&
      !can(regex("://", output.object_storage.public_endpoint)) &&
      !can(regex("://", output.object_storage.intranet_endpoint))
    )
    error_message = "OSS object_storage must wire bare public and intranet host contracts."
  }

  assert {
    condition = (
      local.e2e_import_sample_data_oss.sourceURL == local.oss_import_uri &&
      contains(keys(local.e2e_import_sample_data_oss), "accessKeyID") &&
      contains(keys(local.e2e_import_sample_data_oss), "accessKeySecret")
    )
    error_message = "The OSS import local contract must retain the source URI and credential keys."
  }

  assert {
    condition = (
      yamldecode(nonsensitive(output.e2e_dependency_yaml)).importSampleData.oss.sourceURL == local.oss_import_uri &&
      yamldecode(nonsensitive(output.e2e_dependency_yaml)).importSampleData.oss.endpoint == "https://${local.oss_public_endpoint}" &&
      yamldecode(nonsensitive(output.e2e_dependency_yaml)).importSampleData.oss.accessKeyID == "test-access-key" &&
      yamldecode(nonsensitive(output.e2e_dependency_yaml)).importSampleData.oss.accessKeySecret == "test-secret-key" &&
      yamldecode(nonsensitive(output.e2e_dependency_yaml)).importSampleData.oss.importedDBTable.database == "test" &&
      yamldecode(nonsensitive(output.e2e_dependency_yaml)).importSampleData.oss.importedDBTable.table == "a" &&
      yamldecode(nonsensitive(output.e2e_dependency_yaml)).importSampleData.oss.customCSVFormat.delimiter == "\"" &&
      yamldecode(nonsensitive(output.e2e_dependency_yaml)).importSampleData.oss.customCSVFormat.escapeChar == "\\" &&
      yamldecode(nonsensitive(output.e2e_dependency_yaml)).importSampleData.oss.customCSVFormat.lineTerminator == "\n" &&
      yamldecode(nonsensitive(output.e2e_dependency_yaml)).importSampleData.oss.customCSVFormat.nullValue == "\\N" &&
      yamldecode(nonsensitive(output.e2e_dependency_yaml)).importSampleData.oss.customCSVFormat.separator == ";" &&
      yamldecode(nonsensitive(output.e2e_dependency_yaml)).importSampleData.oss.customCSVFormat.skipRows == 1 &&
      yamldecode(nonsensitive(output.e2e_dependency_yaml)).importSampleData.oss.customCSVFormat.splitFile == false
    )
    error_message = "e2e_dependency_yaml must wire the complete OSS import schema."
  }
}

run "normal_sleep_retains_private_connectivity" {
  command = plan

  variables {
    port_base                       = 40000
    desired_state                   = "stopped"
    remove_privatelink_when_stopped = false
  }

  assert {
    condition     = length(alicloud_nlb_load_balancer.services) == 1 && length(alicloud_privatelink_vpc_endpoint_service.services) == 1
    error_message = "Normal sleep must retain the NLB and endpoint service identity."
  }

  assert {
    condition     = alicloud_instance.services.status == "Stopped" && alicloud_instance.services.stopped_mode == "StopCharging"
    error_message = "Normal sleep must stop ECS in economical StopCharging mode."
  }
}

run "deep_sleep_removes_private_connectivity" {
  command = plan

  variables {
    port_base                       = 40000
    desired_state                   = "stopped"
    remove_privatelink_when_stopped = true
  }

  assert {
    condition     = length(alicloud_nlb_load_balancer.services) == 0 && length(alicloud_privatelink_vpc_endpoint_service.services) == 0
    error_message = "Deep sleep must remove the NLB and endpoint service."
  }

  assert {
    condition     = alicloud_instance.services.status == "Stopped" && alicloud_instance.services.stopped_mode == "StopCharging"
    error_message = "Deep sleep must stop ECS in economical StopCharging mode."
  }
}