dns-autoresolver/internal/service/service_test.go

package service

import (
	"context"
	"testing"

	"github.com/google/uuid"

	"github.com/vasyakrg/dns-autoresolver/internal/crypto"
	"github.com/vasyakrg/dns-autoresolver/internal/diff"
	"github.com/vasyakrg/dns-autoresolver/internal/model"
	"github.com/vasyakrg/dns-autoresolver/internal/provider"
	"github.com/vasyakrg/dns-autoresolver/internal/provider/registry"
	"github.com/vasyakrg/dns-autoresolver/internal/store/dto"
)

func testCipher(t *testing.T) *crypto.Cipher {
	t.Helper()
	key := make([]byte, 32)
	c, err := crypto.NewCipher(key)
	if err != nil {
		t.Fatal(err)
	}
	return c
}

// fakeProvider records applied changesets and returns canned zone records.
type fakeProvider struct {
	actual  []model.Record
	applied diff.Changeset
}

func (fakeProvider) Name() string { return "selectel" }
func (fakeProvider) ListZones(context.Context, provider.Credentials) ([]provider.Zone, error) {
	return nil, nil
}
func (f *fakeProvider) GetRecords(context.Context, provider.Credentials, string) ([]model.Record, error) {
	return f.actual, nil
}
func (f *fakeProvider) ApplyChanges(_ context.Context, _ provider.Credentials, _ string, cs diff.Changeset) error {
	f.applied = cs
	return nil
}
func (fakeProvider) Validate(context.Context, provider.Credentials) error { return nil }

type fakeLoader struct{ ref DomainRef }

func (l fakeLoader) LoadDomain(context.Context, uuid.UUID, uuid.UUID) (DomainRef, error) {
	return l.ref, nil
}

// LoadZone mirrors LoadDomain's provider-access fields but — unlike
// LoadDomain — never errors on a missing template, matching the real
// store.LoadZone contract.
func (l fakeLoader) LoadZone(context.Context, uuid.UUID, uuid.UUID) (ZoneRef, error) {
	return ZoneRef{ZoneID: l.ref.ZoneID, Provider: l.ref.Provider, SecretEnc: l.ref.SecretEnc}, nil
}

type nopRecorder struct{}

func (nopRecorder) SaveCheckRun(context.Context, uuid.UUID, diff.Changeset) error { return nil }

func setup(t *testing.T, actual []model.Record, tmpl dto.TemplateDoc) (*DomainService, *fakeProvider) {
	fp := &fakeProvider{actual: actual}
	reg := registry.New()
	reg.Register(fp)
	cipher := testCipher(t)
	enc, _ := cipher.Encrypt([]byte("secret"))
	loader := fakeLoader{ref: DomainRef{ZoneID: "z1", ZoneName: "example.com.", Provider: "selectel", SecretEnc: enc, Template: tmpl}}
	return New(loader, nopRecorder{}, reg, cipher), fp
}

func TestCheckProducesDiff(t *testing.T) {
	actual := []model.Record{{Type: model.A, Name: "a.example.com.", TTL: 300, Values: []string{"9.9.9.9"}}}
	tmpl := dto.TemplateDoc{Records: []dto.RecordDTO{
		{Type: "A", Name: "a.example.com.", TTL: 300, Values: []string{"1.1.1.1"}}, // update
	}}
	svc, _ := setup(t, actual, tmpl)
	cs, err := svc.Check(context.Background(), uuid.New(), uuid.New())
	if err != nil {
		t.Fatal(err)
	}
	if len(cs.Updates()) != 1 || cs.Updates()[0].Kind != diff.Update {
		t.Fatalf("expected 1 update, got %+v", cs.Updates())
	}
}

// TestCheckMaterializesDomainNamePlaceholder covers the tmpl.Materialize
// wiring in resolve: a template record using {{domain_name}} in its name and
// values must be diffed against the zone using the actual zone name (without
// trailing dot) substituted in, so a template reused across domains reports
// in-sync rather than spurious add/delete pairs.
func TestCheckMaterializesDomainNamePlaceholder(t *testing.T) {
	actual := []model.Record{
		{Type: model.TXT, Name: "_dmarc.example.com.", TTL: 600, Values: []string{"v=DMARC1; p=quarantine"}},
	}
	tmpl := dto.TemplateDoc{Records: []dto.RecordDTO{
		{Type: "TXT", Name: "_dmarc.{{domain_name}}.", TTL: 600, Values: []string{"v=DMARC1; p=quarantine"}},
	}}
	svc, _ := setup(t, actual, tmpl)
	cs, err := svc.Check(context.Background(), uuid.New(), uuid.New())
	if err != nil {
		t.Fatal(err)
	}
	if len(cs.Updates()) != 0 || len(cs.Prunes()) != 0 {
		t.Fatalf("expected placeholder materialized against zone name to be in sync, got updates=%+v prunes=%+v", cs.Updates(), cs.Prunes())
	}
}

// TestZoneRecordsReadsProviderDirectly covers the no-template zone-viewing
// path: ZoneRecords must return the provider's live records with no diff
// and no template involved (loader's Template field is left zero-valued).
func TestZoneRecordsReadsProviderDirectly(t *testing.T) {
	actual := []model.Record{
		{Type: model.A, Name: "a.example.com.", TTL: 300, Values: []string{"1.1.1.1"}},
		{Type: model.NS, Name: "example.com.", TTL: 3600, Values: []string{"ns1.example.com."}},
	}
	svc, _ := setup(t, actual, dto.TemplateDoc{})
	recs, err := svc.ZoneRecords(context.Background(), uuid.New(), uuid.New())
	if err != nil {
		t.Fatal(err)
	}
	if len(recs) != 2 {
		t.Fatalf("expected 2 records straight from the provider, got %+v", recs)
	}
}

func TestApplyRespectsPruneGuard(t *testing.T) {
	// зона содержит лишнюю запись b (нет в шаблоне) → Prune-кандидат
	actual := []model.Record{
		{Type: model.A, Name: "a.example.com.", TTL: 300, Values: []string{"1.1.1.1"}},
		{Type: model.A, Name: "b.example.com.", TTL: 300, Values: []string{"2.2.2.2"}},
	}
	tmpl := dto.TemplateDoc{Records: []dto.RecordDTO{
		{Type: "A", Name: "a.example.com.", TTL: 300, Values: []string{"1.1.1.1"}}, // in sync
	}}

	// applyPrunes=false → удаление b НЕ применяется
	svc, fp := setup(t, actual, tmpl)
	if _, err := svc.Apply(context.Background(), uuid.New(), uuid.New(), ApplyRequest{ApplyUpdates: true, ApplyPrunes: false}); err != nil {
		t.Fatal(err)
	}
	for _, d := range fp.applied.Diffs {
		if d.Kind == diff.Delete {
			t.Fatalf("prune must be skipped when ApplyPrunes=false, applied: %+v", fp.applied.Diffs)
		}
	}

	// applyPrunes=true → удаление b применяется
	svc2, fp2 := setup(t, actual, tmpl)
	if _, err := svc2.Apply(context.Background(), uuid.New(), uuid.New(), ApplyRequest{ApplyUpdates: true, ApplyPrunes: true}); err != nil {
		t.Fatal(err)
	}
	var sawDelete bool
	for _, d := range fp2.applied.Diffs {
		if d.Kind == diff.Delete && d.Name == "b.example.com." {
			sawDelete = true
		}
	}
	if !sawDelete {
		t.Fatalf("prune must be applied when ApplyPrunes=true, applied: %+v", fp2.applied.Diffs)
	}
}