gitops_test.go

package main

import (
	"bytes"
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"os"
	"path/filepath"
	"slices"
	"strings"
	"testing"

	"gopkg.in/yaml.v3"
)

var fixtureAWSManagedServices = map[string]string{
	"cache":          "elasticache",
	"object-storage": "s3",
	"store":          "rds-postgresql",
	"vault":          "secrets-manager",
}

func TestGenerateBundleGoldenShapes(t *testing.T) {
	t.Parallel()

	tests := []struct {
		name      string
		workspace string
		module    string
		services  []string
		golden    string
	}{
		{
			name:      "acme",
			workspace: "acme-control",
			module:    "identity",
			services:  []string{"accounts", "auth-gateway", "cache", "frontend", "object-storage", "store", "vault"},
			golden:    "testdata/acme-bundle.golden.json",
		},
		{
			name:      "example",
			workspace: "example-control",
			module:    "users",
			services:  []string{"store", "vault", "accounts", "cache", "frontend", "forge-edge", "object-storage"},
			golden:    "testdata/example-bundle.golden.json",
		},
	}

	for _, test := range tests {
		test := test
		t.Run(test.name, func(t *testing.T) {
			t.Parallel()
			root, moduleDir := writeModuleFixture(t, test.workspace, test.module, test.services)
			workspace, err := loadWorkspaceManifest(root)
			if err != nil {
				t.Fatal(err)
			}
			if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
				t.Fatal(err)
			}
			got, err := os.ReadFile(filepath.Join(moduleDir, filepath.FromSlash(bundleRelativeDir), "bundle.json"))
			if err != nil {
				t.Fatal(err)
			}
			if os.Getenv("UPDATE_GOLDEN") != "" {
				if err := os.WriteFile(test.golden, got, 0o644); err != nil {
					t.Fatal(err)
				}
			}
			want, err := os.ReadFile(test.golden)
			if err != nil {
				t.Fatal(err)
			}
			if string(got) != string(want) {
				t.Fatalf("bundle golden mismatch\nwant:\n%s\ngot:\n%s", want, got)
			}

			// Both declared environments must render module-owned overlays.
			for _, environment := range []string{"local", "aws"} {
				overlayObjects(t, moduleDir, environment)
			}
		})
	}
}

func TestIdentityNeutralBaseDefersNamespaceAndIstioHost(t *testing.T) {
	t.Parallel()
	root, moduleDir := writeModuleFixture(t, "acme-control", "identity", []string{"accounts", "frontend"})
	workspace, err := loadWorkspaceManifest(root)
	if err != nil {
		t.Fatal(err)
	}
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatal(err)
	}
	overlayRoot := filepath.Join(moduleDir, filepath.FromSlash(bundleRelativeDir), "overlays", "local")
	baseRoot := filepath.Join(overlayRoot, "base")

	// The base must carry neither identity-bearing object: no Namespace object
	// (its name is the tenant identity) and no host-bearing Gateway/VirtualService
	// live anywhere beneath it.
	if err := filepath.WalkDir(baseRoot, func(file string, entry os.DirEntry, err error) error {
		if err != nil || entry.IsDir() || entry.Name() == "kustomization.yaml" {
			return err
		}
		objects, err := decodeYAMLDocuments(file)
		if err != nil {
			return err
		}
		for _, object := range objects {
			switch object["kind"] {
			case "Namespace", "Gateway", "VirtualService":
				t.Errorf("base file %s bakes identity-bearing object %v", file, object["kind"])
			}
		}
		return nil
	}); err != nil {
		t.Fatal(err)
	}

	// The overlay owns the Namespace object, named for the environment rather than
	// a placeholder. This raw name matters: the CLI validates every raw Namespace
	// against the AppProject destinations before rendering, so a placeholder name
	// here fails promotion.
	namespaceObjects, err := decodeYAMLDocuments(filepath.Join(overlayRoot, "namespace.yaml"))
	if err != nil {
		t.Fatal(err)
	}
	metadata := namespaceObjects[0]["metadata"].(map[string]any)
	if metadata["name"] != "identity-local" {
		t.Errorf("overlay Namespace name = %v, want identity-local", metadata["name"])
	}
	labels := metadata["labels"].(map[string]any)
	if labels["kubernetes.io/metadata.name"] != "identity-local" {
		t.Errorf("overlay Namespace kubernetes.io/metadata.name = %v, want identity-local", labels["kubernetes.io/metadata.name"])
	}

	// The overlay also owns the host-bearing Gateway/VirtualService and names the
	// namespace for every resource the base contributes.
	data, err := os.ReadFile(filepath.Join(overlayRoot, "kustomization.yaml"))
	if err != nil {
		t.Fatal(err)
	}
	var overlay kustomization
	if err := yaml.Unmarshal(data, &overlay); err != nil {
		t.Fatal(err)
	}
	if overlay.Namespace != "identity-local" {
		t.Errorf("overlay namespace transformer = %q, want identity-local", overlay.Namespace)
	}
	for _, want := range []string{"base", "namespace.yaml", "ingress.yaml"} {
		if !slices.Contains(overlay.Resources, want) {
			t.Errorf("overlay resources = %v, missing %q", overlay.Resources, want)
		}
	}
	ingressObjects, err := decodeYAMLDocuments(filepath.Join(overlayRoot, "ingress.yaml"))
	if err != nil {
		t.Fatal(err)
	}
	var sawGateway bool
	var virtualServiceHosts []any
	for _, object := range ingressObjects {
		switch object["kind"] {
		case "Gateway":
			sawGateway = true
		case "VirtualService":
			virtualServiceHosts = object["spec"].(map[string]any)["hosts"].([]any)
		}
	}
	if !sawGateway {
		t.Error("overlay ingress is missing its Gateway")
	}
	if !slices.Equal(virtualServiceHosts, []any{"identity.localhost"}) {
		t.Errorf("overlay VirtualService hosts = %v, want [identity.localhost]", virtualServiceHosts)
	}

	// The effective render still resolves to the environment identity: exactly
	// one Namespace named for the environment, and the environment host on the
	// VirtualService.
	namespaces := 0
	for _, object := range overlayObjects(t, moduleDir, "local") {
		switch object["kind"] {
		case "Namespace":
			namespaces++
			if name := object["metadata"].(map[string]any)["name"]; name != "identity-local" {
				t.Errorf("rendered Namespace name = %v, want identity-local", name)
			}
		case "VirtualService":
			if hosts := object["spec"].(map[string]any)["hosts"].([]any); !slices.Equal(hosts, []any{"identity.localhost"}) {
				t.Errorf("rendered VirtualService hosts = %v, want [identity.localhost]", hosts)
			}
		}
	}
	if namespaces != 1 {
		t.Errorf("rendered Namespace count = %d, want 1", namespaces)
	}
}

func TestGeneratedBundleCarriesNoGitOrArgoTransport(t *testing.T) {
	t.Parallel()
	root, moduleDir := writeModuleFixture(t, "neutral-control", "identity", []string{"accounts", "store"})
	workspace, err := loadWorkspaceManifest(root)
	if err != nil {
		t.Fatal(err)
	}
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatal(err)
	}
	generated := filepath.Join(moduleDir, filepath.FromSlash(bundleRelativeDir))
	forbidden := []string{"repoURL", "targetRevision", "AppProject", "argoproj.io", "fluxcd.io", "sourceRepos"}
	err = filepath.WalkDir(generated, func(file string, entry os.DirEntry, err error) error {
		if err != nil || entry.IsDir() {
			return err
		}
		data, err := os.ReadFile(file)
		if err != nil {
			return err
		}
		for _, token := range forbidden {
			if strings.Contains(string(data), token) {
				t.Errorf("generated file %s contains repository/Argo transport token %q", file, token)
			}
		}
		return nil
	})
	if err != nil {
		t.Fatal(err)
	}

	var bundle moduleBundle
	data, err := os.ReadFile(filepath.Join(generated, "bundle.json"))
	if err != nil {
		t.Fatal(err)
	}
	if err := json.Unmarshal(data, &bundle); err != nil {
		t.Fatal(err)
	}
	if bundle.SchemaVersion != moduleBundleSchema || bundle.Module != "identity" {
		t.Fatalf("bundle identity = %q/%q", bundle.SchemaVersion, bundle.Module)
	}
	if len(bundle.Environments) != 2 {
		t.Fatalf("bundle environments = %d, want local and aws", len(bundle.Environments))
	}
	aws := bundle.Environments[1]
	if aws.Name != "aws" || aws.Cluster != "eks" || aws.ResourcePath != "overlays/aws" {
		t.Fatalf("aws bundle environment = %#v", aws)
	}
	if len(aws.ManagedServiceHandoffs) != 1 || aws.ManagedServiceHandoffs[0].Service != "store" {
		t.Fatalf("aws managed handoffs = %#v", aws.ManagedServiceHandoffs)
	}
	if slices.Contains(aws.Services, "store") {
		t.Fatalf("managed store must not appear as an in-cluster workload: %v", aws.Services)
	}
	if bytes.Contains(data, []byte(`"awsKind"`)) {
		t.Fatalf("bundle.json still emits legacy \"awsKind\" key: %s", data)
	}
	if !bytes.Contains(data, []byte(`"kind"`)) {
		t.Fatalf("bundle.json missing \"kind\" handoff key: %s", data)
	}
}

func TestManagedServiceHandoffReadsLegacyAWSKind(t *testing.T) {
	t.Parallel()

	var current managedServiceHandoff
	if err := json.Unmarshal([]byte(`{"service":"store","kind":"rds-postgresql"}`), &current); err != nil {
		t.Fatal(err)
	}
	if current.Kind != "rds-postgresql" {
		t.Fatalf("kind = %q, want rds-postgresql", current.Kind)
	}

	var legacy managedServiceHandoff
	if err := json.Unmarshal([]byte(`{"service":"store","awsKind":"azure-postgres-flexible"}`), &legacy); err != nil {
		t.Fatal(err)
	}
	if legacy.Kind != "azure-postgres-flexible" {
		t.Fatalf("legacy awsKind not read into kind: %q", legacy.Kind)
	}
}

func TestGenerateBundleIgnoresLegacyGitopsPublicationBlock(t *testing.T) {
	t.Parallel()
	root, moduleDir := writeModuleFixture(t, "legacy-control", "identity", []string{"accounts"})
	// A consumer workspace migrated from the previous release still carries the
	// CLI GitOps publication block. The plugin must parse the workspace and
	// ignore that block entirely rather than depend on any repository field.
	appendWorkspace(t, root, `
gitops:
  repo-url: git@github.com:acme/platform-config.git
  branch: main
  revision: 0123456789abcdef0123456789abcdef01234567
  inventory: clusters/codefly/deployments/modules/identity/.codefly-render.json
  environment: local
`)
	workspace, err := loadWorkspaceManifest(root)
	if err != nil {
		t.Fatal(err)
	}
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatal(err)
	}
}

func TestGenerateBundleRendersEnvironmentWithoutPublicIngress(t *testing.T) {
	t.Parallel()
	root, moduleDir := writeModuleFixture(t, "mixed-control", "identity", []string{"accounts", "store"})
	workspace, err := loadWorkspaceManifest(root)
	if err != nil {
		t.Fatal(err)
	}
	// aws is a declared deploy target that has not configured public ingress.
	// A single incompletely-exposed environment must not fail the whole bundle
	// or the sibling environments that are fully configured.
	workspace.Environments[1].Ingress = nil
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatalf("generateDeploymentBundle() with an ingress-less environment: %v", err)
	}

	overlays := filepath.Join(moduleDir, filepath.FromSlash(bundleRelativeDir), "overlays")
	if _, err := os.Stat(filepath.Join(overlays, "local", "ingress.yaml")); err != nil {
		t.Fatalf("fully configured local overlay is missing its gateway: %v", err)
	}
	if _, err := os.Stat(filepath.Join(overlays, "aws", "ingress.yaml")); !errors.Is(err, os.ErrNotExist) {
		t.Fatalf("ingress-less aws overlay emitted a public gateway: %v", err)
	}
	if _, err := os.Stat(filepath.Join(overlays, "aws", "namespace.yaml")); err != nil {
		t.Errorf("ingress-less aws overlay is missing its Namespace object: %v", err)
	}
	awsBase := filepath.Join(overlays, "aws", "base")
	for _, base := range []string{"network-policy.yaml", "istio-mtls.yaml"} {
		if _, err := os.Stat(filepath.Join(awsBase, base)); err != nil {
			t.Errorf("ingress-less aws overlay is missing module-owned %s: %v", base, err)
		}
	}
	for _, object := range overlayObjects(t, moduleDir, "aws") {
		if kind := object["kind"]; kind == "Gateway" || kind == "VirtualService" {
			t.Fatalf("ingress-less aws overlay still emits %v", kind)
		}
	}

	var bundle moduleBundle
	data, err := os.ReadFile(filepath.Join(moduleDir, filepath.FromSlash(bundleRelativeDir), "bundle.json"))
	if err != nil {
		t.Fatal(err)
	}
	if err := json.Unmarshal(data, &bundle); err != nil {
		t.Fatal(err)
	}
	if len(bundle.Environments) != 2 || bundle.Environments[1].Name != "aws" || len(bundle.Environments[1].Ingress) != 0 {
		t.Fatalf("bundle did not record the ingress-less aws environment: %#v", bundle.Environments)
	}
}

func TestGenerateBundleRejectsHostileContracts(t *testing.T) {
	t.Parallel()

	tests := []struct {
		name   string
		mutate func(t *testing.T, moduleDir string, workspace *workspaceManifest)
		want   string
	}{
		{
			name: "no declared environments",
			mutate: func(_ *testing.T, _ string, workspace *workspaceManifest) {
				workspace.Environments = nil
			},
			want: "declares no deployment environments",
		},
		{
			name: "missing namespace",
			mutate: func(_ *testing.T, _ string, workspace *workspaceManifest) {
				workspace.Environments[0].Namespace = ""
			},
			want: "Kubernetes DNS label",
		},
		{
			name: "duplicate environment",
			mutate: func(_ *testing.T, _ string, workspace *workspaceManifest) {
				workspace.Environments[1].Name = "local"
			},
			want: "more than once",
		},
		{
			name: "wildcard ingress host",
			mutate: func(_ *testing.T, _ string, workspace *workspaceManifest) {
				workspace.Environments[0].Ingress = []environmentIngressRoute{{
					Name:     "product",
					Service:  "accounts",
					Endpoint: "http",
					Hosts:    []string{"*"},
				}}
			},
			want: "is not an exact DNS name",
		},
		{
			name: "ingress targets private endpoint",
			mutate: func(_ *testing.T, _ string, workspace *workspaceManifest) {
				workspace.Environments[0].Ingress = []environmentIngressRoute{{
					Name:     "product",
					Service:  "frontend",
					Endpoint: "http",
					Hosts:    []string{"identity.localhost"},
				}}
			},
			want: "is not a public module interface",
		},
		{
			name: "unsupported cluster kind",
			mutate: func(_ *testing.T, _ string, workspace *workspaceManifest) {
				workspace.Environments[0].Cluster.Kind = "openshift"
			},
			want: "is not supported",
		},
		{
			name: "managed service on in-cluster environment",
			mutate: func(_ *testing.T, _ string, workspace *workspaceManifest) {
				workspace.Environments[0].ManagedServices = map[string]managedServiceConfig{
					"store": {Kind: "rds-postgresql", ExternalName: "db.internal.example.com"},
				}
			},
			want: "managed services for an in-cluster environment",
		},
		{
			name: "unexpected managed service",
			mutate: func(_ *testing.T, _ string, workspace *workspaceManifest) {
				workspace.Environments[1].ManagedServices["phantom"] = managedServiceConfig{
					Kind:         "rds-postgresql",
					ExternalName: "db.internal.example.com",
					EgressCIDRs:  []string{"10.42.0.0/24"},
				}
			},
			want: "unexpected managed service",
		},
		{
			name: "unsupported managed kind",
			mutate: func(_ *testing.T, _ string, workspace *workspaceManifest) {
				config := workspace.Environments[1].ManagedServices["store"]
				config.Kind = "dynamodb"
				workspace.Environments[1].ManagedServices["store"] = config
			},
			want: "is not supported",
		},
		{
			name: "invalid managed egress cidr",
			mutate: func(_ *testing.T, _ string, workspace *workspaceManifest) {
				config := workspace.Environments[1].ManagedServices["store"]
				config.EgressCIDRs = []string{"not-a-cidr"}
				workspace.Environments[1].ManagedServices["store"] = config
			},
			want: "egress CIDR",
		},
		{
			name: "incomplete managed secret reference",
			mutate: func(_ *testing.T, _ string, workspace *workspaceManifest) {
				config := workspace.Environments[1].ManagedServices["store"]
				config.SecretReferences = []managedSecretReference{{
					Name:        "store-runtime",
					RemoteKey:   "",
					SecretStore: secretStoreRef{Name: "aws", Kind: "ClusterSecretStore"},
				}}
				workspace.Environments[1].ManagedServices["store"] = config
			},
			want: "secret reference",
		},
		{
			name: "cloud sql without an explicit auth mode",
			mutate: func(_ *testing.T, _ string, workspace *workspaceManifest) {
				config := workspace.Environments[1].ManagedServices["store"]
				config.Kind = "cloud-sql-postgres"
				config.InstanceConnectionName = "identity-prod:us-central1:store"
				workspace.Environments[1].ManagedServices["store"] = config
			},
			want: "requires an explicit auth-mode",
		},
		{
			name: "cloud sql without an instance connection name",
			mutate: func(_ *testing.T, _ string, workspace *workspaceManifest) {
				config := workspace.Environments[1].ManagedServices["store"]
				config.Kind = "cloud-sql-postgres"
				config.AuthMode = "external-identity"
				workspace.Environments[1].ManagedServices["store"] = config
			},
			want: "is not a project:region:instance name",
		},
		{
			name: "malformed instance connection name",
			mutate: func(_ *testing.T, _ string, workspace *workspaceManifest) {
				config := workspace.Environments[1].ManagedServices["store"]
				config.Kind = "cloud-sql-postgres"
				config.AuthMode = "external-identity"
				config.InstanceConnectionName = "identity-prod:us-central1"
				workspace.Environments[1].ManagedServices["store"] = config
			},
			want: "is not a project:region:instance name",
		},
		{
			name: "instance connection name on a non cloud sql kind",
			mutate: func(_ *testing.T, _ string, workspace *workspaceManifest) {
				config := workspace.Environments[1].ManagedServices["store"]
				config.InstanceConnectionName = "identity-prod:us-central1:store"
				workspace.Environments[1].ManagedServices["store"] = config
			},
			want: "does not take an instance-connection-name",
		},
		{
			name: "unsupported managed auth mode",
			mutate: func(_ *testing.T, _ string, workspace *workspaceManifest) {
				config := workspace.Environments[1].ManagedServices["store"]
				config.AuthMode = "kerberos"
				workspace.Environments[1].ManagedServices["store"] = config
			},
			want: "auth-mode",
		},
		{
			name: "external identity with a connection secret",
			mutate: func(_ *testing.T, _ string, workspace *workspaceManifest) {
				config := workspace.Environments[1].ManagedServices["store"]
				config.AuthMode = "external-identity"
				config.SecretReferences = []managedSecretReference{{
					Name:        "store-runtime",
					RemoteKey:   "products/identity/store",
					SecretStore: secretStoreRef{Name: "gcp", Kind: "ClusterSecretStore"},
				}}
				workspace.Environments[1].ManagedServices["store"] = config
			},
			want: "declares secret references",
		},
		{
			name: "missing service path",
			mutate: func(t *testing.T, moduleDir string, _ *workspaceManifest) {
				t.Helper()
				if err := os.RemoveAll(filepath.Join(moduleDir, "services", "frontend")); err != nil {
					t.Fatal(err)
				}
			},
			want: "declared service \"frontend\" path",
		},
		{
			name: "extra service path",
			mutate: func(t *testing.T, moduleDir string, _ *workspaceManifest) {
				t.Helper()
				if err := os.MkdirAll(filepath.Join(moduleDir, "services", "phantom"), 0o755); err != nil {
					t.Fatal(err)
				}
			},
			want: "has no module service declaration",
		},
		{
			name: "duplicate Kubernetes workload identity",
			mutate: func(t *testing.T, moduleDir string, _ *workspaceManifest) {
				t.Helper()
				replaceInServiceManifest(t, moduleDir, "accounts", "  deployment:\n", "  deployment:\n    kubernetes:\n      service-name: shared\n      app-label: accounts\n")
				replaceInServiceManifest(t, moduleDir, "frontend", "  deployment:\n", "  deployment:\n    kubernetes:\n      service-name: shared\n      app-label: frontend\n")
			},
			want: "share Kubernetes service name",
		},
		{
			name: "symlinked service path",
			mutate: func(t *testing.T, moduleDir string, _ *workspaceManifest) {
				t.Helper()
				if err := os.RemoveAll(filepath.Join(moduleDir, "services", "accounts")); err != nil {
					t.Fatal(err)
				}
				if err := os.Symlink(t.TempDir(), filepath.Join(moduleDir, "services", "accounts")); err != nil {
					t.Fatal(err)
				}
			},
			want: "is not a directory",
		},
		{
			name: "deploy job with a missing catalog artifact",
			mutate: func(t *testing.T, moduleDir string, _ *workspaceManifest) {
				t.Helper()
				appendDeployJob(t, moduleDir, "store", "http")
			},
			want: "catalog artifact",
		},
		{
			name: "deploy job writing to a non-dependency",
			mutate: func(t *testing.T, moduleDir string, _ *workspaceManifest) {
				t.Helper()
				writeCatalogArtifact(t, moduleDir)
				appendDeployJob(t, moduleDir, "frontend", "http")
			},
			want: "does not declare that dependency",
		},
		{
			name: "deploy job for an undeclared service",
			mutate: func(t *testing.T, moduleDir string, _ *workspaceManifest) {
				t.Helper()
				writeCatalogArtifact(t, moduleDir)
				appendDeployJob(t, moduleDir, "store", "http")
				replaceInDeployJobs(t, moduleDir, "    service: accounts\n", "    service: phantom\n")
			},
			want: "references undeclared service",
		},
		{
			name: "deploy job to a migration-bearing target without ordering",
			mutate: func(t *testing.T, moduleDir string, _ *workspaceManifest) {
				t.Helper()
				writeCatalogArtifact(t, moduleDir)
				// store declares bootstrap_job_endpoints (a migration Job), so a
				// deploy Job that writes to it but omits it from after would let the
				// import race the migration and write against a missing schema.
				writeDeployJobs(t, moduleDir,
					"deploy_jobs:\n"+
						"  - name: role-catalog-import\n"+
						"    service: accounts\n"+
						"    command: role-catalog-import\n"+
						"    catalog: deployment/generated/contributed-roles.json\n"+
						"    force: true\n"+
						"    writes:\n"+
						"      service: store\n"+
						"      endpoint: http\n")
			},
			want: "must run after it",
		},
	}

	for _, test := range tests {
		test := test
		t.Run(test.name, func(t *testing.T) {
			t.Parallel()
			root, moduleDir := writeModuleFixture(t, "hostile-control", "identity", []string{"accounts", "frontend", "store"})
			workspace, err := loadWorkspaceManifest(root)
			if err != nil {
				t.Fatal(err)
			}
			test.mutate(t, moduleDir, workspace)
			err = generateDeploymentBundle(moduleDir, workspace)
			if err == nil || !strings.Contains(err.Error(), test.want) {
				t.Fatalf("generateDeploymentBundle() error = %v, want substring %q", err, test.want)
			}
		})
	}
}

func TestGeneratedPoliciesAndGatewayMatchTopology(t *testing.T) {
	t.Parallel()
	root, moduleDir := writeModuleFixture(
		t,
		"policy-control",
		"identity",
		[]string{"accounts", "auth-gateway", "store"},
	)
	workspace, err := loadWorkspaceManifest(root)
	if err != nil {
		t.Fatal(err)
	}
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatal(err)
	}
	generated := filepath.Join(moduleDir, filepath.FromSlash(bundleRelativeDir), "overlays")
	namespaceObjects, err := decodeYAMLDocuments(filepath.Join(generated, "local", "namespace.yaml"))
	if err != nil {
		t.Fatal(err)
	}
	namespaceMetadata := namespaceObjects[0]["metadata"].(map[string]any)
	namespaceLabels := namespaceMetadata["labels"].(map[string]any)
	if namespaceLabels["istio.io/dataplane-mode"] != "ambient" {
		t.Fatalf("local namespace dataplane mode = %v, want ambient", namespaceLabels["istio.io/dataplane-mode"])
	}
	if _, sidecarInjection := namespaceLabels["istio-injection"]; sidecarInjection {
		t.Fatal("local namespace enables sidecar injection alongside the ambient mesh")
	}
	// This fixture ships no authorization catalog, so there is no L7 policy and
	// the namespace waypoint must not be provisioned.
	if _, waypointed := namespaceLabels["istio.io/use-waypoint"]; waypointed {
		t.Error("namespace opts into a waypoint without any L7 policy to enforce")
	}
	localNetwork, err := os.ReadFile(filepath.Join(generated, "local", "base", "network-policy.yaml"))
	if err != nil {
		t.Fatal(err)
	}
	for _, policy := range []string{
		"allow-ambient-hbone-transport",
		"allow-istio-ingress-to-auth-gateway",
		"allow-accounts-to-store",
		"allow-store-from-accounts",
		"allow-store-from-bootstrap",
		"allow-store-bootstrap-to-store",
		"allow-auth-gateway-public-egress",
	} {
		if !strings.Contains(string(localNetwork), "name: "+policy) {
			t.Errorf("local network policy is missing %q", policy)
		}
	}
	if count := strings.Count(string(localNetwork), "port: 15008"); count != 2 {
		t.Errorf("local network policy has %d ambient HBONE transport exceptions, want 2", count)
	}
	if count := strings.Count(string(localNetwork), "codefly.dev/bootstrap-service: store"); count != 2 {
		t.Errorf("local network policy has %d bootstrap service selectors, want 2", count)
	}

	localIstio, err := os.ReadFile(filepath.Join(generated, "local", "base", "istio-mtls.yaml"))
	if err != nil {
		t.Fatal(err)
	}
	for _, expected := range []string{
		"name: allow-store-from-internal-topology",
		"cluster.local/ns/identity-local/sa/default",
		`- "8080"`,
	} {
		if !strings.Contains(string(localIstio), expected) {
			t.Errorf("local Istio policy is missing %q", expected)
		}
	}
	awsIstio, err := os.ReadFile(filepath.Join(generated, "aws", "base", "istio-mtls.yaml"))
	if err != nil {
		t.Fatal(err)
	}
	if strings.Contains(string(awsIstio), "allow-store-from-internal-topology") {
		t.Error("AWS Istio policy grants internal authority to managed Postgres")
	}

	gatewayObjects, err := decodeYAMLDocuments(filepath.Join(generated, "local", "ingress.yaml"))
	if err != nil {
		t.Fatal(err)
	}
	var gatewayName string
	var routeGateways []any
	for _, object := range gatewayObjects {
		metadata := object["metadata"].(map[string]any)
		switch object["kind"] {
		case "Gateway":
			gatewayName, _ = metadata["name"].(string)
		case "VirtualService":
			spec := object["spec"].(map[string]any)
			routeGateways, _ = spec["gateways"].([]any)
		}
	}
	if gatewayName != "identity" || len(routeGateways) != 1 || routeGateways[0] != "identity" {
		t.Errorf("generated Gateway %q and route gateways %#v do not match the module-owned route contract", gatewayName, routeGateways)
	}

	// No AppProject / Application is emitted anywhere in the overlay.
	for _, environment := range []string{"local", "aws"} {
		objects := overlayObjects(t, moduleDir, environment)
		for _, object := range objects {
			if kind := object["kind"]; kind == "AppProject" || kind == "Application" {
				t.Fatalf("%s overlay still emits Argo %v", environment, kind)
			}
		}
	}

	awsNetwork, err := os.ReadFile(filepath.Join(generated, "aws", "base", "network-policy.yaml"))
	if err != nil {
		t.Fatal(err)
	}
	if !strings.Contains(string(awsNetwork), "cidr: 10.42.0.0/24") ||
		!strings.Contains(string(awsNetwork), "name: allow-accounts-to-store") {
		t.Errorf("AWS network policy does not bind the managed store CIDR:\n%s", awsNetwork)
	}
	if strings.Contains(string(awsNetwork), "allow-store-from-bootstrap") ||
		strings.Contains(string(awsNetwork), "allow-store-bootstrap-to-store") {
		t.Errorf("AWS network policy retains bootstrap authority for managed Postgres:\n%s", awsNetwork)
	}
}

func TestDeployJobWiresCatalogImport(t *testing.T) {
	t.Parallel()
	root, moduleDir := writeModuleFixture(
		t,
		"catalog-deploy",
		"identity",
		[]string{"accounts", "auth-gateway", "store"},
	)
	writeCatalogArtifact(t, moduleDir)
	appendDeployJob(t, moduleDir, "store", "http")
	workspace, err := loadWorkspaceManifest(root)
	if err != nil {
		t.Fatal(err)
	}
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatal(err)
	}

	var bundle moduleBundle
	data, err := os.ReadFile(filepath.Join(moduleDir, filepath.FromSlash(bundleRelativeDir), "bundle.json"))
	if err != nil {
		t.Fatal(err)
	}
	if err := json.Unmarshal(data, &bundle); err != nil {
		t.Fatal(err)
	}
	// Both environments schedule the import: the store is in-cluster locally and
	// a managed handoff on AWS, and either way the driver must run the step so a
	// contributing module's roles land with no manual invocation.
	if len(bundle.Environments) != 2 {
		t.Fatalf("bundle environments = %d, want local and aws", len(bundle.Environments))
	}
	for _, env := range bundle.Environments {
		if len(env.DeployJobs) != 1 {
			t.Fatalf("%s environment deploy jobs = %d, want 1", env.Name, len(env.DeployJobs))
		}
		job := env.DeployJobs[0]
		if job.Name != "role-catalog-import" || job.Service != "accounts" || job.Command != "role-catalog-import" || !job.Force {
			t.Fatalf("%s deploy job = %#v", env.Name, job)
		}
		if job.Catalog != "deployment/generated/contributed-roles.json" {
			t.Errorf("%s deploy job catalog = %q", env.Name, job.Catalog)
		}
		if job.Writes.Service != "store" || job.Writes.Endpoint != "http" || job.Writes.Port != 8080 {
			t.Errorf("%s deploy job write target = %#v", env.Name, job.Writes)
		}
		if !slices.Equal(job.After, []string{"store"}) {
			t.Errorf("%s deploy job ordering = %v", env.Name, job.After)
		}
	}

	overlays := filepath.Join(moduleDir, filepath.FromSlash(bundleRelativeDir), "overlays")
	localNetwork := mustReadFile(t, filepath.Join(overlays, "local", "base", "network-policy.yaml"))
	for _, name := range []string{
		"allow-store-from-role-catalog-import",
		"allow-role-catalog-import-to-store",
	} {
		if !strings.Contains(localNetwork, "name: "+name) {
			t.Errorf("local network policy is missing deploy-job reach %q", name)
		}
	}
	if !strings.Contains(localNetwork, "codefly.dev/deploy-job: role-catalog-import") {
		t.Error("local network policy does not scope the deploy-job pod identity")
	}

	// The managed store reaches out of cluster; the module renders no in-cluster
	// reach policy for it, exactly as it omits the store's bootstrap authority.
	awsNetwork := mustReadFile(t, filepath.Join(overlays, "aws", "base", "network-policy.yaml"))
	if strings.Contains(awsNetwork, "role-catalog-import") {
		t.Errorf("AWS network policy renders a deploy-job reach for a managed store:\n%s", awsNetwork)
	}
}

func TestGeneratedMeshBaselineIsStrictMTLSDefaultDeny(t *testing.T) {
	t.Parallel()
	root, moduleDir := writeModuleFixture(
		t,
		"mesh-control",
		"identity",
		[]string{"accounts", "auth-gateway", "store"},
	)
	workspace, err := loadWorkspaceManifest(root)
	if err != nil {
		t.Fatal(err)
	}
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatal(err)
	}
	overlays := filepath.Join(moduleDir, filepath.FromSlash(bundleRelativeDir), "overlays")

	// The mesh baseline is the reach gate every mesh-delivered control builds on,
	// so it must hold in the in-cluster overlay and the managed-service overlay
	// alike. Assert it structurally in both so no environment silently regresses.
	for _, environment := range []string{"local", "aws"} {
		path := filepath.Join(overlays, environment, "base", "istio-mtls.yaml")
		objects, err := decodeYAMLDocuments(path)
		if err != nil {
			t.Fatalf("%s mesh baseline: %v", environment, err)
		}

		var peerAuthentications, denies, allows int
		for _, object := range objects {
			metadata := object["metadata"].(map[string]any)
			name, _ := metadata["name"].(string)
			switch object["kind"] {
			case "PeerAuthentication":
				peerAuthentications++
				spec := object["spec"].(map[string]any)
				if _, scoped := spec["selector"]; scoped {
					t.Errorf("%s PeerAuthentication %q is workload-scoped, want mesh-wide", environment, name)
				}
				mode := spec["mtls"].(map[string]any)["mode"]
				if mode != "STRICT" {
					t.Errorf("%s PeerAuthentication %q mtls mode = %v, want STRICT", environment, name, mode)
				}
			case "AuthorizationPolicy":
				spec, _ := object["spec"].(map[string]any)
				if name == "default-deny" {
					denies++
					// A namespace-wide ALLOW policy with no rules matches nothing,
					// so every workload denies by default until an explicit allow
					// grants it. A selector, any rules, or a DENY action would break
					// that invariant.
					if _, scoped := spec["selector"]; scoped {
						t.Errorf("%s default-deny is workload-scoped, want namespace-wide", environment)
					}
					if _, ruled := spec["rules"]; ruled {
						t.Errorf("%s default-deny declares rules, want an empty deny-all policy", environment)
					}
					if action, ok := spec["action"]; ok && action != "ALLOW" {
						t.Errorf("%s default-deny action = %v, want the empty-ALLOW deny-all form", environment, action)
					}
				} else {
					allows++
				}
			}
		}

		if peerAuthentications != 1 {
			t.Errorf("%s mesh baseline has %d PeerAuthentication objects, want exactly one mesh-wide policy", environment, peerAuthentications)
		}
		if denies != 1 {
			t.Errorf("%s mesh baseline has %d namespace default-deny AuthorizationPolicies, want exactly one", environment, denies)
		}
		// Default-deny is inert without the explicit per-dependency allows layered
		// on top of it; assert at least one so the deny-all never ships alone.
		if allows == 0 {
			t.Errorf("%s mesh baseline has a default-deny but no explicit allow policies", environment)
		}

		raw, err := os.ReadFile(path)
		if err != nil {
			t.Fatal(err)
		}
		if strings.Contains(string(raw), "PERMISSIVE") {
			t.Errorf("%s mesh baseline contains a PERMISSIVE mTLS fallback:\n%s", environment, raw)
		}
	}

	// Injection is enforced through the ambient dataplane label, not sidecar
	// injection: every pod in the namespace is captured by the mesh, so an
	// un-injected pod cannot receive traffic outside mTLS.
	namespaceObjects, err := decodeYAMLDocuments(filepath.Join(overlays, "local", "namespace.yaml"))
	if err != nil {
		t.Fatal(err)
	}
	namespaceLabels := namespaceObjects[0]["metadata"].(map[string]any)["labels"].(map[string]any)
	if namespaceLabels["istio.io/dataplane-mode"] != "ambient" {
		t.Errorf("namespace dataplane mode = %v, want ambient so every pod is meshed", namespaceLabels["istio.io/dataplane-mode"])
	}
}

func TestGeneratedMeshPolicyGatesInternalAuthorityByCallerServiceAccount(t *testing.T) {
	t.Parallel()
	root, moduleDir := writeModuleFixture(t, "authority", "identity", []string{"accounts", "auth-gateway"})
	// Realistic identity graph: accounts exposes an internal method and runs
	// under a distinct SA; auth-gateway is its only declared caller and also
	// runs under a distinct SA. This is what lets the policy gate by workload
	// identity instead of the shared sa/default.
	writeTestFile(t, filepath.Join(moduleDir, "services", "accounts", "service.codefly.yaml"),
		serviceManifestFixture("accounts", "http", "http", "private", 8080, "", "  service-account:\n    name: accounts\n", ""))
	writeTestFile(t, filepath.Join(moduleDir, "services", "auth-gateway", "service.codefly.yaml"),
		serviceManifestFixture("auth-gateway", "http", "http", "private", 8080,
			"service-dependencies:\n  - name: accounts\n    endpoints:\n      - name: http\n",
			"  service-account:\n    name: auth-gateway\n",
			"    public-egress-ports:\n      - 443\n"))
	writeTestFile(t, filepath.Join(moduleDir, "services", "accounts", "generated", "authz-methods.json"), `{
  "schema_version": "saas.authz.methods.v1",
  "methods": [
    {"procedure": "/saas.accounts.v1.APIKeyService/ValidateAPIKey", "policy": {"exposure": "EXPOSURE_INTERNAL"}},
    {"procedure": "/saas.accounts.v1.AuthService/Authenticate", "policy": {"exposure": "EXPOSURE_PUBLIC"}}
  ]
}`)
	workspace, err := loadWorkspaceManifest(root)
	if err != nil {
		t.Fatal(err)
	}
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatal(err)
	}
	istioPath := filepath.Join(moduleDir, filepath.FromSlash(bundleRelativeDir), "overlays", "local", "base", "istio-mtls.yaml")
	objects, err := decodeYAMLDocuments(istioPath)
	if err != nil {
		t.Fatal(err)
	}

	strictMTLS := false
	var authority map[string]any
	var portAllow map[string]any
	var waypoint map[string]any
	for _, object := range objects {
		metadata := object["metadata"].(map[string]any)
		switch object["kind"] {
		case "PeerAuthentication":
			mtls := object["spec"].(map[string]any)["mtls"].(map[string]any)
			if mtls["mode"] == "STRICT" {
				strictMTLS = true
			}
		case "AuthorizationPolicy":
			switch metadata["name"] {
			case "allow-accounts-internal-authority":
				authority = object
			case "allow-accounts-from-internal-topology":
				portAllow = object
			}
		case "Gateway":
			if object["apiVersion"] == "gateway.networking.k8s.io/v1" {
				waypoint = object
			}
		}
	}
	if !strictMTLS {
		t.Fatal("mesh baseline is missing STRICT PeerAuthentication")
	}
	if authority == nil {
		t.Fatalf("istio bundle is missing the internal-authority allow policy:\n%s", mustReadFile(t, istioPath))
	}

	// The internal-authority allow is an L7 (method-path) policy; ztunnel is L4
	// only, so it is enforced only if a waypoint fronts the namespace. Without
	// this the policy would be silently inert in the ambient mesh.
	if waypoint == nil {
		t.Fatalf("L7 internal-authority policy has no waypoint to enforce it:\n%s", mustReadFile(t, istioPath))
	}
	if class := waypoint["spec"].(map[string]any)["gatewayClassName"]; class != "istio-waypoint" {
		t.Errorf("waypoint gatewayClassName = %v, want istio-waypoint", class)
	}
	if wpFor := waypoint["metadata"].(map[string]any)["labels"].(map[string]any)["istio.io/waypoint-for"]; wpFor != "service" {
		t.Errorf("waypoint istio.io/waypoint-for = %v, want service", wpFor)
	}
	namespaceObjects, err := decodeYAMLDocuments(filepath.Join(moduleDir, filepath.FromSlash(bundleRelativeDir), "overlays", "local", "namespace.yaml"))
	if err != nil {
		t.Fatal(err)
	}
	nsLabels := namespaceObjects[0]["metadata"].(map[string]any)["labels"].(map[string]any)
	if nsLabels["istio.io/use-waypoint"] != waypoint["metadata"].(map[string]any)["name"] {
		t.Errorf("namespace use-waypoint = %v, want %v", nsLabels["istio.io/use-waypoint"], waypoint["metadata"].(map[string]any)["name"])
	}

	const (
		callerSA  = "cluster.local/ns/identity-local/sa/auth-gateway"
		defaultSA = "cluster.local/ns/identity-local/sa/default"
		ingressSA = "cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account"
	)

	spec := authority["spec"].(map[string]any)
	// Positive ALLOW, not the old fail-open notPrincipals DENY: an unlisted SA
	// is default-denied once an ALLOW selects the workload.
	if spec["action"] != "ALLOW" {
		t.Errorf("internal-authority policy action = %v, want ALLOW", spec["action"])
	}
	// A selector sends the policy to ztunnel, which cannot evaluate L7 rules and
	// fails safe by turning the whole policy into a blanket DENY on the selected
	// workload. L7 must be attached to the waypoint, by targetRef to the Service.
	if _, scoped := spec["selector"]; scoped {
		t.Error("L7 internal-authority policy uses a workload selector; ztunnel would turn it into a blanket deny")
	}
	targetRef := spec["targetRefs"].([]any)[0].(map[string]any)
	if targetRef["kind"] != "Service" || targetRef["name"] != "accounts" {
		t.Errorf("internal-authority targetRef = %v, want the accounts Service", targetRef)
	}
	rule := spec["rules"].([]any)[0].(map[string]any)
	principals := anyToStrings(rule["from"].([]any)[0].(map[string]any)["source"].(map[string]any)["principals"].([]any))
	// Only accounts' declared caller (auth-gateway), named by its per-service
	// SA — not the shared sa/default, and not the ingress gateway.
	if !slices.Equal(principals, []string{callerSA}) {
		t.Errorf("internal-authority principals = %v, want only the caller SA [%s]", principals, callerSA)
	}
	if slices.Contains(principals, defaultSA) {
		t.Error("internal-authority allowlist must not admit the shared sa/default (any namespace pod)")
	}
	if slices.Contains(principals, ingressSA) {
		t.Error("ingress gateway SA must not reach the internal method paths")
	}
	paths := anyToStrings(rule["to"].([]any)[0].(map[string]any)["operation"].(map[string]any)["paths"].([]any))
	if !slices.Contains(paths, "/saas.accounts.v1.APIKeyService/ValidateAPIKey") {
		t.Errorf("internal-authority paths %v missing the internal ValidateAPIKey method", paths)
	}
	if slices.Contains(paths, "/saas.accounts.v1.AuthService/Authenticate") {
		t.Error("internal-authority allow must not cover the public Authenticate method")
	}

	// The L4 port allow is caller-scoped too, so even without the waypoint the
	// target is reachable only by its declared caller — not any sa/default pod.
	if portAllow == nil {
		t.Fatalf("istio bundle is missing the accounts port allow:\n%s", mustReadFile(t, istioPath))
	}
	portPrincipals := anyToStrings(portAllow["spec"].(map[string]any)["rules"].([]any)[0].(map[string]any)["from"].([]any)[0].(map[string]any)["source"].(map[string]any)["principals"].([]any))
	// With a waypoint fronting the namespace, the destination ztunnel sees the
	// waypoint's identity rather than the caller's, so the L4 allowlist must
	// admit it or every east-west request is dropped before the L7 gate runs.
	waypointSA := "cluster.local/ns/identity-local/sa/" + meshWaypointName
	if !slices.Contains(portPrincipals, waypointSA) {
		t.Errorf("port-allow principals = %v, missing the waypoint identity %s that relays east-west traffic", portPrincipals, waypointSA)
	}
	if !slices.Equal(portPrincipals, []string{callerSA, waypointSA}) {
		t.Errorf("accounts port-allow principals = %v, want only the caller SA [%s] and the waypoint", portPrincipals, callerSA)
	}
}

// TestGeneratedMeshPolicyDeniesInternalHTTPRoutesToUndeclaredCallers covers the
// half of the internal surface no service catalog describes: HTTP routes that
// carry cluster-internal authority on the same port the ingress gateway is
// allowed to reach for every browser-facing page. The port-wide ALLOW cannot
// exclude them, so only a DENY can, and it must survive the caller having an
// identity (the publisher edge) and not having one (the internet).
func TestGeneratedMeshPolicyDeniesInternalHTTPRoutesToUndeclaredCallers(t *testing.T) {
	t.Parallel()
	root, moduleDir := writeModuleFixture(t, "internal-http", "identity", []string{"frontend", "telemetry"})
	// frontend publishes an internal HTTP surface on its public port; telemetry is
	// its one declared in-mesh caller, so it is the only exempt principal. The
	// fixture ships no authorization catalog, so the DENY is the only L7 policy
	// and must pull in the waypoint on its own.
	writeTestFile(t, filepath.Join(moduleDir, "services", "frontend", "service.codefly.yaml"),
		serviceManifestFixture("frontend", "http", "http", "public", 3000, "", "",
			"    internal-http-routes:\n      - path: /api/solutions/register\n        methods:\n          - DELETE\n          - POST\n    public-egress-ports:\n      - 443\n"))
	writeTestFile(t, filepath.Join(moduleDir, "services", "telemetry", "service.codefly.yaml"),
		serviceManifestFixture("telemetry", "http", "http", "private", 8080,
			"service-dependencies:\n  - name: frontend\n    endpoints:\n      - name: http\n",
			"  service-account:\n    name: telemetry\n", ""))
	workspace, err := loadWorkspaceManifest(root)
	if err != nil {
		t.Fatal(err)
	}
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatal(err)
	}
	istioPath := filepath.Join(moduleDir, filepath.FromSlash(bundleRelativeDir), "overlays", "local", "base", "istio-mtls.yaml")
	objects, err := decodeYAMLDocuments(istioPath)
	if err != nil {
		t.Fatal(err)
	}

	var deny, ingressAllow, waypoint map[string]any
	for _, object := range objects {
		name := object["metadata"].(map[string]any)["name"]
		switch object["kind"] {
		case "AuthorizationPolicy":
			switch name {
			case "deny-frontend-internal-http":
				deny = object
			case "allow-istio-ingress-to-frontend":
				ingressAllow = object
			}
		case "Gateway":
			waypoint = object
		}
	}
	if deny == nil {
		t.Fatalf("istio bundle is missing the internal-HTTP deny policy:\n%s", mustReadFile(t, istioPath))
	}
	if ingressAllow == nil {
		t.Fatal("fixture no longer grants the ingress gateway the port-wide allow this deny subtracts from")
	}
	if waypoint == nil {
		t.Fatalf("an L7 deny with no waypoint to enforce it is inert:\n%s", mustReadFile(t, istioPath))
	}
	namespaceObjects, err := decodeYAMLDocuments(filepath.Join(moduleDir, filepath.FromSlash(bundleRelativeDir), "overlays", "local", "namespace.yaml"))
	if err != nil {
		t.Fatal(err)
	}
	nsLabels := namespaceObjects[0]["metadata"].(map[string]any)["labels"].(map[string]any)
	if nsLabels["istio.io/use-waypoint"] != waypoint["metadata"].(map[string]any)["name"] {
		t.Errorf("namespace use-waypoint = %v, want %v", nsLabels["istio.io/use-waypoint"], waypoint["metadata"].(map[string]any)["name"])
	}

	spec := deny["spec"].(map[string]any)
	if spec["action"] != "DENY" {
		t.Errorf("internal-HTTP policy action = %v, want DENY (an ALLOW cannot subtract from another ALLOW)", spec["action"])
	}
	// A selector sends an L7 policy to ztunnel, which cannot evaluate paths and
	// fails safe by denying everything to the selected workload — here, every
	// page the product serves. L7 belongs on the waypoint, via targetRef.
	if _, scoped := spec["selector"]; scoped {
		t.Error("L7 internal-HTTP policy uses a workload selector; ztunnel would turn it into a blanket deny on the frontend")
	}
	targetRef := spec["targetRefs"].([]any)[0].(map[string]any)
	if targetRef["kind"] != "Service" || targetRef["name"] != "frontend" {
		t.Errorf("internal-HTTP targetRef = %v, want the frontend Service", targetRef)
	}
	rules := spec["rules"].([]any)
	if len(rules) != 1 {
		t.Fatalf("internal-HTTP policy has %d rules, want one per declared route", len(rules))
	}
	rule := rules[0].(map[string]any)
	exempt := anyToStrings(rule["from"].([]any)[0].(map[string]any)["source"].(map[string]any)["notPrincipals"].([]any))
	// The waypoint never sees ingress-originated traffic, so the ingress gateway
	// is exempt by construction rather than by omission: a rule that named it
	// would read as a north-south boundary and enforce nothing.
	if !slices.Equal(exempt, []string{
		"cluster.local/ns/identity-local/sa/telemetry",
		"cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account",
	}) {
		t.Errorf("internal-HTTP exempt principals = %v, want the declared caller and the ingress gateway", exempt)
	}
	operation := rule["to"].([]any)[0].(map[string]any)["operation"].(map[string]any)
	paths := anyToStrings(operation["paths"].([]any))
	// Istio does not merge duplicate slashes by default, so an exact match alone
	// lets //api/solutions/register through to a handler that still serves it.
	if !slices.Equal(paths, []string{"*/api/solutions/register", "/api/solutions/register"}) {
		t.Errorf("internal-HTTP denied paths = %v, want the suffix form alongside the exact route", paths)
	}
	methods := anyToStrings(operation["methods"].([]any))
	if !slices.Equal(methods, []string{"DELETE", "POST"}) {
		t.Errorf("internal-HTTP denied methods = %v, want only the declared mutations", methods)
	}
	if slices.Contains(methods, "GET") {
		t.Error("denying GET on the same path would break the unauthenticated nav listing")
	}
}

func anyToStrings(values []any) []string {
	out := make([]string, 0, len(values))
	for _, value := range values {
		out = append(out, fmt.Sprint(value))
	}
	return out
}

func mustReadFile(t *testing.T, path string) string {
	t.Helper()
	data, err := os.ReadFile(path)
	if err != nil {
		t.Fatal(err)
	}
	return string(data)
}

func TestGenerateBundleRejectsDependencyWithoutEndpointAuthority(t *testing.T) {
	t.Parallel()
	root, moduleDir := writeModuleFixture(
		t,
		"policy-control",
		"identity",
		[]string{"accounts", "store"},
	)
	replaceInServiceManifest(t, moduleDir, "accounts", "    endpoints:\n      - name: http\n", "    endpoints: []\n")
	workspace, err := loadWorkspaceManifest(root)
	if err != nil {
		t.Fatal(err)
	}
	err = generateDeploymentBundle(moduleDir, workspace)
	if err == nil || !strings.Contains(err.Error(), `dependency "store" declares no endpoints`) {
		t.Fatalf("generateDeploymentBundle() error = %v, want empty dependency authority rejection", err)
	}
}

func TestGeneratedMarketingIngressUsesExactEnvironmentRoutes(t *testing.T) {
	t.Parallel()
	root, moduleDir := writeModuleFixture(
		t,
		"website-control",
		"identity",
		[]string{"auth-gateway", "marketing"},
	)
	workspace, err := loadWorkspaceManifest(root)
	if err != nil {
		t.Fatal(err)
	}
	workspace.Environments[0].Ingress = []environmentIngressRoute{
		{
			Name:     "marketing",
			Service:  "marketing",
			Endpoint: "http",
			Hosts:    []string{"identity.localhost", "www.identity.localhost", "docs.identity.localhost"},
		},
		{
			Name:     "product",
			Service:  "auth-gateway",
			Endpoint: "http",
			Hosts:    []string{"app.identity.localhost", "localhost"},
		},
	}
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatal(err)
	}

	generated := filepath.Join(moduleDir, filepath.FromSlash(bundleRelativeDir), "overlays", "local")
	gatewayObjects, err := decodeYAMLDocuments(filepath.Join(generated, "ingress.yaml"))
	if err != nil {
		t.Fatal(err)
	}
	var virtualService map[string]any
	for _, object := range gatewayObjects {
		if object["kind"] == "VirtualService" {
			virtualService = object
			break
		}
	}
	if virtualService == nil {
		t.Fatal("generated ingress is missing its VirtualService")
	}
	spec := virtualService["spec"].(map[string]any)
	hosts := spec["hosts"].([]any)
	for _, host := range []string{
		"app.identity.localhost",
		"docs.identity.localhost",
		"identity.localhost",
		"localhost",
		"www.identity.localhost",
	} {
		if !slices.Contains(hosts, any(host)) {
			t.Errorf("VirtualService hosts %v do not include %q", hosts, host)
		}
	}
	if slices.Contains(hosts, any("*")) {
		t.Fatalf("VirtualService retains wildcard authority: %v", hosts)
	}

	routes := make(map[string]map[string]any)
	for _, value := range spec["http"].([]any) {
		route := value.(map[string]any)
		routes[route["name"].(string)] = route
	}
	assertRoute := func(name, regex, host string, port int) {
		t.Helper()
		route, exists := routes[name]
		if !exists {
			t.Fatalf("VirtualService route %q is missing", name)
		}
		matches := route["match"].([]any)
		found := false
		for _, value := range matches {
			match := value.(map[string]any)
			authority := match["authority"].(map[string]any)
			if authority["regex"] == regex {
				found = true
			}
		}
		if !found {
			t.Errorf("VirtualService route %q does not match %q", name, regex)
		}
		destinations := route["route"].([]any)
		destination := destinations[0].(map[string]any)["destination"].(map[string]any)
		if destination["host"] != host {
			t.Errorf("VirtualService route %q host = %v, want %s", name, destination["host"], host)
		}
		renderedPort := destination["port"].(map[string]any)["number"]
		if renderedPort != port {
			t.Errorf("VirtualService route %q port = %v, want %d", name, renderedPort, port)
		}
	}
	// The VirtualService routes to the Kubernetes Service port Codefly
	// allocates (8080 for an http endpoint), not the pod port the Next.js
	// server binds (3000): the agent's Service maps 8080 to targetPort 3000,
	// and a destination naming 3000 names no port the Service has. The
	// AuthorizationPolicy below matches the pod port, which is what traffic
	// arrives on at the workload.
	assertRoute(
		"marketing",
		`^www\.identity\.localhost(:[0-9]+)?$`,
		"marketing.identity-local.svc.cluster.local",
		8080,
	)
	assertRoute(
		"product",
		`^app\.identity\.localhost(:[0-9]+)?$`,
		"auth-gateway.identity-local.svc.cluster.local",
		8080,
	)

	authorizationObjects, err := decodeYAMLDocuments(filepath.Join(generated, "base", "istio-mtls.yaml"))
	if err != nil {
		t.Fatal(err)
	}
	authorizedPorts := make(map[string][]any)
	authorizedPrincipals := make(map[string][]any)
	for _, object := range authorizationObjects {
		if object["kind"] != "AuthorizationPolicy" {
			continue
		}
		metadata := object["metadata"].(map[string]any)
		name, _ := metadata["name"].(string)
		if !strings.HasPrefix(name, "allow-istio-ingress-to-") {
			continue
		}
		policySpec := object["spec"].(map[string]any)
		rules := policySpec["rules"].([]any)
		from := rules[0].(map[string]any)["from"].([]any)
		authorizedPrincipals[name] = from[0].(map[string]any)["source"].(map[string]any)["principals"].([]any)
		to := rules[0].(map[string]any)["to"].([]any)
		operation := to[0].(map[string]any)["operation"].(map[string]any)
		authorizedPorts[name] = operation["ports"].([]any)
	}
	if got := authorizedPorts["allow-istio-ingress-to-marketing"]; !slices.Equal(got, []any{"3000"}) {
		t.Errorf("marketing ingress ports = %v, want [3000]", got)
	}
	if got := authorizedPorts["allow-istio-ingress-to-auth-gateway"]; !slices.Equal(got, []any{"8080"}) {
		t.Errorf("product ingress ports = %v, want [8080]", got)
	}
	// The ingress-allow policies must admit ONLY the ingress-gateway SA — the
	// single seam through which north-south traffic enters the mesh. Asserting
	// the principal value (not just the port) is what stops a widened allowlist
	// from shipping green: a rule that also admitted, say, sa/default would let
	// any in-namespace workload impersonate the gateway on public ports.
	ingressSA := []any{"cluster.local/ns/istio-system/sa/istio-ingressgateway-service-account"}
	for _, name := range []string{"allow-istio-ingress-to-marketing", "allow-istio-ingress-to-auth-gateway"} {
		if got := authorizedPrincipals[name]; !slices.Equal(got, ingressSA) {
			t.Errorf("%s principals = %v, want only the ingress-gateway SA %v", name, got, ingressSA)
		}
	}
}

func TestExampleRenderUsesExactServiceGraphRoutesAndPolicies(t *testing.T) {
	t.Parallel()
	services := []string{"accounts", "cache", "forge-edge", "frontend", "object-storage", "store", "vault"}
	root, moduleDir := writeModuleFixture(t, "example-control", "users", services)
	writeExampleTopology(t, moduleDir)
	workspace, err := loadWorkspaceManifest(root)
	if err != nil {
		t.Fatal(err)
	}
	workspace.Environments[0].Ingress = []environmentIngressRoute{{
		Name: "product", Service: "forge-edge", Endpoint: "rest",
		Hosts: []string{"app.example.localhost"},
	}}
	workspace.Environments[1].Ingress = []environmentIngressRoute{{
		Name: "product", Service: "forge-edge", Endpoint: "rest",
		Hosts: []string{"app.example.com"},
	}}

	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatal(err)
	}
	assertExampleRouteAndPolicies(t, moduleDir, "local", "app.example.localhost", false)
	assertExampleRouteAndPolicies(t, moduleDir, "aws", "app.example.com", true)
}

func TestManagedHandoffUsesExternalReferencesWithoutSecretValues(t *testing.T) {
	t.Parallel()
	root, moduleDir := writeModuleFixture(t, "handoff-control", "identity", []string{"accounts", "store"})
	workspace, err := loadWorkspaceManifest(root)
	if err != nil {
		t.Fatal(err)
	}
	workspace.Environments[1].ManagedServices["store"] = managedServiceConfig{
		Kind:         "rds-postgresql",
		ExternalName: "db.internal.example.com",
		EgressCIDRs:  []string{"10.42.0.0/24"},
		SecretReferences: []managedSecretReference{{
			Name:      "store-runtime",
			RemoteKey: "products/identity/store",
			SecretStore: secretStoreRef{
				Name: "aws-secrets-manager",
				Kind: "ClusterSecretStore",
			},
		}},
	}
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatal(err)
	}
	file := filepath.Join(
		moduleDir,
		filepath.FromSlash(bundleRelativeDir),
		"overlays/aws/base/handoffs/store.yaml",
	)
	data, err := os.ReadFile(file)
	if err != nil {
		t.Fatal(err)
	}
	rendered := string(data)
	for _, expected := range []string{
		"kind: Service",
		"type: ExternalName",
		"externalName: db.internal.example.com",
		"kind: ExternalSecret",
		"key: products/identity/store",
	} {
		if !strings.Contains(rendered, expected) {
			t.Errorf("managed handoff is missing %q:\n%s", expected, rendered)
		}
	}
	if strings.Contains(rendered, "kind: Secret\n") || strings.Contains(rendered, "stringData:") {
		t.Errorf("managed handoff emitted secret values:\n%s", rendered)
	}
}

func TestAKSEnvironmentRendersAzureManagedHandoff(t *testing.T) {
	t.Parallel()
	root, moduleDir := writeModuleFixture(t, "handoff-control", "identity", []string{"accounts", "store"})
	workspace, err := loadWorkspaceManifest(root)
	if err != nil {
		t.Fatal(err)
	}
	workspace.Environments[1].Name = "aks"
	workspace.Environments[1].Cluster.Kind = "aks"
	workspace.Environments[1].ManagedServices["store"] = managedServiceConfig{
		Kind:         "azure-postgres-flexible",
		ExternalName: "store.postgres.database.azure.com",
		EgressCIDRs:  []string{"10.42.0.0/24"},
	}
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatal(err)
	}

	var bundle moduleBundle
	data, err := os.ReadFile(filepath.Join(moduleDir, filepath.FromSlash(bundleRelativeDir), "bundle.json"))
	if err != nil {
		t.Fatal(err)
	}
	if err := json.Unmarshal(data, &bundle); err != nil {
		t.Fatal(err)
	}
	aks := bundle.Environments[1]
	if aks.Name != "aks" || aks.Cluster != "aks" {
		t.Fatalf("aks bundle environment = %q/%q, want aks/aks", aks.Name, aks.Cluster)
	}
	if len(aks.ManagedServiceHandoffs) != 1 ||
		aks.ManagedServiceHandoffs[0].Service != "store" ||
		aks.ManagedServiceHandoffs[0].Kind != "azure-postgres-flexible" {
		t.Fatalf("aks managed handoffs = %#v", aks.ManagedServiceHandoffs)
	}
	if slices.Contains(aks.Services, "store") {
		t.Fatalf("managed store must not appear as an in-cluster workload: %v", aks.Services)
	}

	handoff, err := os.ReadFile(filepath.Join(
		moduleDir,
		filepath.FromSlash(bundleRelativeDir),
		"overlays/aks/base/handoffs/store.yaml",
	))
	if err != nil {
		t.Fatal(err)
	}
	if !strings.Contains(string(handoff), "externalName: store.postgres.database.azure.com") {
		t.Fatalf("azure handoff is missing its ExternalName Service:\n%s", handoff)
	}
}

func TestGKEEnvironmentRendersPasswordlessCloudSQLHandoff(t *testing.T) {
	t.Parallel()
	root, moduleDir := writeModuleFixture(t, "handoff-control", "identity", []string{"accounts", "store"})
	workspace, err := loadWorkspaceManifest(root)
	if err != nil {
		t.Fatal(err)
	}
	workspace.Environments[1].Name = "gke"
	workspace.Environments[1].Cluster.Kind = "gke"
	workspace.Environments[1].ManagedServices["store"] = managedServiceConfig{
		Kind:                   "cloud-sql-postgres",
		ExternalName:           "store.identity.internal.example.com",
		AuthMode:               "external-identity",
		InstanceConnectionName: "identity-prod:us-central1:store",
		EgressCIDRs:            []string{"10.42.0.0/24"},
	}
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatal(err)
	}

	var bundle moduleBundle
	data, err := os.ReadFile(filepath.Join(moduleDir, filepath.FromSlash(bundleRelativeDir), "bundle.json"))
	if err != nil {
		t.Fatal(err)
	}
	if err := json.Unmarshal(data, &bundle); err != nil {
		t.Fatal(err)
	}
	gke := bundle.Environments[1]
	if gke.Name != "gke" || gke.Cluster != "gke" {
		t.Fatalf("gke bundle environment = %q/%q, want gke/gke", gke.Name, gke.Cluster)
	}
	if len(gke.ManagedServiceHandoffs) != 1 {
		t.Fatalf("gke managed handoffs = %#v", gke.ManagedServiceHandoffs)
	}
	handoff := gke.ManagedServiceHandoffs[0]
	if handoff.Kind != "cloud-sql-postgres" ||
		handoff.AuthMode != "external-identity" ||
		handoff.InstanceConnectionName != "identity-prod:us-central1:store" {
		t.Fatalf("gke managed handoff = %#v", handoff)
	}
	if len(handoff.SecretReferences) != 0 {
		t.Fatalf("passwordless handoff carries secret references: %#v", handoff.SecretReferences)
	}
	if slices.Contains(gke.Services, "store") {
		t.Fatalf("managed store must not appear as an in-cluster workload: %v", gke.Services)
	}

	rendered, err := os.ReadFile(filepath.Join(
		moduleDir,
		filepath.FromSlash(bundleRelativeDir),
		"overlays/gke/base/handoffs/store.yaml",
	))
	if err != nil {
		t.Fatal(err)
	}
	if !strings.Contains(string(rendered), "externalName: store.identity.internal.example.com") {
		t.Fatalf("cloud sql handoff is missing its ExternalName Service:\n%s", rendered)
	}
	// The instance authenticates the pod as its own workload identity, so the
	// overlay must project no connection secret of any shape.
	for _, forbidden := range []string{"ExternalSecret", "secretKeyRef", "stringData:"} {
		if strings.Contains(string(rendered), forbidden) {
			t.Errorf("passwordless cloud sql handoff rendered %q:\n%s", forbidden, rendered)
		}
	}
}

func passwordlessGKEFixture(t *testing.T, name, instanceConnection string) (string, *workspaceManifest) {
	t.Helper()
	root, moduleDir := writeModuleFixture(t, name, "identity", []string{"accounts", "store"})
	workspace, err := loadWorkspaceManifest(root)
	if err != nil {
		t.Fatal(err)
	}
	workspace.Environments[1].Name = "gke"
	workspace.Environments[1].Cluster.Kind = "gke"
	workspace.Environments[1].ManagedServices["store"] = managedServiceConfig{
		Kind:                   "cloud-sql-postgres",
		ExternalName:           "store.identity.internal.example.com",
		AuthMode:               "external-identity",
		InstanceConnectionName: instanceConnection,
		EgressCIDRs:            []string{"10.42.0.0/24"},
	}
	return moduleDir, workspace
}

// External identity means the token IS the credential, so a caller that cannot
// reach the metadata endpoint cannot authenticate at all — and the baseline
// denies egress while the public-egress policy excepts link-local.
func TestPasswordlessManagedServiceRendersWorkloadIdentityTokenEgress(t *testing.T) {
	t.Parallel()
	moduleDir, workspace := passwordlessGKEFixture(t, "token-egress", "identity-prod:us-central1:store")
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatal(err)
	}
	data, err := os.ReadFile(filepath.Join(
		moduleDir,
		filepath.FromSlash(bundleRelativeDir),
		"overlays/gke/base/network-policy.yaml",
	))
	if err != nil {
		t.Fatal(err)
	}
	rendered := string(data)
	for _, expected := range []string{
		"name: allow-accounts-workload-identity-token",
		"cidr: 169.254.169.254/32",
	} {
		if !strings.Contains(rendered, expected) {
			t.Errorf("passwordless caller has no token egress %q:\n%s", expected, rendered)
		}
	}
}

// The password-backed shape mints nothing, so it must not be granted reach to
// the metadata endpoint it has no use for.
func TestPasswordManagedServiceRendersNoWorkloadIdentityTokenEgress(t *testing.T) {
	t.Parallel()
	root, moduleDir := writeModuleFixture(t, "no-token-egress", "identity", []string{"accounts", "store"})
	workspace, err := loadWorkspaceManifest(root)
	if err != nil {
		t.Fatal(err)
	}
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatal(err)
	}
	data, err := os.ReadFile(filepath.Join(
		moduleDir,
		filepath.FromSlash(bundleRelativeDir),
		"overlays/aws/base/network-policy.yaml",
	))
	if err != nil {
		t.Fatal(err)
	}
	if strings.Contains(string(data), "workload-identity-token") || strings.Contains(string(data), "169.254.169.254") {
		t.Errorf("password-backed caller was granted metadata endpoint reach:\n%s", data)
	}
}

// The value that was validated is the value that must travel: validating a
// trimmed spelling while storing the raw one ships a coordinate no driver can
// resolve.
func TestPasswordlessHandoffCanonicalizesInstanceConnectionName(t *testing.T) {
	t.Parallel()
	moduleDir, workspace := passwordlessGKEFixture(t, "token-trim", "  identity-prod:us-central1:store  ")
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatal(err)
	}
	data, err := os.ReadFile(filepath.Join(moduleDir, filepath.FromSlash(bundleRelativeDir), "bundle.json"))
	if err != nil {
		t.Fatal(err)
	}
	var bundle moduleBundle
	if err := json.Unmarshal(data, &bundle); err != nil {
		t.Fatal(err)
	}
	handoff := bundle.Environments[1].ManagedServiceHandoffs[0]
	if handoff.InstanceConnectionName != "identity-prod:us-central1:store" {
		t.Errorf("instance connection name = %q, want the canonical spelling", handoff.InstanceConnectionName)
	}
}

// An absent authMode already means password to every existing consumer, so the
// default must not rewrite handoffs on clouds this feature never touched.
func TestPasswordDefaultOmitsAuthModeFromBundle(t *testing.T) {
	t.Parallel()
	root, moduleDir := writeModuleFixture(t, "authmode-default", "identity", []string{"accounts", "store"})
	workspace, err := loadWorkspaceManifest(root)
	if err != nil {
		t.Fatal(err)
	}
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatal(err)
	}
	data, err := os.ReadFile(filepath.Join(moduleDir, filepath.FromSlash(bundleRelativeDir), "bundle.json"))
	if err != nil {
		t.Fatal(err)
	}
	if strings.Contains(string(data), "authMode") {
		t.Errorf("password-backed handoff emitted an authMode key:\n%s", data)
	}
}

func TestInstanceConnectionNameAcceptsDomainScopedProject(t *testing.T) {
	t.Parallel()
	moduleDir, workspace := passwordlessGKEFixture(t, "domain-scoped", "example.com:identity-prod:us-central1:store")
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatalf("legacy domain-scoped project was refused: %v", err)
	}
}

func TestUnresolvedPlaceholderErrorNamesTheToken(t *testing.T) {
	t.Parallel()
	moduleDir, workspace := passwordlessGKEFixture(t, "unresolved-token", "saas-starter:us-central1:store")
	err := generateDeploymentBundle(moduleDir, workspace)
	if err == nil {
		t.Fatal("a starter identity in the bundle was accepted")
	}
	if !strings.Contains(err.Error(), "saas-starter") {
		t.Errorf("error does not name the offending token: %v", err)
	}
}

func TestReplaceGeneratedTreeRestoresPreviousTreeOnInstallFailure(t *testing.T) {
	t.Parallel()
	parent := t.TempDir()
	root := filepath.Join(parent, "kustomize")
	writeTestFile(t, filepath.Join(root, "bundle.json"), "previous\n")

	err := replaceGeneratedTree(filepath.Join(parent, "missing-stage"), root)
	if err == nil || !strings.Contains(err.Error(), "install generated bundle directory") {
		t.Fatalf("replaceGeneratedTree() error = %v", err)
	}
	data, readErr := os.ReadFile(filepath.Join(root, "bundle.json"))
	if readErr != nil {
		t.Fatalf("previous tree was not restored: %v", readErr)
	}
	if string(data) != "previous\n" {
		t.Fatalf("restored bundle = %q", data)
	}
}

func TestGenerateBundleReplacesStaleArgoTree(t *testing.T) {
	t.Parallel()
	root, moduleDir := writeModuleFixture(t, "migration-control", "identity", []string{"accounts"})
	staleRoot := filepath.Join(moduleDir, filepath.FromSlash(bundleRelativeDir))
	// A tree generated by the previous release still carries Argo Applications,
	// an AppProject, a pinned repository revision, and even a leaked Secret.
	writeTestFile(t, filepath.Join(staleRoot, "overlays", "local", "applications", "accounts.yaml"), `apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: identity-accounts-local
spec:
  source:
    repoURL: git@github.com:acme/platform-config.git
    targetRevision: 0123456789abcdef0123456789abcdef01234567
`)
	writeTestFile(t, filepath.Join(staleRoot, "overlays", "aws", "secret.yaml"), `apiVersion: v1
kind: Secret
metadata:
  name: leaked
stringData:
  password: hostile-canary
`)
	writeTestFile(t, filepath.Join(staleRoot, "inventory.json"), `{"repository":"git@github.com:acme/platform-config.git"}`)

	workspace, err := loadWorkspaceManifest(root)
	if err != nil {
		t.Fatal(err)
	}
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatal(err)
	}
	if _, err := os.Stat(filepath.Join(staleRoot, "inventory.json")); !errors.Is(err, os.ErrNotExist) {
		t.Fatalf("stale inventory.json survived generation: %v", err)
	}
	err = filepath.WalkDir(staleRoot, func(file string, entry os.DirEntry, err error) error {
		if err != nil || entry.IsDir() {
			return err
		}
		data, err := os.ReadFile(file)
		if err != nil {
			return err
		}
		for _, token := range []string{"hostile-canary", "kind: Secret", "kind: Application", "repoURL", "targetRevision", "argoproj.io"} {
			if strings.Contains(string(data), token) {
				t.Fatalf("stale token %q survived in %s", token, file)
			}
		}
		return nil
	})
	if err != nil {
		t.Fatal(err)
	}
}

func TestCreateGeneratesBundleAndPreservesConsumerFiles(t *testing.T) {
	root, target := writeModuleFixture(t, "create-control", "identity", []string{"accounts"})
	source := t.TempDir()
	writeTestFile(t, filepath.Join(source, moduleYamlPath), `kind: module
name: saas-starter
services:
  - name: accounts
  - name: auth-gateway
`)
	if err := os.MkdirAll(filepath.Join(source, "services", "accounts"), 0o755); err != nil {
		t.Fatal(err)
	}
	if err := os.MkdirAll(filepath.Join(source, "services", "auth-gateway"), 0o755); err != nil {
		t.Fatal(err)
	}
	writeTestFile(t, filepath.Join(source, "services", "accounts", "service.codefly.yaml"), `name: accounts
version: 0.0.0
agent:
  kind: codefly:service
  name: go-grpc
  publisher: codefly.dev
  version: 0.1.0
endpoints:
  - name: http
    visibility: public
spec:
  deployment:
    endpoint-ports:
      http: 8080
`)
	writeTestFile(t, filepath.Join(source, "services", "README.md"), "canonical service documentation\n")
	writeTestFile(t, filepath.Join(target, "services", "README.md"), "stale consumer copy\n")
	updatedBase := "package accounts\n\nconst Mode = \"updated\"\n"
	divergedConsumer := "package accounts\n\nconst Mode = \"consumer\"\n"
	writeTestFile(t, filepath.Join(target, "services", "accounts", "diverged.go"), divergedConsumer)
	writeTestFile(t, filepath.Join(target, "services", "accounts", "consumer.go"), "package accounts\n")
	writeTestFile(t, filepath.Join(source, "services", "accounts", "diverged.go"), updatedBase)
	writeTestFile(t, filepath.Join(target, "deployment", "generated", "service-topology.json"), `{"module":"saas-starter"}`)
	writeTestFile(t, filepath.Join(target, "deployment", "generated", "consumer-artifact.json"), `{"owner":"consumer"}`)
	writeTestFile(t, filepath.Join(target, "deployment", "generated", "accounts-routes.virtualservice.yaml"), `stale`)
	// A stale plugin-owned tree from the previous release must be regenerated,
	// never carried forward.
	writeTestFile(t, filepath.Join(source, filepath.FromSlash(bundleRelativeDir), "overlays", "local", "application.yaml"), `repoURL: REPLACE_ME
targetRevision: main
`)
	t.Setenv(sourceEnvVar, source)

	if err := Create(context.Background(), target, "identity"); err != nil {
		t.Fatal(err)
	}
	data, err := os.ReadFile(filepath.Join(target, moduleYamlPath))
	if err != nil {
		t.Fatal(err)
	}
	if strings.Contains(string(data), "name: saas-starter") || !strings.Contains(string(data), "name: identity") {
		t.Fatalf("module name was not structurally rewritten:\n%s", data)
	}
	if strings.Contains(string(data), "auth-gateway") {
		t.Fatalf("source service inventory replaced the consumer inventory:\n%s", data)
	}
	if _, err := os.Stat(filepath.Join(target, "services", "auth-gateway")); !os.IsNotExist(err) {
		t.Fatalf("undeclared source service was copied: %v", err)
	}
	if data, err := os.ReadFile(filepath.Join(target, "services", "README.md")); err != nil ||
		string(data) != "canonical service documentation\n" {
		t.Fatalf("canonical service documentation was not refreshed: data=%q error=%v", data, err)
	}
	// A base file the consumer edited in place is the base's again after a
	// compose: nothing records what the consumer changed, and the base only
	// moves via a new release. Consumers add files beside the base instead.
	if data, err := os.ReadFile(filepath.Join(target, "services", "accounts", "diverged.go")); err != nil ||
		string(data) != updatedBase {
		t.Fatalf("base file edited in place was not replaced by the base: data=%q error=%v", data, err)
	}
	if data, err := os.ReadFile(filepath.Join(target, "services", "accounts", "consumer.go")); err != nil ||
		string(data) != "package accounts\n" {
		t.Fatalf("consumer addition was removed during base reconciliation: data=%q error=%v", data, err)
	}
	// The manifest is the model: the consumer runs the agent the base's
	// service.codefly.yaml names, and nothing else carries a second version.
	if data, err := os.ReadFile(filepath.Join(target, "services", "accounts", "service.codefly.yaml")); err != nil ||
		!strings.Contains(string(data), "version: 0.1.0") ||
		strings.Contains(string(data), "# Composed by the module agent") {
		t.Fatalf("service manifest is not the base's authored manifest: data=%q error=%v", data, err)
	}
	if data, err := os.ReadFile(filepath.Join(target, "deployment", "generated", "consumer-artifact.json")); err != nil ||
		string(data) != `{"owner":"consumer"}` {
		t.Fatalf("consumer generated artifact was not preserved: data=%q error=%v", data, err)
	}
	if _, err := os.Stat(filepath.Join(target, "deployment", "generated", "accounts-routes.virtualservice.yaml")); !os.IsNotExist(err) {
		t.Fatalf("transport-specific route artifact was copied: %v", err)
	}
	bundleRoot := filepath.Join(target, filepath.FromSlash(bundleRelativeDir))
	if _, err := os.Stat(filepath.Join(bundleRoot, "overlays", "local", "application.yaml")); !os.IsNotExist(err) {
		t.Fatalf("placeholder Application was copied: %v", err)
	}
	if _, err := os.Stat(filepath.Join(bundleRoot, "bundle.json")); err != nil {
		t.Fatalf("generated bundle manifest is missing: %v", err)
	}
	overlayObjects(t, target, "local")
	if _, err := os.Stat(filepath.Join(root, workspaceYamlPath)); err != nil {
		t.Fatal(err)
	}
}

func TestCreateReconcilesRemovedBaseFileAtRelativeServicePath(t *testing.T) {
	_, target := writeModuleFixture(t, "relative-path-control", "identity", []string{"accounts"})
	if err := os.RemoveAll(filepath.Join(target, "services", "accounts")); err != nil {
		t.Fatal(err)
	}
	writeTestFile(t, filepath.Join(target, moduleYamlPath), `kind: module
name: identity
service-entry: accounts
services:
  - name: accounts
    path: backend
`)

	source := t.TempDir()
	writeTestFile(t, filepath.Join(source, moduleYamlPath), `kind: module
name: saas-starter
service-entry: accounts
interface:
  endpoints:
    - service: accounts
      endpoint: http
      visibility: public
services:
  - name: accounts
`)
	writeTestFile(t, filepath.Join(source, "services", "accounts", "current.go"), "package accounts\n")
	writeTestFile(t, filepath.Join(source, "services", "accounts", "service.codefly.yaml"),
		serviceManifestFixture("accounts", "http", "http", "public", 8080, "", "", ""))
	t.Setenv(sourceEnvVar, source)

	if err := Create(context.Background(), target, "identity"); err != nil {
		t.Fatal(err)
	}
	if data, err := os.ReadFile(filepath.Join(target, "services", "backend", "current.go")); err != nil ||
		string(data) != "package accounts\n" {
		t.Fatalf("current base file was not installed under the relative service path: data=%q error=%v", data, err)
	}
}

func TestResolveSourceFallsBackToPackagedModule(t *testing.T) {
	t.Setenv(sourceEnvVar, "")
	source, cleanup, err := resolveSource()
	if err != nil {
		t.Fatal(err)
	}
	defer cleanup()
	data, err := os.ReadFile(filepath.Join(source, moduleYamlPath))
	if err != nil {
		t.Fatal(err)
	}
	if !strings.Contains(string(data), "name: saas-starter") {
		t.Fatalf("packaged source is not the canonical module:\n%s", data)
	}
}

func TestRegenerateServiceManifestsIncludesFrontendPluginDependencies(t *testing.T) {
	moduleDir := t.TempDir()
	writeTestFile(
		t,
		filepath.Join(moduleDir, "services", "frontend", "code", "server", "plugin-service-allowlist.generated.json"),
		`{
  "schemaVersion": 1,
  "contractVersion": 2,
  "entries": [
    {
      "target": {
        "module": "billing",
        "service": "subscriptions",
        "endpoint": "rest"
      }
    }
  ]
}
`,
	)
	writeTestFile(t, filepath.Join(moduleDir, "services", "frontend", "service.codefly.yaml"),
		serviceManifestFixture("frontend", "http", "http", "internal", 3000, "", "", ""))
	manifest := moduleManifest{Name: "users", Services: []serviceReference{{Name: "frontend"}}}

	if err := regenerateServiceManifests(moduleDir, manifest, true); err != nil {
		t.Fatal(err)
	}
	data, err := os.ReadFile(filepath.Join(moduleDir, "services", "frontend", "service.codefly.yaml"))
	if err != nil {
		t.Fatal(err)
	}
	for _, required := range []string{
		"# Composed by the module agent from services/frontend/service.codefly.yaml and services/frontend/code/server/plugin-service-allowlist.generated.json.",
		"name: subscriptions",
		"module: billing",
		"name: rest",
	} {
		if !strings.Contains(string(data), required) {
			t.Fatalf("frontend service manifest is missing plugin dependency %q:\n%s", required, data)
		}
	}
}

func TestServiceInventoryAcceptsAbsoluteMonorepoPath(t *testing.T) {
	t.Parallel()
	moduleDir := t.TempDir()
	external := filepath.Join(t.TempDir(), "accounts")
	if err := os.MkdirAll(external, 0o755); err != nil {
		t.Fatal(err)
	}
	services, err := validateServiceInventory(moduleDir, []serviceReference{{Name: "accounts", Path: &external}})
	if err != nil {
		t.Fatal(err)
	}
	if len(services) != 1 || services[0].directory != external {
		t.Fatalf("resolved services = %#v, want absolute path %q", services, external)
	}
}

func TestCreatePreservesAbsoluteMonorepoServicePath(t *testing.T) {
	root, target := writeModuleFixture(t, "monorepo-control", "identity", []string{"accounts"})
	external := filepath.Join(t.TempDir(), "accounts")
	writeTestFile(t, filepath.Join(external, "consumer.txt"), "consumer-owned\n")
	writeTestFile(t, filepath.Join(external, "service.codefly.yaml"),
		serviceManifestFixture("accounts", "http", "http", "public", 8080, "", "", ""))
	if err := os.RemoveAll(filepath.Join(target, "services")); err != nil {
		t.Fatal(err)
	}
	writeTestFile(t, filepath.Join(target, moduleYamlPath), fmt.Sprintf(`kind: module
name: identity
service-entry: accounts
services:
  - name: accounts
    path: %s
`, external))
	source := t.TempDir()
	writeTestFile(t, filepath.Join(source, moduleYamlPath), `kind: module
name: saas-starter
service-entry: accounts
interface:
  endpoints:
    - service: accounts
      endpoint: http
      visibility: public
services:
  - name: accounts
`)
	writeTestFile(t, filepath.Join(source, "services", "accounts", "canonical.txt"), "must not escape staging\n")
	t.Setenv(sourceEnvVar, source)

	if err := Create(context.Background(), target, "identity"); err != nil {
		t.Fatal(err)
	}
	if _, err := os.Stat(filepath.Join(target, "services", "accounts")); !errors.Is(err, os.ErrNotExist) {
		t.Fatalf("source service was copied to the default path despite the absolute override: %v", err)
	}
	if data, err := os.ReadFile(filepath.Join(external, "consumer.txt")); err != nil || string(data) != "consumer-owned\n" {
		t.Fatalf("external service changed: data=%q error=%v", data, err)
	}
	if _, err := os.Stat(filepath.Join(root, workspaceYamlPath)); err != nil {
		t.Fatal(err)
	}
}

func TestCanonicalSourceDoesNotShipGeneratedBundleTree(t *testing.T) {
	t.Parallel()
	root := filepath.Join("module", filepath.FromSlash(bundleRelativeDir))
	err := filepath.WalkDir(root, func(file string, entry os.DirEntry, err error) error {
		if errors.Is(err, os.ErrNotExist) {
			return nil
		}
		if err != nil || entry.IsDir() {
			return err
		}
		t.Errorf("canonical source still contains consumer-owned bundle file %s", file)
		return nil
	})
	if err != nil {
		t.Fatal(err)
	}
}

// --- fixtures ------------------------------------------------------------

func overlayObjects(t *testing.T, moduleDir, environment string) []map[string]any {
	t.Helper()
	objects, err := renderKustomization(filepath.Join(
		moduleDir,
		filepath.FromSlash(bundleRelativeDir),
		"overlays",
		environment,
	))
	if err != nil {
		t.Fatalf("render %s overlay: %v", environment, err)
	}
	return objects
}

func writeModuleFixture(t *testing.T, workspaceName, moduleName string, services []string) (string, string) {
	t.Helper()
	root := t.TempDir()
	moduleDir := filepath.Join(root, "modules", moduleName)
	entry := services[0]
	for _, candidate := range []string{"forge-edge", "auth-gateway", "accounts", "frontend"} {
		if slices.Contains(services, candidate) {
			entry = candidate
			break
		}
	}
	var module strings.Builder
	module.WriteString("kind: module\nname: " + moduleName + "\ndescription: test\nservice-entry: " + entry + "\n")
	module.WriteString("interface:\n  endpoints:\n    - service: " + entry + "\n      endpoint: http\n      visibility: public\n")
	if entry != "marketing" && slices.Contains(services, "marketing") {
		module.WriteString("    - service: marketing\n      endpoint: http\n      visibility: public\n")
	}
	module.WriteString("services:\n")
	for _, service := range services {
		port := 8080
		if service == "marketing" {
			port = 3000
		}
		module.WriteString("  - name: " + service + "\n")
		topLevel, deployment := "", ""
		if service == "store" {
			deployment += "    bootstrap-job-endpoints:\n      - http\n"
		}
		if service == entry {
			deployment += "    public-egress-ports:\n      - 443\n"
		}
		if service == "accounts" && slices.Contains(services, "store") {
			topLevel = "service-dependencies:\n  - name: store\n    endpoints:\n      - name: http\n"
		}
		writeTestFile(t, filepath.Join(moduleDir, "services", service, "service.codefly.yaml"),
			serviceManifestFixture(service, "http", "http", "private", port, topLevel, "", deployment))
	}
	writeTestFile(t, filepath.Join(moduleDir, moduleYamlPath), module.String())
	workspace := "name: " + workspaceName + `
layout: modules
environments:
  - name: local
    cluster:
      kind: k3d
    namespace: ` + moduleName + `-local
    ingress:
      - name: product
        service: ` + entry + `
        endpoint: http
        hosts: [` + moduleName + `.localhost]
  - name: aws
    cluster:
      kind: eks
    namespace: ` + moduleName + `-aws
` + fixtureKeyService(services) + `    ingress:
      - name: product
        service: ` + entry + `
        endpoint: http
        hosts: [` + moduleName + `.example.com]
    managed-services:
`
	for _, service := range services {
		kind, managed := fixtureAWSManagedServices[service]
		if !managed {
			continue
		}
		workspace += "      " + service + ":\n" +
			"        kind: " + kind + "\n" +
			"        external-name: " + service + ".internal.example.com\n" +
			"        egress-cidrs:\n" +
			"          - 10.42.0.0/24\n"
	}
	writeTestFile(t, filepath.Join(root, workspaceYamlPath), workspace)
	return root, moduleDir
}

func appendWorkspace(t *testing.T, root, extra string) {
	t.Helper()
	file := filepath.Join(root, workspaceYamlPath)
	data, err := os.ReadFile(file)
	if err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(file, append(data, []byte(extra)...), 0o644); err != nil {
		t.Fatal(err)
	}
}

func writeExampleTopology(t *testing.T, moduleDir string) {
	t.Helper()
	writeTestFile(t, filepath.Join(moduleDir, moduleYamlPath), `kind: module
name: users
description: Example users boundary
service-entry: forge-edge
interface:
  endpoints:
    - service: forge-edge
      endpoint: rest
      visibility: public
services:
  - name: accounts
  - name: cache
  - name: forge-edge
  - name: frontend
  - name: object-storage
  - name: store
  - name: vault
`)
	write := func(name, manifest string) {
		writeTestFile(t, filepath.Join(moduleDir, "services", name, "service.codefly.yaml"), manifest)
	}
	write("accounts", serviceManifestFixture("accounts", "grpc", "grpc", "private", 8080,
		"service-dependencies:\n"+
			"  - name: cache\n    endpoints:\n      - name: redis\n"+
			"  - name: object-storage\n    endpoints:\n      - name: http\n"+
			"  - name: store\n    endpoints:\n      - name: postgres\n"+
			"  - name: vault\n    endpoints:\n      - name: http\n", "", ""))
	write("cache", serviceManifestFixture("cache", "redis", "redis", "private", 6379, "", "", ""))
	write("forge-edge", serviceManifestFixture("forge-edge", "rest", "http", "public", 8080,
		"service-dependencies:\n  - name: accounts\n    endpoints:\n      - name: grpc\n", "", "    public-egress-ports:\n      - 443\n"))
	write("frontend", serviceManifestFixture("frontend", "http", "http", "private", 3000,
		"service-dependencies:\n  - name: forge-edge\n    endpoints:\n      - name: rest\n", "", ""))
	write("object-storage", serviceManifestFixture("object-storage", "http", "http", "private", 9000, "", "", ""))
	write("store", serviceManifestFixture("store", "postgres", "postgres", "private", 5432, "", "", ""))
	write("vault", serviceManifestFixture("vault", "http", "http", "private", 8200, "", "", ""))
}

func assertExampleRouteAndPolicies(
	t *testing.T,
	moduleDir,
	environment,
	host string,
	aws bool,
) {
	t.Helper()
	environmentRoot := filepath.Join(
		moduleDir,
		filepath.FromSlash(bundleRelativeDir),
		"overlays",
		environment,
	)
	baseRoot := filepath.Join(environmentRoot, "base")
	ingressObjects, err := decodeYAMLDocuments(filepath.Join(environmentRoot, "ingress.yaml"))
	if err != nil {
		t.Fatal(err)
	}
	destinationObjects, err := decodeYAMLDocuments(filepath.Join(baseRoot, "destination-rules.yaml"))
	if err != nil {
		t.Fatal(err)
	}
	var route map[string]any
	for _, object := range ingressObjects {
		if object["kind"] == "VirtualService" {
			route = object
		}
	}
	var destinationRuleHosts []string
	for _, object := range destinationObjects {
		if object["kind"] != "DestinationRule" {
			continue
		}
		spec := object["spec"].(map[string]any)
		ruleHost := spec["host"].(string)
		if strings.Contains(ruleHost, "*") {
			t.Errorf("%s DestinationRule retains wildcard authority %q", environment, ruleHost)
		}
		destinationRuleHosts = append(destinationRuleHosts, ruleHost)
	}
	if route == nil {
		t.Fatal("example bootstrap has no VirtualService")
	}
	expectedServices := []string{"accounts", "cache", "forge-edge", "frontend", "object-storage", "store", "vault"}
	if aws {
		expectedServices = []string{"accounts", "forge-edge", "frontend"}
	}
	expectedRuleHosts := make([]string, 0, len(expectedServices))
	for _, service := range expectedServices {
		expectedRuleHosts = append(expectedRuleHosts, service+".users-"+environment+".svc.cluster.local")
	}
	if !slices.Equal(destinationRuleHosts, expectedRuleHosts) {
		t.Fatalf("%s DestinationRule hosts = %v, want %v", environment, destinationRuleHosts, expectedRuleHosts)
	}
	spec := route["spec"].(map[string]any)
	if got := spec["hosts"].([]any); !slices.Equal(got, []any{host}) {
		t.Fatalf("%s route hosts = %v, want [%s]", environment, got, host)
	}
	httpRoutes := spec["http"].([]any)
	destination := httpRoutes[0].(map[string]any)["route"].([]any)[0].(map[string]any)["destination"].(map[string]any)
	if destination["host"] != "forge-edge.users-"+environment+".svc.cluster.local" ||
		destination["port"].(map[string]any)["number"] != 8080 {
		t.Fatalf("%s route destination = %#v", environment, destination)
	}

	data, err := os.ReadFile(filepath.Join(baseRoot, "network-policy.yaml"))
	if err != nil {
		t.Fatal(err)
	}
	rendered := string(data)
	for _, name := range []string{
		"default-deny-all",
		"allow-ambient-hbone-transport",
		"allow-istio-ingress-to-forge-edge",
		"allow-forge-edge-to-accounts",
		"allow-accounts-from-forge-edge",
		"allow-frontend-to-forge-edge",
		"allow-forge-edge-from-frontend",
	} {
		if !strings.Contains(rendered, "name: "+name) {
			t.Errorf("%s network policy is missing %q", environment, name)
		}
	}
	if count := strings.Count(rendered, "port: 15008"); count != 2 {
		t.Errorf("%s network policy has %d ambient HBONE transport exceptions, want 2", environment, count)
	}
	if aws {
		for _, name := range []string{
			"allow-accounts-to-cache",
			"allow-accounts-to-object-storage",
			"allow-accounts-to-store",
			"allow-accounts-to-vault",
		} {
			if !strings.Contains(rendered, "name: "+name) {
				t.Errorf("AWS network policy is missing managed exception %q", name)
			}
		}
		if !strings.Contains(rendered, "cidr: 10.42.0.0/24") {
			t.Error("AWS network policy has no exact managed-service CIDR")
		}
		return
	}
	for _, name := range []string{
		"allow-cache-from-accounts",
		"allow-object-storage-from-accounts",
		"allow-store-from-accounts",
		"allow-vault-from-accounts",
	} {
		if !strings.Contains(rendered, "name: "+name) {
			t.Errorf("local network policy is missing topology exception %q", name)
		}
	}
}

func writeCatalogArtifact(t *testing.T, moduleDir string) {
	t.Helper()
	writeTestFile(
		t,
		filepath.Join(moduleDir, "deployment", "generated", "contributed-roles.json"),
		"{\"version\":1,\"roles\":[]}\n",
	)
}

func appendDeployJob(t *testing.T, moduleDir, writesService, writesEndpoint string) {
	t.Helper()
	writeDeployJobs(t, moduleDir,
		"deploy_jobs:\n"+
			"  - name: role-catalog-import\n"+
			"    service: accounts\n"+
			"    command: role-catalog-import\n"+
			"    catalog: deployment/generated/contributed-roles.json\n"+
			"    force: true\n"+
			"    writes:\n"+
			"      service: "+writesService+"\n"+
			"      endpoint: "+writesEndpoint+"\n"+
			"    after:\n"+
			"      - store\n")
}

// serviceManifestFixture renders an authored service.codefly.yaml: one endpoint,
// its port under spec.deployment, and whatever a test needs beside them —
// topLevel goes between the agent and the endpoints (service-dependencies),
// spec under spec, deployment under spec.deployment.
func serviceManifestFixture(name, endpoint, api, visibility string, port int, topLevel, spec, deployment string) string {
	var manifest strings.Builder
	manifest.WriteString("name: " + name + "\nversion: 0.0.0\nagent:\n  kind: codefly:service\n  name: test\n  version: 0.0.1\n  publisher: codefly.dev\n")
	manifest.WriteString(topLevel)
	manifest.WriteString("endpoints:\n  - name: " + endpoint + "\n")
	if api != endpoint {
		manifest.WriteString("    api: " + api + "\n")
	}
	if visibility != "private" {
		manifest.WriteString("    visibility: " + visibility + "\n")
	}
	manifest.WriteString("spec:\n")
	manifest.WriteString(spec)
	fmt.Fprintf(&manifest, "  deployment:\n    endpoint-ports:\n      %s: %d\n", endpoint, port)
	manifest.WriteString(deployment)
	return manifest.String()
}

func writeDeployJobs(t *testing.T, moduleDir, block string) {
	t.Helper()
	writeTestFile(t, filepath.Join(moduleDir, filepath.FromSlash(deployJobsManifestPath)), "version: v1\n"+block)
}

// fixtureKeyService states the hosted environment's key service when the
// fixture composes a Vault to be it, and states nothing when it does not. A
// fixture that named the vault backend with no `vault` service would be the
// contradiction resolveKeyService refuses, so every composition-shaped test
// that happens not to compose one would fail on that refusal instead of its
// own subject.
func fixtureKeyService(services []string) string {
	if slices.Contains(services, "vault") {
		return "    key-service: vault\n"
	}
	return ""
}

func replaceInServiceManifest(t *testing.T, moduleDir, service, old, new string) {
	t.Helper()
	file := filepath.Join(moduleDir, "services", service, "service.codefly.yaml")
	data, err := os.ReadFile(file)
	if err != nil {
		t.Fatal(err)
	}
	replaced := strings.Replace(string(data), old, new, 1)
	if replaced == string(data) {
		t.Fatalf("service %s manifest substitution %q found nothing to replace", service, old)
	}
	if err := os.WriteFile(file, []byte(replaced), 0o644); err != nil {
		t.Fatal(err)
	}
}

func replaceInDeployJobs(t *testing.T, moduleDir, old, new string) {
	t.Helper()
	file := filepath.Join(moduleDir, filepath.FromSlash(deployJobsManifestPath))
	data, err := os.ReadFile(file)
	if err != nil {
		t.Fatal(err)
	}
	replaced := strings.Replace(string(data), old, new, 1)
	if replaced == string(data) {
		t.Fatalf("deploy jobs substitution %q found nothing to replace", old)
	}
	if err := os.WriteFile(file, []byte(replaced), 0o644); err != nil {
		t.Fatal(err)
	}
}

func writeTestFile(t *testing.T, file, content string) {
	t.Helper()
	if err := os.MkdirAll(filepath.Dir(file), 0o755); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(file, []byte(content), 0o644); err != nil {
		t.Fatal(err)
	}
}

// cellVaultFixture builds a two-service module whose accounts depends on vault,
// and points its hosted environment at a Vault the cell runs in a namespace of
// its own. accounts' vault dependency is what makes the egress policy render at
// all, so it is written in rather than inherited from the shared fixture.
func cellVaultFixture(t *testing.T, name string, vault managedServiceConfig) (string, *workspaceManifest) {
	t.Helper()
	root, moduleDir := writeModuleFixture(t, name, "identity", []string{"accounts", "vault"})
	replaceInServiceManifest(t, moduleDir, "accounts",
		"endpoints:\n",
		"service-dependencies:\n  - name: vault\n    endpoints:\n      - name: http\n"+
			"workspace-configuration-dependencies:\n  - identity\n  - key-service\n  - security\n  - vault\nendpoints:\n")
	workspace, err := loadWorkspaceManifest(root)
	if err != nil {
		t.Fatal(err)
	}
	workspace.Environments[1].Name = "gke"
	workspace.Environments[1].Cluster.Kind = "gke"
	workspace.Environments[1].ManagedServices = map[string]managedServiceConfig{"vault": vault}
	return moduleDir, workspace
}

func cellVault() managedServiceConfig {
	return managedServiceConfig{
		Kind:            managedKindCellVault,
		ExternalName:    "vault.vault.svc.cluster.local",
		AuthMode:        "external-identity",
		EgressNamespace: "vault",
	}
}

func readBundle(t *testing.T, moduleDir string) moduleBundle {
	t.Helper()
	data, err := os.ReadFile(filepath.Join(moduleDir, filepath.FromSlash(bundleRelativeDir), "bundle.json"))
	if err != nil {
		t.Fatal(err)
	}
	var bundle moduleBundle
	if err := json.Unmarshal(data, &bundle); err != nil {
		t.Fatal(err)
	}
	return bundle
}

// The whole point of the kind: the hosted environment renders no Vault of this
// module's own — no StatefulSet to hold the signing key in memory, no token to
// project — and the product reaches the one the cell runs.
func TestCellVaultLeavesNoModuleVaultAndProjectsNoToken(t *testing.T) {
	t.Parallel()
	moduleDir, workspace := cellVaultFixture(t, "cell-vault", cellVault())
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatal(err)
	}
	gke := readBundle(t, moduleDir).Environments[1]
	if slices.Contains(gke.Services, "vault") {
		t.Fatalf("the module's own vault is still an in-cluster workload: %v", gke.Services)
	}
	if len(gke.ManagedServiceHandoffs) != 1 {
		t.Fatalf("managed handoffs = %#v", gke.ManagedServiceHandoffs)
	}
	handoff := gke.ManagedServiceHandoffs[0]
	if handoff.Kind != managedKindCellVault ||
		handoff.AuthMode != "external-identity" ||
		handoff.EgressNamespace != "vault" ||
		handoff.ExternalName != "vault.vault.svc.cluster.local" {
		t.Fatalf("cell vault handoff = %#v", handoff)
	}
	if len(handoff.SecretReferences) != 0 {
		t.Fatalf("cell vault handoff carries secret references: %#v", handoff.SecretReferences)
	}

	rendered, err := os.ReadFile(filepath.Join(
		moduleDir, filepath.FromSlash(bundleRelativeDir), "overlays/gke/base/handoffs/vault.yaml"))
	if err != nil {
		t.Fatal(err)
	}
	if !strings.Contains(string(rendered), "externalName: vault.vault.svc.cluster.local") {
		t.Fatalf("cell vault handoff is missing its ExternalName Service:\n%s", rendered)
	}
	// The caller logs in as its own ServiceAccount, so no Vault token of any
	// shape may be projected into the namespace.
	for _, forbidden := range []string{"ExternalSecret", "secretKeyRef", "stringData:"} {
		if strings.Contains(string(rendered), forbidden) {
			t.Errorf("cell vault handoff rendered %q:\n%s", forbidden, rendered)
		}
	}
}

// The Vault is in another namespace of the same cluster, so reach is granted by
// namespace. A CIDR cannot describe it: the pod address moves on every
// reschedule and the pod CIDR covers every workload in the cluster. And the
// credential is a projected ServiceAccount token read off disk, so unlike the
// cloud passwordless kinds this one gets no metadata-endpoint reach.
func TestCellVaultEgressIsNamespaceSelectedAndNeedsNoMetadataEndpoint(t *testing.T) {
	t.Parallel()
	moduleDir, workspace := cellVaultFixture(t, "cell-vault-egress", cellVault())
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatal(err)
	}
	data, err := os.ReadFile(filepath.Join(
		moduleDir, filepath.FromSlash(bundleRelativeDir), "overlays/gke/base/network-policy.yaml"))
	if err != nil {
		t.Fatal(err)
	}
	rendered := string(data)
	// The assertion is on the caller's own policy, not on the whole file: the
	// entry service's public-egress rule legitimately carries an ipBlock, so a
	// file-wide search would pass while saying nothing about this edge.
	var edge string
	for _, document := range strings.Split(rendered, "\n---\n") {
		if strings.Contains(document, "name: allow-accounts-to-vault") {
			edge = document
		}
	}
	if edge == "" {
		t.Fatalf("no allow-accounts-to-vault egress policy was rendered:\n%s", rendered)
	}
	if !strings.Contains(edge, "kubernetes.io/metadata.name: vault") {
		t.Errorf("cell vault egress does not select the Vault's namespace:\n%s", edge)
	}
	if strings.Contains(edge, "ipBlock") {
		t.Errorf("cell vault egress names an address block:\n%s", edge)
	}
	for _, forbidden := range []string{"workload-identity-token", "169.254.169.254"} {
		if strings.Contains(rendered, forbidden) {
			t.Errorf("cell vault caller was granted %q:\n%s", forbidden, rendered)
		}
	}
}

// Each of these, left to a default, reproduces a failure the kind exists to
// prevent — so each must be refused, and the refusal must name the field, or the
// reader is sent to the wrong file.
func TestCellVaultRefusesEveryBindingThatIsNotIdentityAndNamespace(t *testing.T) {
	t.Parallel()
	for name, expect := range map[string]struct {
		config managedServiceConfig
		names  string
	}{
		"password auth": {
			managedServiceConfig{Kind: managedKindCellVault, ExternalName: "vault.vault.svc.cluster.local", AuthMode: "password", EgressNamespace: "vault"},
			"auth-mode: external-identity",
		},
		"defaulted auth": {
			managedServiceConfig{Kind: managedKindCellVault, ExternalName: "vault.vault.svc.cluster.local", EgressNamespace: "vault"},
			"auth-mode: external-identity",
		},
		"no egress namespace": {
			managedServiceConfig{Kind: managedKindCellVault, ExternalName: "vault.vault.svc.cluster.local", AuthMode: "external-identity"},
			"requires an egress-namespace",
		},
		"egress cidrs instead": {
			managedServiceConfig{Kind: managedKindCellVault, ExternalName: "vault.vault.svc.cluster.local", AuthMode: "external-identity", EgressNamespace: "vault", EgressCIDRs: []string{"10.42.0.0/24"}},
			"authorize every workload in the cluster",
		},
		"secret references": {
			managedServiceConfig{Kind: managedKindCellVault, ExternalName: "vault.vault.svc.cluster.local", AuthMode: "external-identity", EgressNamespace: "vault",
				SecretReferences: []managedSecretReference{{Name: "vault-token", RemoteKey: "vault/token", SecretStore: secretStoreRef{Name: "cell", Kind: "ClusterSecretStore"}}}},
			"declares secret references",
		},
	} {
		moduleDir, workspace := cellVaultFixture(t, "cell-vault-refuse", expect.config)
		err := generateDeploymentBundle(moduleDir, workspace)
		if err == nil {
			t.Errorf("%s: accepted", name)
			continue
		}
		if !strings.Contains(err.Error(), expect.names) {
			t.Errorf("%s: refusal does not name %q: %v", name, expect.names, err)
		}
	}
}

// egress-namespace belongs to the one in-cluster kind. Accepting it on an
// out-of-cluster kind would read as a second, silently ignored way of granting
// reach beside the CIDRs that actually gate it.
func TestEgressNamespaceIsRefusedOnAnOutOfClusterKind(t *testing.T) {
	t.Parallel()
	moduleDir, workspace := cellVaultFixture(t, "ns-on-cloud-kind", managedServiceConfig{
		Kind:            "secrets-manager",
		ExternalName:    "vault.internal.example.com",
		EgressNamespace: "vault",
		EgressCIDRs:     []string{"10.42.0.0/24"},
	})
	err := generateDeploymentBundle(moduleDir, workspace)
	if err == nil {
		t.Fatal("egress-namespace accepted on an out-of-cluster kind")
	}
	if !strings.Contains(err.Error(), "does not take an egress-namespace") {
		t.Fatalf("refusal does not name the field: %v", err)
	}
}

// A local environment composes this module's own vault; the kind is only
// meaningful where the cell runs one beside it.
func TestCellVaultIsRefusedOnALocalEnvironment(t *testing.T) {
	t.Parallel()
	root, moduleDir := writeModuleFixture(t, "cell-vault-local", "identity", []string{"accounts", "vault"})
	workspace, err := loadWorkspaceManifest(root)
	if err != nil {
		t.Fatal(err)
	}
	workspace.Environments[0].ManagedServices = map[string]managedServiceConfig{"vault": cellVault()}
	if err := generateDeploymentBundle(moduleDir, workspace); err == nil {
		t.Fatal("a local environment accepted a managed cell Vault")
	}
}

// The key-service selection: an environment whose keys live in the cell's cloud
// key-management service composes no Vault.
//
// On 2026-10-17 the first boot of a hosted cell on `KEY_SERVICE_BACKEND=kms`
// with `KEY_SERVICE_SIGNING_BACKEND=kms-wrapped` showed what the missing
// declaration costs. accounts opened no Vault connection — nothing in
// services/accounts/code/pkg/keyservice reaches one on that selection — and the
// module still rendered its `vault` service into the cell's inventory. It was
// scheduled, refused to start without the auto-unseal seal a cell on cloud KMS
// is forbidden to hold, and crash-looped as a permanently degraded workload
// that nothing read. The two planes had no declaration in common: accounts
// selected its backend from a configuration group at runtime, and the inventory
// was decided by a render that never saw the selection.
//
// These hold the declaration that joins them, and the three things it has to
// take away together — the workload, the reach, and the ability to contradict it.

// keyServiceFixture builds accounts-plus-vault with accounts depending on the
// vault endpoint, which is what makes an egress policy render at all, and
// points the hosted environment's key-service selection at `selection`.
func keyServiceFixture(t *testing.T, name, selection string) (string, *workspaceManifest) {
	t.Helper()
	root, moduleDir := writeModuleFixture(t, name, "identity", []string{"accounts", "vault"})
	replaceInServiceManifest(t, moduleDir, "accounts",
		"endpoints:\n",
		"service-dependencies:\n  - name: vault\n    endpoints:\n      - name: http\n"+
			"workspace-configuration-dependencies:\n  - identity\n  - key-service\n  - security\n  - vault\nendpoints:\n")
	workspace, err := loadWorkspaceManifest(root)
	if err != nil {
		t.Fatal(err)
	}
	workspace.Environments[1].Name = "gke"
	workspace.Environments[1].Cluster.Kind = "gke"
	workspace.Environments[1].KeyService = selection
	workspace.Environments[1].ManagedServices = nil
	return moduleDir, workspace
}

// The whole point of the selection: no StatefulSet, no PVC, no seal and no
// token on the environment that reads no Vault — while the local environment,
// which runs this module's own Vault over loopback with a token, keeps it.
func TestKMSKeyServiceComposesNoVaultAndLeavesLocalAlone(t *testing.T) {
	t.Parallel()
	moduleDir, workspace := keyServiceFixture(t, "key-service-kms", keyServiceKMS)
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatal(err)
	}
	bundle := readBundle(t, moduleDir)
	local, hosted := bundle.Environments[0], bundle.Environments[1]
	if !slices.Contains(local.Services, "vault") {
		t.Errorf("the local environment lost this module's own vault: %v", local.Services)
	}
	if slices.Contains(hosted.Services, "vault") {
		t.Errorf("a cell on cloud KMS still schedules this module's vault: %v", hosted.Services)
	}
	// Not a managed dependency either. A handoff would render an ExternalName
	// Service and egress to an address nothing dials, and would read as "the
	// Vault is over there" on a cell that has none.
	if len(hosted.ManagedServiceHandoffs) != 0 {
		t.Errorf("a withdrawn vault was handed off instead of withdrawn: %#v", hosted.ManagedServiceHandoffs)
	}
}

// The dependency edge goes with the service. Before the selection existed the
// renderer refused outright ("has no in-cluster service or managed handoff"),
// because a dependency could only be in-cluster or managed — so a cell that
// dropped the Vault could not render at all, and the only way to render was to
// schedule one.
func TestKMSKeyServiceWithdrawsTheVaultEdgeRatherThanGrantingReach(t *testing.T) {
	t.Parallel()
	moduleDir, workspace := keyServiceFixture(t, "key-service-kms-edge", keyServiceKMS)
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatal(err)
	}
	// The WHOLE overlay, not two named files: a renderer that later emits reach
	// in a file this test did not know about would otherwise pass.
	overlay := filepath.Join(moduleDir, filepath.FromSlash(bundleRelativeDir), "overlays", "gke")
	var scanned int
	if err := filepath.Walk(overlay, func(path string, info os.FileInfo, err error) error {
		if err != nil || info.IsDir() {
			return err
		}
		data, readErr := os.ReadFile(path)
		if readErr != nil {
			return readErr
		}
		scanned++
		relative, _ := filepath.Rel(overlay, path)
		for index, line := range strings.Split(string(data), "\n") {
			if strings.Contains(strings.ToLower(line), "vault") {
				t.Errorf("overlays/gke/%s:%d names vault, so reach was granted for a dial that does not happen: %s",
					filepath.ToSlash(relative), index+1, strings.TrimSpace(line))
			}
		}
		return nil
	}); err != nil {
		t.Fatal(err)
	}
	if scanned == 0 {
		t.Fatalf("no files under %s, so this scan asserted nothing", overlay)
	}
}

// Stating the selection and then naming a Vault to reach says two different
// things about the same cell, and nothing in the render could say which won.
func TestKMSKeyServiceRefusesACellVaultHandoffAlongsideIt(t *testing.T) {
	t.Parallel()
	moduleDir, workspace := keyServiceFixture(t, "key-service-kms-and-handoff", keyServiceKMS)
	workspace.Environments[1].ManagedServices = map[string]managedServiceConfig{"vault": cellVault()}
	err := generateDeploymentBundle(moduleDir, workspace)
	if err == nil {
		t.Fatal("a cell declared both key-service: kms and a vault handoff")
	}
	if !strings.Contains(err.Error(), "no Vault for a handoff to point at") {
		t.Fatalf("refusal does not say why the two cannot both hold: %v", err)
	}
}

// `vault` keeps every behaviour the selection did not exist for: the module's
// own durable Vault in-cluster, or the cell's through the handoff.
func TestVaultKeyServiceKeepsBothVaultShapes(t *testing.T) {
	t.Parallel()
	own, ownWorkspace := keyServiceFixture(t, "key-service-vault-own", keyServiceVault)
	if err := generateDeploymentBundle(own, ownWorkspace); err != nil {
		t.Fatal(err)
	}
	if !slices.Contains(readBundle(t, own).Environments[1].Services, "vault") {
		t.Error("key-service: vault did not schedule this module's own vault")
	}

	cell, cellWorkspace := keyServiceFixture(t, "key-service-vault-cell", keyServiceVault)
	cellWorkspace.Environments[1].ManagedServices = map[string]managedServiceConfig{"vault": cellVault()}
	if err := generateDeploymentBundle(cell, cellWorkspace); err != nil {
		t.Fatal(err)
	}
	hosted := readBundle(t, cell).Environments[1]
	if slices.Contains(hosted.Services, "vault") {
		t.Errorf("the cell's own Vault was declared and the module scheduled one anyway: %v", hosted.Services)
	}
	if len(hosted.ManagedServiceHandoffs) != 1 || hosted.ManagedServiceHandoffs[0].Kind != managedKindCellVault {
		t.Errorf("the cell-vault handoff was lost: %#v", hosted.ManagedServiceHandoffs)
	}
}

// An unstated selection keeps this module's behaviour from before the selection
// existed, on a deployed environment too. It SHOULD be refused there — an
// unstated key service is exactly what put a Vault on a cell that reads none,
// and `keyservice.selectedBackend` already refuses the same unstated fact at
// boot — and it is not, because the environment block's schema is the CLI's.
// `pkg/environments.Environment` is decoded strictly and recursively with no
// extension seam, so until it carries `key-service` a composition cannot write
// the line, and refusing an omission would refuse every composition rather than
// the one mistake. Verified against codefly 0.1.181: "field key-service not
// found in type environments.Environment".
//
// This test pins the compatible behaviour so the change is deliberate when that
// field lands: resolveKeyService refuses the omission on a managed-capable
// environment, and this test inverts.
func TestAnUnstatedKeyServiceStillComposesTheVault(t *testing.T) {
	t.Parallel()
	moduleDir, workspace := keyServiceFixture(t, "key-service-unstated", "")
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatal(err)
	}
	for _, environment := range readBundle(t, moduleDir).Environments {
		if !slices.Contains(environment.Services, "vault") {
			t.Errorf("environment %q lost its vault on an unstated selection: %v", environment.Name, environment.Services)
		}
	}
}

// What a composition can declare TODAY, with no CLI change: leaving `vault` out
// of its own `module.codefly.yaml` services. That is a field the CLI does parse,
// and it is the whole answer for a composition whose keys live in a cloud key
// service in every environment — the service tree is not copied, accounts' vault
// dependency is pruned, no environment schedules one, and the `vault`
// configuration group goes with the binding, so nothing is left answering for
// the address and AppRole credential of a Vault that is not there.
func TestAWholeCompositionWithNoVaultRendersEveryEnvironment(t *testing.T) {
	t.Parallel()
	root, moduleDir := writeModuleFixture(t, "no-vault-composition", "identity", []string{"accounts", "store"})
	workspace, err := loadWorkspaceManifest(root)
	if err != nil {
		t.Fatal(err)
	}
	if workspace.Environments[1].KeyService != "" {
		t.Fatalf("fixture states a key-service with no vault composed, so this proves nothing")
	}
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatal(err)
	}
	for _, environment := range readBundle(t, moduleDir).Environments {
		if slices.Contains(environment.Services, "vault") {
			t.Errorf("environment %q scheduled a vault the composition never composed: %v", environment.Name, environment.Services)
		}
	}
	// And the selection is a no-op rather than an error there: there is nothing
	// left to withdraw, so a cell that states `kms` anyway still renders.
	workspace.Environments[1].KeyService = keyServiceKMS
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatalf("key-service: kms refused a composition that already has no vault: %v", err)
	}
}

// A local environment has no cell and no cloud key service: it runs this
// module's own Vault over loopback with a token, so the selection defaults
// there and `codefly run service --fixture dev-admin` is unchanged.
func TestALocalEnvironmentNeedsNoKeyServiceAndKeepsItsVault(t *testing.T) {
	t.Parallel()
	root, moduleDir := writeModuleFixture(t, "key-service-local", "identity", []string{"accounts", "vault"})
	workspace, err := loadWorkspaceManifest(root)
	if err != nil {
		t.Fatal(err)
	}
	if workspace.Environments[0].KeyService != "" {
		t.Fatalf("fixture's local environment states a key-service, so this proves nothing")
	}
	if err := generateDeploymentBundle(moduleDir, workspace); err != nil {
		t.Fatal(err)
	}
	if !slices.Contains(readBundle(t, moduleDir).Environments[0].Services, "vault") {
		t.Error("a local environment lost the vault it runs with a token")
	}
}

// A misspelt selection must be refused rather than read as one of the two: a
// typo that fell through to `vault` would schedule a Vault on a cell that
// reads none, which is the failure, and one that fell through to `kms` would
// take away the Vault a cell depends on.
func TestAnUnsupportedKeyServiceIsRefusedByName(t *testing.T) {
	t.Parallel()
	moduleDir, workspace := keyServiceFixture(t, "key-service-typo", "kms-wrapped")
	err := generateDeploymentBundle(moduleDir, workspace)
	if err == nil {
		t.Fatal("an unsupported key-service was accepted")
	}
	if !strings.Contains(err.Error(), `key-service "kms-wrapped" is not supported`) {
		t.Fatalf("refusal does not name the value: %v", err)
	}
}

// The `vault` configuration group follows the KEY-SERVICE SELECTION, and this
// is the test that pins the owner: the inventory is identical in both halves —
// accounts declares the group, `vault` is a composed service, the dependency
// edge is there — and only the selection moves. A composition whose every
// environment selects the cell's cloud key service stops answering for the
// group; one where any environment selects the vault backend keeps it.
//
// Keying it off the service's presence produced the same answer for this
// module, because the only thing its `vault` service is for IS that backend,
// and the wrong answer as soon as the two part: a cell whose Vault is the
// CELL's renders no Vault of this module's and needs every key in the group.
func TestTheVaultGroupFollowsTheSelectionAndNotTheVaultService(t *testing.T) {
	t.Parallel()
	for _, test := range []struct {
		name      string
		keepLocal bool
		declared  bool
	}{
		{name: "cloud key service everywhere", keepLocal: false, declared: false},
		{name: "a local run still on the vault backend", keepLocal: true, declared: true},
	} {
		t.Run(test.name, func(t *testing.T) {
			t.Parallel()
			moduleDir, workspace := keyServiceFixture(t, "group-owner-"+strings.ReplaceAll(test.name, " ", "-"), keyServiceKMS)
			if !test.keepLocal {
				// The local environment is the one that selects the vault
				// backend by stating nothing; a composition that deploys only
				// its cell has no such environment.
				workspace.Environments = workspace.Environments[1:]
			}
			if err := normalizeDeploymentMetadata(moduleDir, workspace); err != nil {
				t.Fatal(err)
			}
			groups := composedGroups(t, moduleDir, "accounts")
			if slices.Contains(groups, keyServiceGroup) != test.declared {
				t.Errorf("accounts declares %v; wanted the %q group declared=%v", groups, keyServiceGroup, test.declared)
			}
			// Nothing else moves with it. The rule is "the group the selected
			// key service is reached through", not "any group".
			for _, kept := range []string{"identity", "key-service", "security"} {
				if !slices.Contains(groups, kept) {
					t.Errorf("the %s group was withdrawn with the vault binding: %v", kept, groups)
				}
			}
		})
	}
}

// A composition that composes no `vault` service must not be left answering for
// the group either. A declared group is delivered whether it is read or not, and
// its keys have to be supplied or explicitly marked may-be-empty — so leaving it
// declared made a composition with no Vault answer for VAULT_AUTH_METHOD and the
// AppRole credential of a Vault that is not there. Here the selection says so
// through the inventory, which is the only half of it a composition can write
// today, and the group goes with the selection.
func TestComposingWithoutAVaultSelectsTheCloudKeyServiceAndWithdrawsItsGroup(t *testing.T) {
	t.Parallel()
	moduleDir := t.TempDir()
	writeTestFile(t, filepath.Join(moduleDir, "services", "accounts", "service.codefly.yaml"),
		serviceManifestFixture("accounts", "http", "http", "private", 8080,
			"service-dependencies:\n  - name: vault\n    endpoints:\n      - name: http\n"+
				"  - name: store\n    endpoints:\n      - name: tcp\n"+
				"workspace-configuration-dependencies:\n    - identity\n    - key-service\n    - security\n    - vault\n",
			"", ""))
	writeTestFile(t, filepath.Join(moduleDir, "services", "store", "service.codefly.yaml"),
		serviceManifestFixture("store", "tcp", "tcp", "private", 5432, "", "", ""))

	manifest := moduleManifest{Name: "identity", Services: []serviceReference{{Name: "accounts"}, {Name: "store"}}}
	selected, err := compositionSelectsVault(&workspaceManifest{
		Environments: []*environmentConfig{{Name: "local"}, {Name: "gke"}},
	}, []string{"accounts", "store"})
	if err != nil {
		t.Fatal(err)
	}
	if selected {
		t.Fatal("a composition with no vault service was read as selecting the vault backend")
	}
	if err := regenerateServiceManifests(moduleDir, manifest, selected); err != nil {
		t.Fatal(err)
	}
	raw, err := os.ReadFile(filepath.Join(moduleDir, "services", "accounts", "service.codefly.yaml"))
	if err != nil {
		t.Fatal(err)
	}
	composed := string(raw)
	var parsed struct {
		ServiceDependencies []struct {
			Name string `yaml:"name"`
		} `yaml:"service-dependencies"`
		WorkspaceConfigurationDependencies []string `yaml:"workspace-configuration-dependencies"`
	}
	if err := yaml.Unmarshal([]byte(composed), &parsed); err != nil {
		t.Fatalf("parse composed accounts manifest: %v\n%s", err, composed)
	}
	for _, dependency := range parsed.ServiceDependencies {
		if dependency.Name == "vault" {
			t.Errorf("the vault dependency survived a composition without it:\n%s", composed)
		}
	}
	if slices.Contains(parsed.WorkspaceConfigurationDependencies, "vault") {
		t.Errorf("the vault configuration group survived a composition with no vault service:\n%s", composed)
	}
	for _, kept := range []string{"identity", "key-service", "security"} {
		if !slices.Contains(parsed.WorkspaceConfigurationDependencies, kept) {
			t.Errorf("the %s group was withdrawn with the vault binding:\n%s", kept, composed)
		}
	}
}

// An environment that STATES the vault backend while the composition composes
// no Vault is the one contradiction an unstated selection cannot be read as.
// Leaving it to mean `vault` would deliver accounts the group's keys with
// nothing behind them; reading it as `kms` would silently overrule what the
// environment wrote. So it is refused, and the refusal names both halves.
func TestAnExplicitVaultKeyServiceWithNoVaultComposedIsRefused(t *testing.T) {
	t.Parallel()
	root, moduleDir := writeModuleFixture(t, "vault-selected-none-composed", "identity", []string{"accounts", "store"})
	workspace, err := loadWorkspaceManifest(root)
	if err != nil {
		t.Fatal(err)
	}
	workspace.Environments[1].KeyService = keyServiceVault
	err = generateDeploymentBundle(moduleDir, workspace)
	if err == nil {
		t.Fatal("an environment selected the vault backend with no Vault composed")
	}
	for _, required := range []string{
		"selects key-service: vault",
		"composes no \"vault\" service",
		"\"vault\" configuration group",
	} {
		if !strings.Contains(err.Error(), required) {
			t.Fatalf("refusal does not say %q: %v", required, err)
		}
	}
}

// composedGroups reads back the workspace configuration groups a composed
// service manifest declares.
func composedGroups(t *testing.T, moduleDir, service string) []string {
	t.Helper()
	raw, err := os.ReadFile(filepath.Join(moduleDir, "services", service, "service.codefly.yaml"))
	if err != nil {
		t.Fatal(err)
	}
	var parsed struct {
		WorkspaceConfigurationDependencies []string `yaml:"workspace-configuration-dependencies"`
	}
	if err := yaml.Unmarshal(raw, &parsed); err != nil {
		t.Fatalf("parse composed %s manifest: %v\n%s", service, err, raw)
	}
	return parsed.WorkspaceConfigurationDependencies
}