fn_test.go

package main

import (
	"context"
	"flag"
	"fmt"
	"maps"
	"os"
	"path/filepath"
	"slices"
	"strings"
	"testing"

	"github.com/google/go-cmp/cmp"
	"github.com/google/go-cmp/cmp/cmpopts"
	"google.golang.org/protobuf/encoding/protojson"
	"google.golang.org/protobuf/testing/protocmp"
	"google.golang.org/protobuf/types/known/durationpb"
	"google.golang.org/protobuf/types/known/structpb"
	"k8s.io/apimachinery/pkg/runtime"
	sigsyaml "sigs.k8s.io/yaml"

	xpv2 "github.com/crossplane/crossplane/apis/v2/core/v2"
	"github.com/crossplane/function-sdk-go/logging"
	fnv1 "github.com/crossplane/function-sdk-go/proto/v1"
	"github.com/crossplane/function-sdk-go/resource"
	"github.com/crossplane/function-sdk-go/resource/composed"
	"github.com/crossplane/function-sdk-go/response"

	"github.com/NVIDIA/aicr/pkg/recipe"

	"github.com/jonasz-lasut/function-aicr/input/v1beta1"
	"github.com/jonasz-lasut/function-aicr/internal/compose"
	"github.com/jonasz-lasut/function-aicr/internal/schema"
)

// update regenerates test-fixtures/want from the function's own output instead
// of comparing against it. It is driven by `go generate ./...` (see
// test-fixtures/generate.go); the resulting diff is what the function will
// deploy after a github.com/NVIDIA/aicr bump, and deserves review.
var update = flag.Bool("update", false, "regenerate test-fixtures/want from the function's output")

const (
	fixturesDir  = "test-fixtures"
	wantDir      = "want"
	goldenHeader = "# Generated by `go generate ./...` from the request fixtures. DO NOT EDIT.\n"
	// testRecipeVersion stands in for the aicr module version main.go reads
	// from build info, which test binaries do not carry.
	testRecipeVersion = "v0.0.0-test"
)

// yamlToProto loads a single-document YAML fixture (relative to test-fixtures/)
// as a protobuf Struct. For test use only; panics on error.
func yamlToProto(name string) *structpb.Struct {
	y, err := os.ReadFile(filepath.Join(fixturesDir, name))
	if err != nil {
		panic(err)
	}
	j, err := sigsyaml.YAMLToJSON(y)
	if err != nil {
		panic(err)
	}
	return resource.MustStructJSON(string(j))
}

func fixture(name string) *fnv1.Resource { return &fnv1.Resource{Resource: yamlToProto(name)} }

// golden names the generated fixtures under test-fixtures/want that a case's
// desired state is compared against; either may be empty when the case is
// expected to produce none.
type golden struct {
	resources string // directory holding one <name>.yaml per desired composed resource
	composite string // file holding the desired composite resource
}

// loadGolden reads the desired state a case expects, or nil if it expects none.
func loadGolden(t *testing.T, g golden) *fnv1.State {
	t.Helper()
	if g.resources == "" && g.composite == "" {
		return nil
	}
	state := &fnv1.State{}
	if g.resources != "" {
		entries, err := os.ReadDir(filepath.Join(fixturesDir, wantDir, g.resources))
		if err != nil {
			t.Fatalf("cannot read golden resources %q (run `go generate ./...`): %v", g.resources, err)
		}
		state.Resources = make(map[string]*fnv1.Resource, len(entries))
		for _, e := range entries {
			name := strings.TrimSuffix(e.Name(), ".yaml")
			state.Resources[name] = fixture(filepath.Join(wantDir, g.resources, e.Name()))
		}
	}
	if g.composite != "" {
		state.Composite = fixture(filepath.Join(wantDir, g.composite))
	}
	return state
}

// writtenGolden guards against two cases regenerating the same golden file
// with different content, which check mode would otherwise report as a
// failure that `go generate` cannot fix.
var writtenGolden = map[string][]byte{}

// writeGolden regenerates the golden fixtures a case names from the desired
// state the function produced.
func writeGolden(t *testing.T, g golden, got *fnv1.State) {
	t.Helper()
	write := func(rel string, s *structpb.Struct) {
		j, err := protojson.Marshal(s)
		if err != nil {
			t.Fatalf("cannot marshal %q: %v", rel, err)
		}
		y, err := sigsyaml.JSONToYAML(j)
		if err != nil {
			t.Fatalf("cannot convert %q to YAML: %v", rel, err)
		}
		y = append([]byte(goldenHeader), y...)
		path := filepath.Join(fixturesDir, wantDir, rel)
		if prev, ok := writtenGolden[path]; ok && !slices.Equal(prev, y) {
			t.Fatalf("golden %q regenerated with different content by two cases; give them separate goldens", rel)
		}
		writtenGolden[path] = y
		if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
			t.Fatalf("cannot create %q: %v", filepath.Dir(path), err)
		}
		if err := os.WriteFile(path, y, 0o644); err != nil {
			t.Fatalf("cannot write %q: %v", path, err)
		}
	}
	if len(got.GetResources()) > 0 && g.resources == "" {
		t.Fatalf("case produced %d desired resources but names no golden resources directory", len(got.GetResources()))
	}
	if got.GetComposite() != nil && g.composite == "" {
		t.Fatalf("case produced a desired composite but names no golden composite file")
	}
	for name, r := range got.GetResources() {
		write(filepath.Join(g.resources, name+".yaml"), r.GetResource())
	}
	if c := got.GetComposite(); c != nil {
		write(g.composite, c.GetResource())
	}
}

// permissiveSchema accepts any object. It proves the plumbing without pinning
// this test to provider-helm's real CRD; schema.Validate is tested separately.
func permissiveSchema() *fnv1.Schema {
	s, err := structpb.NewStruct(map[string]any{
		"type":                                 "object",
		"x-kubernetes-preserve-unknown-fields": true,
	})
	if err != nil {
		panic(err)
	}
	return &fnv1.Schema{OpenapiV3: s}
}

func meta() *fnv1.RequestMeta {
	return &fnv1.RequestMeta{
		Tag: "test",
		Capabilities: []fnv1.Capability{
			fnv1.Capability_CAPABILITY_CAPABILITIES,
			fnv1.Capability_CAPABILITY_REQUIRED_SCHEMAS,
		},
	}
}

func releaseRequirement() *fnv1.Requirements {
	return &fnv1.Requirements{Schemas: map[string]*fnv1.SchemaSelector{
		"release": {ApiVersion: "helm.m.crossplane.io/v1beta1", Kind: "Release"},
	}}
}

func releaseAndObjectRequirements() *fnv1.Requirements {
	return &fnv1.Requirements{Schemas: map[string]*fnv1.SchemaSelector{
		"release": {ApiVersion: "helm.m.crossplane.io/v1beta1", Kind: "Release"},
		"object":  {ApiVersion: "kubernetes.m.crossplane.io/v1alpha1", Kind: "Object"},
	}}
}

func functionSuccess() *fnv1.Condition {
	return &fnv1.Condition{
		Type:   "FunctionSuccess",
		Status: fnv1.Status_STATUS_CONDITION_TRUE,
		Reason: "Success",
		Target: fnv1.Target_TARGET_COMPOSITE_AND_CLAIM.Enum(),
	}
}

func fatal(msg string) []*fnv1.Result {
	return []*fnv1.Result{{
		Severity: fnv1.Severity_SEVERITY_FATAL,
		Message:  msg,
		Target:   fnv1.Target_TARGET_COMPOSITE.Enum(),
	}}
}

// TestRunFunction drives the function end to end against the embedded AICR
// recipe data. The desired state each case expects lives under
// test-fixtures/want and is the function's own output, regenerated by
// `go generate ./...`; the static parts of the response — requirements,
// results, conditions — are asserted here and are what a recipe bump must
// not change.
func TestRunFunction(t *testing.T) {
	respMeta := &fnv1.ResponseMeta{Tag: "test", Ttl: durationpb.New(response.DefaultTTL)}

	type args struct {
		ctx context.Context
		req *fnv1.RunFunctionRequest
	}
	type want struct {
		rsp    *fnv1.RunFunctionResponse
		golden golden
		err    error
	}

	cases := map[string]struct {
		reason string
		args   args
		want   want
	}{
		"ResolvesRecipeFromAnyXR": {
			reason: "With schemas resolved, criteriaFrom pulls criteria off an XR the function knows nothing about; overrides and skips are applied.",
			args: args{
				ctx: context.Background(),
				req: &fnv1.RunFunctionRequest{
					Meta:            meta(),
					Input:           yamlToProto("input/resolve.yaml"),
					Observed:        &fnv1.State{Composite: fixture("observed/xr.yaml")},
					RequiredSchemas: map[string]*fnv1.Schema{"release": permissiveSchema()},
				},
			},
			want: want{
				rsp: &fnv1.RunFunctionResponse{
					Meta:         respMeta,
					Requirements: releaseRequirement(),
					Conditions:   []*fnv1.Condition{functionSuccess()},
				},
				golden: golden{resources: "resolve"},
			},
		},
		"ResolvesProviderConfigFromXR": {
			reason: "providerConfigRefFrom pulls the provider config off the XR, so one Composition can target the cluster each XR names; the composed Release carries it.",
			args: args{
				ctx: context.Background(),
				req: &fnv1.RunFunctionRequest{
					Meta:            meta(),
					Input:           yamlToProto("input/provider-config-from-xr.yaml"),
					Observed:        &fnv1.State{Composite: fixture("observed/xr-with-provider-config.yaml")},
					RequiredSchemas: map[string]*fnv1.Schema{"release": permissiveSchema()},
				},
			},
			want: want{
				rsp: &fnv1.RunFunctionResponse{
					Meta:         respMeta,
					Requirements: releaseRequirement(),
					Conditions:   []*fnv1.Condition{functionSuccess()},
				},
				golden: golden{resources: "provider-config-from-xr"},
			},
		},
		"RendersManifestsIntoObjects": {
			reason: "A component's manifest files are Helm-style templates; they are rendered with the recipe's values and emitted as Objects — here the manifest-only nodewright-customizations' Skyhook CR next to nodewright-operator's Release — and the Object schema is required only because the recipe carries manifests.",
			args: args{
				ctx: context.Background(),
				req: &fnv1.RunFunctionRequest{
					Meta:     meta(),
					Input:    yamlToProto("input/render-manifests.yaml"),
					Observed: &fnv1.State{Composite: fixture("observed/xr.yaml")},
					RequiredSchemas: map[string]*fnv1.Schema{
						"release": permissiveSchema(),
						"object":  permissiveSchema(),
					},
				},
			},
			want: want{
				rsp: &fnv1.RunFunctionResponse{
					Meta:         respMeta,
					Requirements: releaseAndObjectRequirements(),
					Conditions:   []*fnv1.Condition{functionSuccess()},
				},
				golden: golden{resources: "render-manifests"},
			},
		},
		"WritesSummaryToTarget": {
			reason: "With target set, the resolved-recipe summary lands at the named field path on the desired XR.",
			args: args{
				ctx: context.Background(),
				req: &fnv1.RunFunctionRequest{
					Meta:            meta(),
					Input:           yamlToProto("input/resolve-with-target.yaml"),
					Observed:        &fnv1.State{Composite: fixture("observed/xr.yaml")},
					Desired:         &fnv1.State{Composite: fixture("desired/xr.yaml")},
					RequiredSchemas: map[string]*fnv1.Schema{"release": permissiveSchema()},
				},
			},
			want: want{
				rsp: &fnv1.RunFunctionResponse{
					Meta:         respMeta,
					Requirements: releaseRequirement(),
					Conditions:   []*fnv1.Condition{functionSuccess()},
				},
				golden: golden{resources: "resolve", composite: "composite/summary.yaml"},
			},
		},
		"PreservesSiblingsAtTarget": {
			reason: "A bare status target must not clobber keys other pipeline steps put there: siblings survive and stale summary keys are overwritten.",
			args: args{
				ctx: context.Background(),
				req: &fnv1.RunFunctionRequest{
					Meta:            meta(),
					Input:           yamlToProto("input/resolve-with-status-target.yaml"),
					Observed:        &fnv1.State{Composite: fixture("observed/xr.yaml")},
					Desired:         &fnv1.State{Composite: fixture("desired/xr-with-status-siblings.yaml")},
					RequiredSchemas: map[string]*fnv1.Schema{"release": permissiveSchema()},
				},
			},
			want: want{
				rsp: &fnv1.RunFunctionResponse{
					Meta:         respMeta,
					Requirements: releaseRequirement(),
					Conditions:   []*fnv1.Condition{functionSuccess()},
				},
				golden: golden{resources: "resolve", composite: "composite/summary-with-siblings.yaml"},
			},
		},
		"WritesNoSummaryWithoutTarget": {
			reason: "Without target the desired composite passes through untouched.",
			args: args{
				ctx: context.Background(),
				req: &fnv1.RunFunctionRequest{
					Meta:            meta(),
					Input:           yamlToProto("input/resolve.yaml"),
					Observed:        &fnv1.State{Composite: fixture("observed/xr.yaml")},
					Desired:         &fnv1.State{Composite: fixture("desired/xr.yaml")},
					RequiredSchemas: map[string]*fnv1.Schema{"release": permissiveSchema()},
				},
			},
			want: want{
				rsp: &fnv1.RunFunctionResponse{
					Meta:         respMeta,
					Requirements: releaseRequirement(),
					Conditions:   []*fnv1.Condition{functionSuccess()},
				},
				golden: golden{resources: "resolve", composite: "composite/passthrough.yaml"},
			},
		},
		"RequestsSchemasAndEmitsNothingWhenUnresolved": {
			reason: "On the first pass Crossplane has not resolved the schema; the function asks for it and composes nothing.",
			args: args{
				ctx: context.Background(),
				req: &fnv1.RunFunctionRequest{
					Meta:     meta(),
					Input:    yamlToProto("input/resolve.yaml"),
					Observed: &fnv1.State{Composite: fixture("observed/xr.yaml")},
				},
			},
			want: want{
				rsp: &fnv1.RunFunctionResponse{
					Meta:         respMeta,
					Requirements: releaseRequirement(),
				},
			},
		},
		"FatalWhenCrossplaneLacksCapability": {
			reason: "Without the required-schemas capability the function could never validate, and would otherwise loop forever composing nothing.",
			args: args{
				ctx: context.Background(),
				req: &fnv1.RunFunctionRequest{
					Meta:     &fnv1.RequestMeta{Tag: "test"},
					Input:    yamlToProto("input/resolve.yaml"),
					Observed: &fnv1.State{Composite: fixture("observed/xr.yaml")},
				},
			},
			want: want{
				rsp: &fnv1.RunFunctionResponse{
					Meta:    respMeta,
					Results: fatal("function-aicr requires a Crossplane that supports required schemas; upgrade Crossplane, or pass --required-schemas to crossplane render"),
				},
			},
		},
		"FatalWhenProviderNotInstalled": {
			reason: "A resolved-but-nil schema means the CRD is absent; emitting a Release nobody reconciles would strand the XR.",
			args: args{
				ctx: context.Background(),
				req: &fnv1.RunFunctionRequest{
					Meta:            meta(),
					Input:           yamlToProto("input/resolve.yaml"),
					Observed:        &fnv1.State{Composite: fixture("observed/xr.yaml")},
					RequiredSchemas: map[string]*fnv1.Schema{"release": {}},
				},
			},
			want: want{
				rsp: &fnv1.RunFunctionResponse{
					Meta:         respMeta,
					Requirements: releaseRequirement(),
					Results:      fatal(`no schema for helm.m.crossplane.io/v1beta1, Kind=Release: is provider-helm installed?`),
				},
			},
		},
		"FatalWhenProviderConfigNameMissing": {
			reason: "A provider config name must come from providerConfigRef or a providerConfigRefFrom path.",
			args: args{
				ctx: context.Background(),
				req: &fnv1.RunFunctionRequest{
					Meta:     meta(),
					Input:    yamlToProto("input/missing-provider-config.yaml"),
					Observed: &fnv1.State{Composite: fixture("observed/xr.yaml")},
				},
			},
			want: want{
				rsp: &fnv1.RunFunctionResponse{
					Meta:    respMeta,
					Results: fatal("cannot resolve the provider config reference: providerConfigRef.name is required: set it, or a providerConfigRefFrom.name field path that resolves on the composite resource"),
				},
			},
		},
		"FatalWhenOverrideValuesNotObject": {
			reason: "componentOverrides values that are valid JSON but not an object are rejected up front, by name and kind, before any schema is requested.",
			args: args{
				ctx: context.Background(),
				req: &fnv1.RunFunctionRequest{
					Meta:     meta(),
					Input:    yamlToProto("input/override-values-not-object.yaml"),
					Observed: &fnv1.State{Composite: fixture("observed/xr.yaml")},
				},
			},
			want: want{
				rsp: &fnv1.RunFunctionResponse{
					Meta:    respMeta,
					Results: fatal(`componentOverrides["gpu-operator"].values must be an object, got string`),
				},
			},
		},
		"FatalWhenCriteriaInvalid": {
			reason: "A criteria value outside AICR's enums fails fast with AICR's own message; anything AICR accepts is passed through, since only its catalog knows which combinations exist.",
			args: args{
				ctx: context.Background(),
				req: &fnv1.RunFunctionRequest{
					Meta:     meta(),
					Input:    yamlToProto("input/invalid-criteria.yaml"),
					Observed: &fnv1.State{Composite: fixture("observed/xr.yaml")},
				},
			},
			want: want{
				rsp: &fnv1.RunFunctionResponse{
					Meta:    respMeta,
					Results: fatal("invalid AICR recipe criteria: [INVALID_REQUEST] invalid accelerator: [INVALID_REQUEST] invalid accelerator type: bogus"),
				},
			},
		},
		"FatalWhenTargetNotUnderStatus": {
			reason: "Writing outside status would corrupt the desired composite's spec.",
			args: args{
				ctx: context.Background(),
				req: &fnv1.RunFunctionRequest{
					Meta:     meta(),
					Input:    yamlToProto("input/target-not-status.yaml"),
					Observed: &fnv1.State{Composite: fixture("observed/xr.yaml")},
				},
			},
			want: want{
				rsp: &fnv1.RunFunctionResponse{
					Meta:    respMeta,
					Results: fatal(`target.fieldPath must begin with "status", got "spec.aicr"`),
				},
			},
		},
		"GatesDependentsWithoutObserved": {
			reason: "With gating on and nothing observed, gpu-operator is withheld until cert-manager is Ready.",
			args: args{
				ctx: context.Background(),
				req: &fnv1.RunFunctionRequest{
					Meta:            meta(),
					Input:           yamlToProto("input/gate.yaml"),
					Observed:        &fnv1.State{Composite: fixture("observed/xr.yaml")},
					RequiredSchemas: map[string]*fnv1.Schema{"release": permissiveSchema()},
				},
			},
			want: want{
				rsp: &fnv1.RunFunctionResponse{
					Meta:         respMeta,
					Requirements: releaseRequirement(),
					Results: []*fnv1.Result{{
						Severity: fnv1.Severity_SEVERITY_NORMAL,
						Message:  `delaying "gpu-operator" until dependency "cert-manager" is ready`,
						Target:   fnv1.Target_TARGET_COMPOSITE.Enum(),
					}},
					Conditions: []*fnv1.Condition{functionSuccess()},
				},
				golden: golden{resources: "gate-none"},
			},
		},
		"WritesSummaryExcludingGatedComponents": {
			reason: "A component withheld by the dependency gate must not be reported as deployed in the summary.",
			args: args{
				ctx: context.Background(),
				req: &fnv1.RunFunctionRequest{
					Meta:            meta(),
					Input:           yamlToProto("input/gate-with-target.yaml"),
					Observed:        &fnv1.State{Composite: fixture("observed/xr.yaml")},
					Desired:         &fnv1.State{Composite: fixture("desired/xr.yaml")},
					RequiredSchemas: map[string]*fnv1.Schema{"release": permissiveSchema()},
				},
			},
			want: want{
				rsp: &fnv1.RunFunctionResponse{
					Meta:         respMeta,
					Requirements: releaseRequirement(),
					Results: []*fnv1.Result{{
						Severity: fnv1.Severity_SEVERITY_NORMAL,
						Message:  `delaying "gpu-operator" until dependency "cert-manager" is ready`,
						Target:   fnv1.Target_TARGET_COMPOSITE.Enum(),
					}},
					Conditions: []*fnv1.Condition{functionSuccess()},
				},
				golden: golden{resources: "gate-none", composite: "composite/summary-gated.yaml"},
			},
		},
		"EmitsDependentWhenDepsReady": {
			reason: "Once cert-manager is observed Ready, gpu-operator is emitted.",
			args: args{
				ctx: context.Background(),
				req: &fnv1.RunFunctionRequest{
					Meta:  meta(),
					Input: yamlToProto("input/gate.yaml"),
					Observed: &fnv1.State{
						Composite: fixture("observed/xr.yaml"),
						Resources: map[string]*fnv1.Resource{
							"cert-manager": fixture("observed/cert-manager-ready.yaml"),
						},
					},
					RequiredSchemas: map[string]*fnv1.Schema{"release": permissiveSchema()},
				},
			},
			want: want{
				rsp: &fnv1.RunFunctionResponse{
					Meta:         respMeta,
					Requirements: releaseRequirement(),
					Conditions:   []*fnv1.Condition{functionSuccess()},
				},
				golden: golden{resources: "gate-ready"},
			},
		},
	}

	dp := newDataProvider()

	for name, tc := range cases {
		t.Run(name, func(t *testing.T) {
			f := &Function{log: logging.NewNopLogger(), ttl: response.DefaultTTL, dp: dp, recipeVersion: testRecipeVersion}
			rsp, err := f.RunFunction(tc.args.ctx, tc.args.req)

			if *update {
				writeGolden(t, tc.want.golden, rsp.GetDesired())
			}
			tc.want.rsp.Desired = loadGolden(t, tc.want.golden)

			if diff := cmp.Diff(tc.want.rsp, rsp, protocmp.Transform()); diff != "" {
				t.Errorf("%s\nf.RunFunction(...): -want rsp, +got rsp:\n%s", tc.reason, diff)
			}
			if diff := cmp.Diff(tc.want.err, err, cmpopts.EquateErrors()); diff != "" {
				t.Errorf("%s\nf.RunFunction(...): -want err, +got err:\n%s", tc.reason, diff)
			}
		})
	}
}

// TestCatalogInvariants resolves every leaf recipe of the embedded AICR
// catalog through the function's own building blocks and asserts the
// properties the function relies on but TestRunFunction — which pins the
// content of a single, manifest-free tier — cannot see. An AICR bump that ships
// a manifest that does not render, two documents that map to the same Object
// name, a disabled component in the deployment order, a dependency on a
// component that is not in the recipe, or a dependency graph the gate can
// never drain fails here, not in a cluster.
func TestCatalogInvariants(t *testing.T) {
	ctx := context.Background()
	dp := newDataProvider()

	leaves, err := recipe.ResolveLeaves(ctx, recipe.ResolveLeavesOptions{Provider: dp, Version: testRecipeVersion})
	if err != nil {
		t.Fatalf("recipe.ResolveLeaves(...): %v", err)
	}
	if len(leaves) == 0 {
		t.Fatal("recipe.ResolveLeaves(...): the embedded catalog has no leaf recipes")
	}

	pcRef := compose.ProviderConfigRef{Kind: "ClusterProviderConfig", Name: "gpu-cluster"}
	permissive, err := schema.NewValidator(permissiveSchema().GetOpenapiV3())
	if err != nil {
		t.Fatalf("schema.NewValidator(...): %v", err)
	}

	for _, leaf := range leaves {
		t.Run(leaf.Entry.Name, func(t *testing.T) {
			t.Parallel()
			if leaf.Err != nil {
				t.Fatalf("the catalog cannot resolve this leaf: %v", leaf.Err)
			}
			criteria := leaf.Entry.Criteria
			if err := criteria.Validate(); err != nil {
				t.Fatalf("a shipped leaf's criteria must pass AICR's own validation, or the function could never resolve it: %v", err)
			}

			// The function's own resolution path, without a snapshot evaluator.
			res, err := recipe.NewBuilder(recipe.WithVersion(testRecipeVersion), recipe.WithDataProvider(dp)).BuildFromCriteria(ctx, criteria)
			if err != nil {
				t.Fatalf("BuildFromCriteria(%s): %v", criteria, err)
			}

			rsp := &fnv1.RunFunctionResponse{}
			managed := managedComponents(rsp, res, &v1beta1.Input{})
			for _, r := range rsp.GetResults() {
				if r.GetSeverity() == fnv1.Severity_SEVERITY_WARNING {
					t.Errorf("managedComponents(...) warned with no skips or overrides configured: %s", r.GetMessage())
				}
			}
			if len(managed) == 0 {
				t.Fatalf("no managed component: the leaf would deploy nothing")
			}

			inRecipe := make(map[string]bool, len(res.ComponentRefs))
			enabled := make(map[string]bool, len(res.ComponentRefs))
			for _, c := range res.ComponentRefs {
				inRecipe[c.Name] = true
				enabled[c.Name] = c.IsEnabled()
			}
			ordered := make(map[string]bool, len(res.DeploymentOrder))
			for _, name := range res.DeploymentOrder {
				ordered[name] = true
				if !enabled[name] {
					t.Errorf("DeploymentOrder lists %q, which is disabled or absent; the summary would report a component the function never deploys", name)
				}
			}
			for _, name := range slices.Sorted(maps.Keys(managed)) {
				if !ordered[name] {
					t.Errorf("managed component %q is not in DeploymentOrder — is it disabled by the recipe?", name)
				}
			}
			for _, name := range slices.Sorted(maps.Keys(managed)) {
				for _, dep := range managed[name].DependencyRefs {
					if !inRecipe[dep] {
						t.Errorf("%q depends on %q, which is not a component of the recipe", name, dep)
					}
				}
			}

			values, err := resolveValues(ctx, res, managed)
			if err != nil {
				t.Fatalf("resolveValues(...): %v", err)
			}

			// Every Release must build and every manifest file must render
			// and parse — the function is Fatal otherwise, and a recipe with
			// a Fatal tier is unusable.
			s := &stack{
				managed:       managed,
				values:        values,
				pcRef:         pcRef,
				dp:            dp,
				releaseSchema: permissive,
				objectSchema:  permissive,
				desired:       make(map[resource.Name]*resource.DesiredComposed),
			}
			if err := s.composeReleases(); err != nil {
				t.Fatalf("composeReleases(): %v", err)
			}
			if err := s.composeObjects(ctx); err != nil {
				t.Fatalf("composeObjects(...): %v", err)
			}
			releases, emitted := 0, 0
			for _, name := range slices.Sorted(maps.Keys(managed)) {
				if !managed[name].IsManifestOnlyHelm() {
					releases++
				}
				emitted += len(s.objects.all(name))
			}
			all := s.desired
			if releases+emitted != len(all) {
				t.Errorf("names collide: %d Releases and %d Objects composed but %d distinct names; a later resource overwrote an earlier one", releases, emitted, len(all))
			}

			// The gate must eventually emit everything: starting from nothing
			// observed, and marking whatever it emits Ready between rounds,
			// the withheld set must reach zero. A dependency graph it cannot
			// drain — the manifest-only deadlock class — shows up as
			// resources it never emits.
			total := len(all)
			observed := make(map[resource.Name]resource.ObservedComposed, total)
			converged := false
			for round := 0; round <= 3*len(managed)+3; round++ {
				d := maps.Clone(all)
				(&stack{managed: managed, desired: d, observed: observed, objects: s.objects}).gate(&fnv1.RunFunctionResponse{})
				if len(d) == total {
					converged = true
					break
				}
				progressed := false
				for name := range d {
					if _, ok := observed[name]; ok {
						continue
					}
					cd := composed.New()
					cd.SetName(string(name))
					cd.SetConditions(xpv2.Available())
					observed[name] = resource.ObservedComposed{Resource: cd}
					progressed = true
				}
				if !progressed {
					break
				}
			}
			if !converged {
				never := make([]string, 0)
				for name := range all {
					if _, ok := observed[name]; !ok {
						never = append(never, string(name))
					}
				}
				slices.Sort(never)
				t.Errorf("the gate never emits %d of %d resources even with everything it emitted Ready — a dependency it can never see satisfied: %v", len(never), total, never)
			}
		})
	}
}

// TestGate exercises the gate directly. The embedded "kind" recipe used by
// TestRunFunction carries no manifest files, and its gate cases only ever place
// the dependency (cert-manager) in observed, never the dependent itself; so
// neither the pre-/post-manifest waves nor the "never gate something already
// created" guards have coverage there. The gate withholds resources by deleting
// map entries from desired, which is authoritative — untested deletion logic
// can silently tear down a running component.
func TestGate(t *testing.T) {
	observedResource := func(name string, ready bool) (resource.Name, resource.ObservedComposed) {
		cd := composed.New()
		cd.SetName(name)
		if ready {
			cd.SetConditions(xpv2.Available())
		}
		return resource.Name(name), resource.ObservedComposed{Resource: cd}
	}
	observe := func(entries ...func() (resource.Name, resource.ObservedComposed)) map[resource.Name]resource.ObservedComposed {
		observed := make(map[resource.Name]resource.ObservedComposed, len(entries))
		for _, e := range entries {
			name, oc := e()
			observed[name] = oc
		}
		return observed
	}
	ready := func(name string) func() (resource.Name, resource.ObservedComposed) {
		return func() (resource.Name, resource.ObservedComposed) { return observedResource(name, true) }
	}
	notReady := func(name string) func() (resource.Name, resource.ObservedComposed) {
		return func() (resource.Name, resource.ObservedComposed) { return observedResource(name, false) }
	}
	delay := func(format string, a ...any) *fnv1.Result {
		return &fnv1.Result{
			Severity: fnv1.Severity_SEVERITY_NORMAL,
			Message:  fmt.Sprintf(format, a...),
			Target:   fnv1.Target_TARGET_COMPOSITE.Enum(),
		}
	}

	const (
		dependency   = "cert-manager"
		component    = "gpu-operator"
		preObject    = "gpu-operator-pre-namespace-gpu-operator"
		postObject   = "gpu-operator-post-clusterpolicy-cluster-policy"
		manifestOnly = "nodewright-customizations"
		mOnlyObject  = "nodewright-customizations-post-configmap-tuning"
	)
	chart := func(name string, deps ...string) *recipe.ComponentRef {
		return &recipe.ComponentRef{Name: name, Type: recipe.ComponentTypeHelm, Source: "https://example.com", Chart: name, DependencyRefs: deps}
	}
	manifests := func(name string, deps ...string) *recipe.ComponentRef {
		return &recipe.ComponentRef{Name: name, Type: recipe.ComponentTypeHelm, ManifestFiles: []string{"post/tuning.yaml"}, DependencyRefs: deps}
	}

	// Component sets.
	componentWithDependency := map[string]*recipe.ComponentRef{
		dependency: chart(dependency),
		component:  chart(component, dependency),
	}
	componentWithUnmanagedDependency := map[string]*recipe.ComponentRef{
		component: chart(component, "nfd"),
	}
	componentAlone := map[string]*recipe.ComponentRef{
		component: chart(component),
	}
	componentOnManifestOnly := map[string]*recipe.ComponentRef{
		manifestOnly: manifests(manifestOnly),
		component:    chart(component, manifestOnly),
	}
	manifestOnlyWithDependency := map[string]*recipe.ComponentRef{
		dependency:   chart(dependency),
		manifestOnly: manifests(manifestOnly, dependency),
	}

	// Object sets.
	none := manifestObjects{}
	pre := manifestObjects{pre: map[string][]string{component: {preObject}}}
	post := manifestObjects{post: map[string][]string{component: {postObject}}}
	mOnly := manifestObjects{post: map[string][]string{manifestOnly: {mOnlyObject}}}

	type args struct {
		managed  map[string]*recipe.ComponentRef
		desired  []string
		observed map[resource.Name]resource.ObservedComposed
		objects  manifestObjects
	}
	type want struct {
		desired []string
		results []*fnv1.Result
	}

	cases := map[string]struct {
		reason string
		args   args
		want   want
	}{
		// Release ← managed dependencies.
		"GatesReleaseWhenDependencyAbsent": {
			reason: "Nothing observed: the dependent Release is withheld and the dependency survives.",
			args:   args{managed: componentWithDependency, desired: []string{dependency, component}, objects: none},
			want: want{
				desired: []string{dependency},
				results: []*fnv1.Result{delay(`delaying %q until dependency %q is ready`, component, dependency)},
			},
		},
		"GatesReleaseWhenDependencyNotReady": {
			reason: "The dependency is observed but not Ready: the dependent Release is still withheld.",
			args:   args{managed: componentWithDependency, desired: []string{dependency, component}, observed: observe(notReady(dependency)), objects: none},
			want: want{
				desired: []string{dependency},
				results: []*fnv1.Result{delay(`delaying %q until dependency %q is ready`, component, dependency)},
			},
		},
		"EmitsReleaseWhenDependencyReady": {
			reason: "The dependency is observed Ready: both Releases survive.",
			args:   args{managed: componentWithDependency, desired: []string{dependency, component}, observed: observe(ready(dependency)), objects: none},
			want:   want{desired: []string{dependency, component}},
		},
		"NeverDeletesLiveRelease": {
			reason: "The dependent is already live while its dependency is absent: the gate must not tear down a running component when its dependency goes briefly unready.",
			args:   args{managed: componentWithDependency, desired: []string{component}, observed: observe(ready(component)), objects: none},
			want:   want{desired: []string{component}},
		},
		"EmitsReleaseWhenDependencyUnmanaged": {
			reason: "A dependency absent from the managed set is treated as satisfied — the user opted to manage it elsewhere.",
			args:   args{managed: componentWithUnmanagedDependency, desired: []string{component}, objects: none},
			want:   want{desired: []string{component}},
		},

		// Release ← its pre-manifest Objects.
		"GatesReleaseWhenPreObjectAbsent": {
			reason: "Nothing observed: the Release is withheld and its pre-manifest Object stays in desired.",
			args:   args{managed: componentAlone, desired: []string{component, preObject}, objects: pre},
			want: want{
				desired: []string{preObject},
				results: []*fnv1.Result{delay(`delaying %q until pre-manifest object %q is ready`, component, preObject)},
			},
		},
		"GatesReleaseWhenPreObjectNotReady": {
			reason: "The pre-manifest Object is observed but not Ready: the Release is still withheld.",
			args:   args{managed: componentAlone, desired: []string{component, preObject}, observed: observe(notReady(preObject)), objects: pre},
			want: want{
				desired: []string{preObject},
				results: []*fnv1.Result{delay(`delaying %q until pre-manifest object %q is ready`, component, preObject)},
			},
		},
		"EmitsReleaseWhenPreObjectReady": {
			reason: "The pre-manifest Object is observed Ready: the Release survives.",
			args:   args{managed: componentAlone, desired: []string{component, preObject}, observed: observe(ready(preObject)), objects: pre},
			want:   want{desired: []string{component, preObject}},
		},
		"NeverDeletesLiveReleaseWhenPreObjectAbsent": {
			reason: "The Release is already live while its pre-manifest Object is absent: the gate must not tear down a running component when a sibling goes briefly unready.",
			args:   args{managed: componentAlone, desired: []string{component, preObject}, observed: observe(ready(component)), objects: pre},
			want:   want{desired: []string{component, preObject}},
		},

		// Pre-manifest Objects ← managed dependencies.
		"GatesPreObjectsAndReleaseWhenDependencyNotReady": {
			reason: "A component's pre-manifest Objects wait for its dependencies too: aicr's pre wave follows the dependencies' waves.",
			args:   args{managed: componentWithDependency, desired: []string{dependency, component, preObject}, objects: pre},
			want: want{
				desired: []string{dependency},
				results: []*fnv1.Result{
					delay(`delaying pre-manifest objects of %q until dependency %q is ready`, component, dependency),
					delay(`delaying %q until dependency %q is ready`, component, dependency),
				},
			},
		},
		"NeverDeletesLivePreObject": {
			reason: "The pre-manifest Object is already live while the dependency is absent: only the not-yet-created Release is withheld, and no pre-manifest delay is reported for nothing.",
			args:   args{managed: componentWithDependency, desired: []string{dependency, component, preObject}, observed: observe(ready(preObject)), objects: pre},
			want: want{
				desired: []string{dependency, preObject},
				results: []*fnv1.Result{delay(`delaying %q until dependency %q is ready`, component, dependency)},
			},
		},

		// Post-manifest Objects ← the component's Release.
		"GatesPostObjectsWhenReleaseAbsent": {
			reason: "The Release is not yet created: its post-manifest Objects are withheld (aicr's post wave lands after the chart).",
			args:   args{managed: componentAlone, desired: []string{component, postObject}, objects: post},
			want: want{
				desired: []string{component},
				results: []*fnv1.Result{delay(`delaying post-manifest objects of %q until its Release is ready`, component)},
			},
		},
		"GatesPostObjectsWhenReleaseNotReady": {
			reason: "The Release is observed but not Ready (still installing): its post-manifest Objects are still withheld.",
			args:   args{managed: componentAlone, desired: []string{component, postObject}, observed: observe(notReady(component)), objects: post},
			want: want{
				desired: []string{component},
				results: []*fnv1.Result{delay(`delaying post-manifest objects of %q until its Release is ready`, component)},
			},
		},
		"EmitsPostObjectsWhenReleaseReady": {
			reason: "The Release is observed Ready: its post-manifest Objects survive.",
			args:   args{managed: componentAlone, desired: []string{component, postObject}, observed: observe(ready(component)), objects: post},
			want:   want{desired: []string{component, postObject}},
		},
		"NeverDeletesLivePostObject": {
			reason: "The post-manifest Object is already live while its Release is not observed: the gate must not tear it down.",
			args:   args{managed: componentAlone, desired: []string{component, postObject}, observed: observe(ready(postObject)), objects: post},
			want:   want{desired: []string{component, postObject}},
		},

		// Manifest-only component's Objects ← managed dependencies.
		"GatesManifestOnlyObjectsWhenDependencyNotReady": {
			reason: "A manifest-only component has no Release, so all of its Objects wait for its dependencies.",
			args:   args{managed: manifestOnlyWithDependency, desired: []string{dependency, mOnlyObject}, objects: mOnly},
			want: want{
				desired: []string{dependency},
				results: []*fnv1.Result{delay(`delaying objects of %q until dependency %q is ready`, manifestOnly, dependency)},
			},
		},
		"EmitsManifestOnlyObjectsWhenDependencyReady": {
			reason: "The manifest-only component's dependency is observed Ready: its Objects survive.",
			args:   args{managed: manifestOnlyWithDependency, desired: []string{dependency, mOnlyObject}, observed: observe(ready(dependency)), objects: mOnly},
			want:   want{desired: []string{dependency, mOnlyObject}},
		},
		"NeverDeletesLiveManifestOnlyObject": {
			reason: "The manifest-only component's Object is already live while its dependency is absent: the gate must not tear it down.",
			args:   args{managed: manifestOnlyWithDependency, desired: []string{dependency, mOnlyObject}, observed: observe(ready(mOnlyObject)), objects: mOnly},
			want:   want{desired: []string{dependency, mOnlyObject}},
		},

		// Manifest-only component as a dependency: readiness is that of its Objects.
		"GatesDependentOnManifestOnlyDependencyWhoseObjectsAreNotReady": {
			reason: "The dependent's manifest-only dependency has an Object observed but not Ready: the dependent Release is withheld.",
			args:   args{managed: componentOnManifestOnly, desired: []string{component, mOnlyObject}, observed: observe(notReady(mOnlyObject)), objects: mOnly},
			want: want{
				desired: []string{mOnlyObject},
				results: []*fnv1.Result{delay(`delaying %q until dependency %q is ready`, component, manifestOnly)},
			},
		},
		"EmitsDependentWhenManifestOnlyDependencyObjectsReady": {
			reason: "No Release carries a manifest-only component's name, so a bare-name lookup would deadlock; its readiness is that of every Object it emitted.",
			args:   args{managed: componentOnManifestOnly, desired: []string{component, mOnlyObject}, observed: observe(ready(mOnlyObject)), objects: mOnly},
			want:   want{desired: []string{component, mOnlyObject}},
		},
		"EmitsDependentWhenManifestOnlyDependencyHasNoObjects": {
			reason: "The manifest-only dependency emitted no Objects at all: there is nothing to wait for.",
			args:   args{managed: componentOnManifestOnly, desired: []string{component}, objects: none},
			want:   want{desired: []string{component}},
		},
	}

	for name, tc := range cases {
		t.Run(name, func(t *testing.T) {
			desired := make(map[resource.Name]*resource.DesiredComposed, len(tc.args.desired))
			for _, n := range tc.args.desired {
				desired[resource.Name(n)] = &resource.DesiredComposed{Resource: composed.New()}
			}
			rsp := &fnv1.RunFunctionResponse{}

			s := &stack{managed: tc.args.managed, desired: desired, observed: tc.args.observed, objects: tc.args.objects}
			s.gate(rsp)

			gotDesired := slices.Sorted(maps.Keys(desired))
			wantDesired := make([]resource.Name, 0, len(tc.want.desired))
			for _, n := range tc.want.desired {
				wantDesired = append(wantDesired, resource.Name(n))
			}
			slices.Sort(wantDesired)
			if diff := cmp.Diff(wantDesired, gotDesired); diff != "" {
				t.Errorf("%s\ngate(...): -want desired keys, +got desired keys:\n%s", tc.reason, diff)
			}
			if diff := cmp.Diff(tc.want.results, rsp.GetResults(), protocmp.Transform()); diff != "" {
				t.Errorf("%s\ngate(...): -want results, +got results:\n%s", tc.reason, diff)
			}
		})
	}
}

// TestManagedComponents exercises managedComponents directly: the embedded
// "kind" recipe used by TestRunFunction has no disabled or non-Helm component,
// and its skip lists name only real components.
func TestManagedComponents(t *testing.T) {
	warning := func(format string, a ...any) *fnv1.Result {
		return &fnv1.Result{
			Severity: fnv1.Severity_SEVERITY_WARNING,
			Message:  fmt.Sprintf(format, a...),
			Target:   fnv1.Target_TARGET_COMPOSITE.Enum(),
		}
	}
	res := &recipe.RecipeResult{ComponentRefs: []recipe.ComponentRef{
		{Name: "cert-manager", Type: recipe.ComponentTypeHelm, Source: "https://charts.jetstack.io", Chart: "cert-manager"},
		{Name: "gpu-operator", Type: recipe.ComponentTypeHelm, Source: "https://helm.ngc.nvidia.com/nvidia", Chart: "gpu-operator"},
		// Disabled by an overlay: kept in AICR's inventory, never deployed.
		{Name: "mariadb-operator", Type: recipe.ComponentTypeHelm, Source: "oci://ghcr.io/mariadb-operator/charts", Chart: "mariadb-operator", Overrides: map[string]any{"install": false}},
		{Name: "nfd", Type: recipe.ComponentTypeHelm, Source: "https://kubernetes-sigs.github.io/node-feature-discovery/charts", Chart: "node-feature-discovery", Overrides: map[string]any{"enabled": false}},
		{Name: "kustomized", Type: recipe.ComponentTypeKustomize, Source: "https://example.com/repo", Path: "overlays/prod"},
	}}

	type args struct {
		in *v1beta1.Input
	}
	type want struct {
		managed []string
		results []*fnv1.Result
	}

	cases := map[string]struct {
		reason string
		args   args
		want   want
	}{
		"DisabledComponentsAreNotManaged": {
			reason: "Components the recipe disables via overrides.enabled or overrides.install=false must not be deployed, exactly as AICR's own deployers treat them; the non-Helm component is reported once.",
			args:   args{in: &v1beta1.Input{}},
			want: want{
				managed: []string{"cert-manager", "gpu-operator"},
				results: []*fnv1.Result{{
					Severity: fnv1.Severity_SEVERITY_NORMAL,
					Message:  `skipping non-Helm component "kustomized" (type Kustomize) — not yet supported`,
					Target:   fnv1.Target_TARGET_COMPOSITE.Enum(),
				}},
			},
		},
		"SkippedComponentsAreNotManaged": {
			reason: "A skipComponents entry naming a real component — enabled, disabled, or non-Helm — excludes it without a warning.",
			args:   args{in: &v1beta1.Input{SkipComponents: []v1beta1.ComponentRef{{Name: "gpu-operator"}, {Name: "mariadb-operator"}, {Name: "kustomized"}}}},
			want:   want{managed: []string{"cert-manager"}},
		},
		"UnknownSkipWarns": {
			reason: "A skipComponents entry that names nothing is a typo that would otherwise silently deploy the component it meant to skip.",
			args:   args{in: &v1beta1.Input{SkipComponents: []v1beta1.ComponentRef{{Name: "gpu-operatr"}, {Name: "kustomized"}}}},
			want: want{
				managed: []string{"cert-manager", "gpu-operator"},
				results: []*fnv1.Result{warning(`skipComponents names %q, which is not a component of the resolved recipe; check the spelling`, "gpu-operatr")},
			},
		},
		"UnmanagedOverrideWarns": {
			reason: "A componentOverrides entry for anything not managed — misspelled, skipped, or disabled by the recipe — is silently ignored otherwise; warnings are sorted by name.",
			args: args{in: &v1beta1.Input{
				SkipComponents: []v1beta1.ComponentRef{{Name: "kustomized"}},
				ComponentOverrides: map[string]v1beta1.ComponentOverride{
					"gpu-operator":     {Version: "v99.0.0"},
					"gpu-operatr":      {Version: "v99.0.0"},
					"mariadb-operator": {Namespace: "db"},
				},
			}},
			want: want{
				managed: []string{"cert-manager", "gpu-operator"},
				results: []*fnv1.Result{
					warning(`componentOverrides[%q] names no managed component of the resolved recipe (skipped, disabled by the recipe, or misspelled); the override is ignored`, "gpu-operatr"),
					warning(`componentOverrides[%q] names no managed component of the resolved recipe (skipped, disabled by the recipe, or misspelled); the override is ignored`, "mariadb-operator"),
				},
			},
		},
	}

	for name, tc := range cases {
		t.Run(name, func(t *testing.T) {
			rsp := &fnv1.RunFunctionResponse{}

			got := managedComponents(rsp, res, tc.args.in)

			if diff := cmp.Diff(tc.want.managed, slices.Sorted(maps.Keys(got))); diff != "" {
				t.Errorf("%s\nmanagedComponents(...): -want managed, +got managed:\n%s", tc.reason, diff)
			}
			if diff := cmp.Diff(tc.want.results, rsp.GetResults(), protocmp.Transform()); diff != "" {
				t.Errorf("%s\nmanagedComponents(...): -want results, +got results:\n%s", tc.reason, diff)
			}
		})
	}
}

func TestDeployed(t *testing.T) {
	const (
		chartBacked  = "gpu-operator"
		manifestOnly = "nodewright-customizations"
		objectA      = "nodewright-customizations-post-configmap-a"
		objectB      = "nodewright-customizations-post-configmap-b"
	)
	managed := map[string]*recipe.ComponentRef{
		chartBacked:  {Name: chartBacked, Type: recipe.ComponentTypeHelm, Source: "https://example.com", Chart: chartBacked},
		manifestOnly: {Name: manifestOnly, Type: recipe.ComponentTypeHelm, ManifestFiles: []string{"post/a.yaml", "post/b.yaml"}},
	}
	order := []string{"skipped", manifestOnly, chartBacked}
	objects := manifestObjects{post: map[string][]string{manifestOnly: {objectA, objectB}}}
	desiredOf := func(names ...string) map[resource.Name]*resource.DesiredComposed {
		d := make(map[resource.Name]*resource.DesiredComposed, len(names))
		for _, n := range names {
			d[resource.Name(n)] = &resource.DesiredComposed{Resource: composed.New()}
		}
		return d
	}

	type args struct {
		desired map[resource.Name]*resource.DesiredComposed
		objects manifestObjects
	}
	type want struct {
		deployed []string
	}

	cases := map[string]struct {
		reason string
		args   args
		want   want
	}{
		"AllPresent": {
			reason: "Nothing withheld: every managed component is listed in deployment order; components not managed (skipped) are not.",
			args:   args{desired: desiredOf(chartBacked, objectA, objectB), objects: objects},
			want:   want{deployed: []string{manifestOnly, chartBacked}},
		},
		"ReleaseWithheld": {
			reason: "A chart-backed component whose Release the gate withheld is not deployed.",
			args:   args{desired: desiredOf(objectA, objectB), objects: objects},
			want:   want{deployed: []string{manifestOnly}},
		},
		"ManifestOnlyObjectWithheld": {
			reason: "A manifest-only component is deployed only once every Object it emitted is in desired.",
			args:   args{desired: desiredOf(chartBacked, objectA), objects: objects},
			want:   want{deployed: []string{chartBacked}},
		},
		"ManifestOnlyWithoutObjects": {
			reason: "A manifest-only component that emitted no Objects has nothing to withhold and counts as deployed.",
			args:   args{desired: desiredOf(chartBacked), objects: manifestObjects{}},
			want:   want{deployed: []string{manifestOnly, chartBacked}},
		},
	}

	for name, tc := range cases {
		t.Run(name, func(t *testing.T) {
			s := &stack{managed: managed, desired: tc.args.desired, objects: tc.args.objects}
			got := s.deployed(order)
			if diff := cmp.Diff(tc.want.deployed, got); diff != "" {
				t.Errorf("%s\ndeployed(...): -want, +got:\n%s", tc.reason, diff)
			}
		})
	}
}

func TestParseOverrides(t *testing.T) {
	raw := func(j string) *runtime.RawExtension { return &runtime.RawExtension{Raw: []byte(j)} }

	type args struct {
		in *v1beta1.Input
	}
	type want struct {
		overrides map[string]*compose.Override
		err       error
	}

	cases := map[string]struct {
		reason string
		args   args
		want   want
	}{
		"ObjectValues": {
			reason: "A JSON object becomes the override's values; version and namespace pass through.",
			args: args{in: &v1beta1.Input{ComponentOverrides: map[string]v1beta1.ComponentOverride{
				"gpu-operator": {Version: "v99.0.0", Namespace: "gpu", Values: raw(`{"driver":{"enabled":false}}`)},
			}}},
			want: want{overrides: map[string]*compose.Override{
				"gpu-operator": {Version: "v99.0.0", Namespace: "gpu", Values: map[string]any{"driver": map[string]any{"enabled": false}}},
			}},
		},
		"NoValues": {
			reason: "An override without values customizes only version and namespace.",
			args: args{in: &v1beta1.Input{ComponentOverrides: map[string]v1beta1.ComponentOverride{
				"cert-manager": {Namespace: "certs"},
			}}},
			want: want{overrides: map[string]*compose.Override{"cert-manager": {Namespace: "certs"}}},
		},
		"NullValues": {
			reason: "A JSON null is the same as no values.",
			args: args{in: &v1beta1.Input{ComponentOverrides: map[string]v1beta1.ComponentOverride{
				"cert-manager": {Values: raw(`null`)},
			}}},
			want: want{overrides: map[string]*compose.Override{"cert-manager": {}}},
		},
		"NonObjectValuesError": {
			reason: "Values that are valid JSON but not an object are rejected rather than dropped.",
			args: args{in: &v1beta1.Input{ComponentOverrides: map[string]v1beta1.ComponentOverride{
				"gpu-operator": {Values: raw(`["a","b"]`)},
			}}},
			want: want{err: cmpopts.AnyError},
		},
		"MalformedValuesError": {
			reason: "Values that are not JSON at all are rejected up front.",
			args: args{in: &v1beta1.Input{ComponentOverrides: map[string]v1beta1.ComponentOverride{
				"gpu-operator": {Values: raw(`{driver:`)},
			}}},
			want: want{err: cmpopts.AnyError},
		},
	}

	for name, tc := range cases {
		t.Run(name, func(t *testing.T) {
			got, err := parseOverrides(tc.args.in)
			if diff := cmp.Diff(tc.want.err, err, cmpopts.EquateErrors()); diff != "" {
				t.Errorf("%s\nparseOverrides(...): -want err, +got err:\n%s", tc.reason, diff)
			}
			if diff := cmp.Diff(tc.want.overrides, got); diff != "" {
				t.Errorf("%s\nparseOverrides(...): -want, +got:\n%s", tc.reason, diff)
			}
		})
	}
}

func TestJSONKind(t *testing.T) {
	type args struct {
		v any
	}
	type want struct {
		kind string
	}

	cases := map[string]struct {
		reason string
		args   args
		want   want
	}{
		"String":  {reason: "A decoded JSON string.", args: args{v: "x"}, want: want{kind: "string"}},
		"Number":  {reason: "encoding/json decodes every JSON number into a float64.", args: args{v: float64(1)}, want: want{kind: "number"}},
		"Boolean": {reason: "A decoded JSON boolean.", args: args{v: true}, want: want{kind: "boolean"}},
		"Array":   {reason: "A decoded JSON array.", args: args{v: []any{"a"}}, want: want{kind: "array"}},
		"Unknown": {reason: "Anything else — the caller handles objects and null before asking.", args: args{v: map[string]any{}}, want: want{kind: "unknown"}},
	}

	for name, tc := range cases {
		t.Run(name, func(t *testing.T) {
			got := jsonKind(tc.args.v)
			if diff := cmp.Diff(tc.want.kind, got); diff != "" {
				t.Errorf("%s\njsonKind(...): -want, +got:\n%s", tc.reason, diff)
			}
		})
	}
}

func TestRecipeName(t *testing.T) {
	type args struct {
		c *recipe.Criteria
	}
	type want struct {
		name string
	}

	cases := map[string]struct {
		reason string
		args   args
		want   want
	}{
		"AllDimensions": {
			reason: "Every stated dimension: accelerator, service, os, intent, platform.",
			args: args{c: &recipe.Criteria{
				Accelerator: recipe.CriteriaAcceleratorH100,
				Service:     recipe.CriteriaServiceEKS,
				Intent:      recipe.CriteriaIntentTraining,
				OS:          recipe.CriteriaOSUbuntu,
				Platform:    recipe.CriteriaPlatformKubeflow,
			}},
			want: want{name: "h100-eks-ubuntu-training-kubeflow"},
		},
		"UnstatedOSAndPlatformOmitted": {
			reason: "An unstated os or platform must not leave an empty segment behind.",
			args: args{c: &recipe.Criteria{
				Accelerator: recipe.CriteriaAcceleratorH100,
				Service:     recipe.CriteriaServiceKind,
				Intent:      recipe.CriteriaIntentTraining,
			}},
			want: want{name: "h100-kind-training"},
		},
	}

	for name, tc := range cases {
		t.Run(name, func(t *testing.T) {
			got := recipeName(tc.args.c)
			if diff := cmp.Diff(tc.want.name, got); diff != "" {
				t.Errorf("%s\nrecipeName(...): -want, +got:\n%s", tc.reason, diff)
			}
		})
	}
}