<?php

namespace Tests\Feature;

use App\Models\Server;
use Illuminate\Foundation\Testing\RefreshDatabase;
use Tests\TestCase;

/**
 * The metrics poller keeps one long-lived SSH connection per server and reuses it across
 * ticks. CredentialVault::resolve() enforces a credential's `disabled_at` lock only at
 * connect() time, so a connection opened BEFORE a credential is disabled would keep pulling
 * metrics over the already-open session. The poll set must therefore exclude servers whose
 * credential is disabled (or missing) at the query, so a revoked credential drops out of the
 * live loop on the next tick — Server::withActiveCredential() is that gate.
 */
class PollMetricsCredentialTest extends TestCase
{
    use RefreshDatabase;

    private function serverWithCredential(string $name, string $ip, ?string $disabledAt): Server
    {
        $server = Server::create(['name' => $name, 'ip' => $ip, 'ssh_port' => 22, 'status' => 'online']);
        $server->credential()->create([
            'username' => 'root',
            'auth_type' => 'password',
            'secret' => 'x',
            'disabled_at' => $disabledAt,
        ]);

        return $server;
    }

    public function test_only_servers_with_an_active_credential_are_pollable(): void
    {
        $enabled = $this->serverWithCredential('enabled', '10.0.0.1', null);
        $disabled = $this->serverWithCredential('disabled', '10.0.0.2', now()->toDateTimeString());
        $noCredential = Server::create(['name' => 'bare', 'ip' => '10.0.0.3', 'ssh_port' => 22, 'status' => 'online']);

        $ids = Server::withActiveCredential()->pluck('id');

        $this->assertTrue($ids->contains($enabled->id));       // enabled credential → polled
        $this->assertFalse($ids->contains($disabled->id));     // disabled (revoked) credential → excluded
        $this->assertFalse($ids->contains($noCredential->id)); // no credential → excluded
    }
}