import ../make-test-python.nix (
  { pkgs, ... }:
  let
    # Set up SSL certs for Synapse to be happy.
    runWithOpenSSL = file: cmd: pkgs.runCommand file
      {
        buildInputs = [ pkgs.openssl ];
      }
      cmd;

    ca_key = runWithOpenSSL "ca-key.pem" "openssl genrsa -out $out 2048";
    ca_pem = runWithOpenSSL "ca.pem" ''
      openssl req \
        -x509 -new -nodes -key ${ca_key} \
        -days 10000 -out $out -subj "/CN=snakeoil-ca"
    '';
    key = runWithOpenSSL "matrix_key.pem" "openssl genrsa -out $out 2048";
    csr = runWithOpenSSL "matrix.csr" ''
      openssl req \
         -new -key ${key} \
         -out $out -subj "/CN=localhost" \
    '';
    cert = runWithOpenSSL "matrix_cert.pem" ''
      openssl x509 \
        -req -in ${csr} \
        -CA ${ca_pem} -CAkey ${ca_key} \
        -CAcreateserial -out $out \
        -days 365
    '';
  in
  {
    name = "mjolnir";
    meta = with pkgs.lib; {
      maintainers = teams.matrix.members;
    };

    nodes = {
      homeserver = { pkgs, ... }: {
        services.matrix-synapse = {
          enable = true;
          settings = {
            database.name = "sqlite3";
            tls_certificate_path = "${cert}";
            tls_private_key_path = "${key}";
            enable_registration = true;
            enable_registration_without_verification = true;
            registration_shared_secret = "supersecret-registration";

            listeners = [ {
              # The default but tls=false
              bind_addresses = [
                "0.0.0.0"
              ];
              port = 8448;
              resources = [ {
                compress = true;
                names = [ "client" ];
              } {
                compress = false;
                names = [ "federation" ];
              } ];
              tls = false;
              type = "http";
              x_forwarded = false;
            } ];
          };
        };

        networking.firewall.allowedTCPPorts = [ 8448 ];

        environment.systemPackages = [
          (pkgs.writeShellScriptBin "register_mjolnir_user" ''
            exec ${pkgs.matrix-synapse}/bin/register_new_matrix_user \
              -u mjolnir \
              -p mjolnir-password \
              --admin \
              --shared-secret supersecret-registration \
              http://localhost:8448
          ''
          )
          (pkgs.writeShellScriptBin "register_moderator_user" ''
            exec ${pkgs.matrix-synapse}/bin/register_new_matrix_user \
              -u moderator \
              -p moderator-password \
              --no-admin \
              --shared-secret supersecret-registration \
              http://localhost:8448
          ''
          )
        ];
      };

      mjolnir = { pkgs, ... }: {
        services.mjolnir = {
          enable = true;
          homeserverUrl = "http://homeserver:8448";
          pantalaimon = {
            enable = true;
            username = "mjolnir";
            passwordFile = pkgs.writeText "password.txt" "mjolnir-password";
            # otherwise mjolnir tries to connect to ::1, which is not listened by pantalaimon
            options.listenAddress = "127.0.0.1";
          };
          managementRoom = "#moderators:homeserver";
        };
      };

      client = { pkgs, ... }: {
        environment.systemPackages = [
          (pkgs.writers.writePython3Bin "create_management_room_and_invite_mjolnir"
            { libraries = with pkgs.python3Packages; [
                (matrix-nio.override { withOlm = true; })
              ];
            } ''
            import asyncio

            from nio import (
                AsyncClient,
                EnableEncryptionBuilder
            )


            async def main() -> None:
                client = AsyncClient("http://homeserver:8448", "moderator")

                await client.login("moderator-password")

                room = await client.room_create(
                    name="Moderators",
                    alias="moderators",
                    initial_state=[EnableEncryptionBuilder().as_dict()],
                )

                await client.join(room.room_id)
                await client.room_invite(room.room_id, "@mjolnir:homeserver")

            asyncio.run(main())
          ''
          )
        ];
      };
    };

    testScript = ''
      with subtest("start homeserver"):
        homeserver.start()

        homeserver.wait_for_unit("matrix-synapse.service")
        homeserver.wait_until_succeeds("curl --fail -L http://localhost:8448/")

      with subtest("register users"):
        # register mjolnir user
        homeserver.succeed("register_mjolnir_user")
        # register moderator user
        homeserver.succeed("register_moderator_user")

      with subtest("start mjolnir"):
        mjolnir.start()

        # wait for pantalaimon to be ready
        mjolnir.wait_for_unit("pantalaimon-mjolnir.service")
        mjolnir.wait_for_unit("mjolnir.service")

        mjolnir.wait_until_succeeds("curl --fail -L http://localhost:8009/")

      with subtest("ensure mjolnir can be invited to the management room"):
        client.start()

        client.wait_until_succeeds("curl --fail -L http://homeserver:8448/")

        client.succeed("create_management_room_and_invite_mjolnir")

        mjolnir.wait_for_console_text("Startup complete. Now monitoring rooms")
    '';
  }
)