rpki/tests/test_cir_sequence_replay_m3.rs

use std::path::{Path, PathBuf};
use std::process::Command;

use rpki::cir::{encode_cir, materialize_cir, CanonicalInputRepresentation, CirHashAlgorithm, CirObject, CirTal, CIR_VERSION_V1};

fn apnic_tal_path() -> PathBuf {
    PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/tal/apnic-rfc7730-https.tal")
}

fn apnic_ta_path() -> PathBuf {
    PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("tests/fixtures/ta/apnic-ta.cer")
}

fn build_ta_only_cir() -> (CanonicalInputRepresentation, Vec<u8>) {
    let tal_bytes = std::fs::read(apnic_tal_path()).expect("read tal");
    let ta_bytes = std::fs::read(apnic_ta_path()).expect("read ta");
    let tal = rpki::data_model::tal::Tal::decode_bytes(&tal_bytes).expect("decode tal");
    let ta_rsync_uri = tal
        .ta_uris
        .iter()
        .find(|uri| uri.scheme() == "rsync")
        .expect("tal has rsync uri")
        .as_str()
        .to_string();
    let ta_hash = {
        use sha2::{Digest, Sha256};
        Sha256::digest(&ta_bytes).to_vec()
    };
    (
        CanonicalInputRepresentation {
            version: CIR_VERSION_V1,
            hash_alg: CirHashAlgorithm::Sha256,
            validation_time: time::OffsetDateTime::parse(
                "2026-04-07T00:00:00Z",
                &time::format_description::well_known::Rfc3339,
            )
            .unwrap(),
            objects: vec![CirObject {
                rsync_uri: ta_rsync_uri,
                sha256: ta_hash,
            }],
            tals: vec![CirTal {
                tal_uri: "https://example.test/root.tal".to_string(),
                tal_bytes,
            }],
        },
        ta_bytes,
    )
}

fn write_static(root: &Path, date: &str, bytes: &[u8]) {
    use sha2::{Digest, Sha256};
    let hash = hex::encode(Sha256::digest(bytes));
    let dir = root.join(date).join(&hash[0..2]).join(&hash[2..4]);
    std::fs::create_dir_all(&dir).expect("mkdir static");
    std::fs::write(dir.join(hash), bytes).expect("write static object");
}

fn prepare_reference_ccr(work: &Path, cir: &CanonicalInputRepresentation, mirror_root: &Path) -> PathBuf {
    let reference_ccr = work.join("reference.ccr");
    let rpki_bin = env!("CARGO_BIN_EXE_rpki");
    let wrapper = PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("scripts/cir/cir-rsync-wrapper");
    let tal_path = apnic_tal_path();
    let ta_path = apnic_ta_path();
    let out = Command::new(rpki_bin)
        .env("REAL_RSYNC_BIN", "/usr/bin/rsync")
        .env("CIR_MIRROR_ROOT", mirror_root)
        .env("CIR_LOCAL_LINK_MODE", "1")
        .args([
            "--db",
            work.join("reference-db").to_string_lossy().as_ref(),
            "--tal-path",
            tal_path.to_string_lossy().as_ref(),
            "--ta-path",
            ta_path.to_string_lossy().as_ref(),
            "--disable-rrdp",
            "--rsync-command",
            wrapper.to_string_lossy().as_ref(),
            "--validation-time",
            &cir.validation_time.format(&time::format_description::well_known::Rfc3339).unwrap(),
            "--max-depth",
            "0",
            "--max-instances",
            "1",
            "--ccr-out",
            reference_ccr.to_string_lossy().as_ref(),
        ])
        .output()
        .expect("run reference rpki");
    assert!(out.status.success(), "stderr={}", String::from_utf8_lossy(&out.stderr));
    reference_ccr
}

#[test]
fn ours_sequence_replay_script_replays_all_steps() {
    if !Path::new("/usr/bin/rsync").exists() {
        return;
    }
    let td = tempfile::tempdir().expect("tempdir");
    let sequence_root = td.path().join("sequence");
    let static_root = sequence_root.join("static");
    let mirror_root = td.path().join("mirror");
    std::fs::create_dir_all(sequence_root.join("full")).unwrap();
    std::fs::create_dir_all(sequence_root.join("delta-001")).unwrap();
    std::fs::create_dir_all(sequence_root.join("delta-002")).unwrap();

    let (cir, ta_bytes) = build_ta_only_cir();
    let cir_bytes = encode_cir(&cir).expect("encode cir");
    std::fs::write(sequence_root.join("full").join("input.cir"), &cir_bytes).unwrap();
    std::fs::write(sequence_root.join("delta-001").join("input.cir"), &cir_bytes).unwrap();
    std::fs::write(sequence_root.join("delta-002").join("input.cir"), &cir_bytes).unwrap();
    write_static(&static_root, "20260407", &ta_bytes);
    materialize_cir(&cir, &static_root, &mirror_root, true).unwrap();
    let reference = prepare_reference_ccr(td.path(), &cir, &mirror_root);
    std::fs::copy(&reference, sequence_root.join("full").join("result.ccr")).unwrap();
    std::fs::copy(&reference, sequence_root.join("delta-001").join("result.ccr")).unwrap();
    std::fs::copy(&reference, sequence_root.join("delta-002").join("result.ccr")).unwrap();
    std::fs::write(sequence_root.join("full").join("report.json"), b"{}").unwrap();
    std::fs::write(sequence_root.join("delta-001").join("report.json"), b"{}").unwrap();
    std::fs::write(sequence_root.join("delta-002").join("report.json"), b"{}").unwrap();

    let sequence = serde_json::json!({
        "version": 1,
        "staticRoot": "static",
        "steps": [
            {"stepId":"full","kind":"full","validationTime":"2026-04-07T00:00:00Z","cirPath":"full/input.cir","ccrPath":"full/result.ccr","reportPath":"full/report.json","previousStepId":null},
            {"stepId":"delta-001","kind":"delta","validationTime":"2026-04-07T00:00:00Z","cirPath":"delta-001/input.cir","ccrPath":"delta-001/result.ccr","reportPath":"delta-001/report.json","previousStepId":"full"},
            {"stepId":"delta-002","kind":"delta","validationTime":"2026-04-07T00:00:00Z","cirPath":"delta-002/input.cir","ccrPath":"delta-002/result.ccr","reportPath":"delta-002/report.json","previousStepId":"delta-001"}
        ]
    });
    std::fs::write(
        sequence_root.join("sequence.json"),
        serde_json::to_vec_pretty(&sequence).unwrap(),
    )
    .unwrap();

    let script =
        PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("scripts/cir/run_cir_replay_sequence_ours.sh");
    let out = Command::new(script)
        .args([
            "--sequence-root",
            sequence_root.to_string_lossy().as_ref(),
            "--rpki-bin",
            env!("CARGO_BIN_EXE_rpki"),
        ])
        .output()
        .expect("run sequence replay");
    assert!(out.status.success(), "stderr={}", String::from_utf8_lossy(&out.stderr));

    let summary: serde_json::Value =
        serde_json::from_slice(&std::fs::read(sequence_root.join("sequence-summary.json")).unwrap())
            .unwrap();
    assert_eq!(summary["stepCount"], 3);
    assert_eq!(summary["allMatch"], true);
}