# `checks.module-eval-matrix-core` — see ./lib.nix for the shared
# rationale (why this suite exists, naming convention, "evaluates
# not executes").
{
  pkgs,
  lib,
  self,
  nixosSystem,
}:
let
  inherit
    (import ./lib.nix {
      inherit
        pkgs
        lib
        self
        nixosSystem
        ;
    })
    hive
    runGroup
    ;

  # A deliberately odd `maxRequestSize`, so the number the assertion looks for
  # cannot have come from a default or from another module's literal.
  matrixBodyCap = hive {
    deploy.singleHostSwarm = true;
    deploy.matrix.maxRequestSize = 99000000;
  };

  # The same hive with the identity taken away, which separates "a homeserver
  # is deployed" from "this host can authenticate to the store".
  matrixNoBaoIdentity = hive { deploy.matrix.enable = true; };
  cases = [
    {
      # Absence arm, and what makes the one above able to fail: with no leaf
      # this unit would fail a TLS handshake on every boot, so it must not
      # exist at all rather than retry its way through the start limit.
      name = "a hive with no store identity renders no queue credential reader";
      ok = !(matrixNoBaoIdentity.systemd.services ? swarm-bao-queue-agent);
    }
    {
      # Two limits governed a matrix upload and nothing kept them in agreement,
      # so raising the documented one past the gateway's hardcoded cap changed
      # nothing. The second clause is the control: the old directive is gone, so
      # a pass means the value is derived rather than that `hasInfix` matched
      # something incidental. It targets the whole directive rather than the
      # bare size, because the rendered config carries the comment above it and
      # a prose mention of the old value would defeat a looser arm.
      name = "the matrix gateway's body cap is derived from maxRequestSize, not a literal";
      ok =
        let
          c = matrixBodyCap.services.nginx.virtualHosts."chat.t.local".locations."/_matrix/".extraConfig;
        in
        lib.hasInfix "client_max_body_size 100048576;" c && !(lib.hasInfix "client_max_body_size 50M" c);
    }
    {
      # Absence arm for the one above, and the reason the gate is the identity
      # rather than the homeserver: without it, deploying matrix anywhere would
      # render a reader that cannot authenticate.
      name = "a homeserver with no way to authenticate to the store renders no token reader";
      ok = !(matrixNoBaoIdentity.systemd.services ? swarm-bao-matrix-token);
    }
    {
      # Absence arm for the case above. A hive with no client identity gets no
      # store environment at all — the daemon reports a queue it cannot serve
      # rather than a handshake it cannot explain.
      name = "a hive with no client identity gives hive-c0re no store environment";
      ok =
        let
          s = matrixNoBaoIdentity.systemd.services;
        in
        s ? hive-c0re
        && !(s.hive-c0re.environment ? BAO_ADDR)
        && !(lib.any (c: lib.hasPrefix "bao-" c) s.hive-c0re.serviceConfig.LoadCredential);
    }
  ];
in
runGroup "matrix-core" cases