import ./make-test-python.nix ({ pkgs, ...} : {
  name = "influxdb2";
  meta = with pkgs.lib.maintainers; {
    maintainers = [ offline ];
  };

  nodes.machine = { lib, ... }: {
    environment.systemPackages = [ pkgs.influxdb2-cli ];
    # Make sure that the service is restarted immediately if tokens need to be rewritten
    # without relying on any Restart=on-failure behavior
    systemd.services.influxdb2.serviceConfig.RestartSec = 6000;
    services.influxdb2.enable = true;
    services.influxdb2.provision = {
      enable = true;
      initialSetup = {
        organization = "default";
        bucket = "default";
        passwordFile = pkgs.writeText "admin-pw" "ExAmPl3PA55W0rD";
        tokenFile = pkgs.writeText "admin-token" "verysecureadmintoken";
      };
      organizations.someorg = {
        buckets.somebucket = {};
        auths.sometoken = {
          description = "some auth token";
          readBuckets = ["somebucket"];
          writeBuckets = ["somebucket"];
        };
      };
      users.someuser.passwordFile = pkgs.writeText "tmp-pw" "abcgoiuhaoga";
    };

    specialisation.withModifications.configuration = { ... }: {
      services.influxdb2.provision = {
        organizations.someorg.buckets.somebucket.present = false;
        organizations.someorg.auths.sometoken.present = false;
        users.someuser.present = false;

        organizations.myorg = {
          description = "Myorg description";
          buckets.mybucket = {
            description = "Mybucket description";
          };
          auths.mytoken = {
            operator = true;
            description = "operator token";
            tokenFile = pkgs.writeText "tmp-tok" "someusertoken";
          };
        };
        users.myuser.passwordFile = pkgs.writeText "tmp-pw" "abcgoiuhaoga";
      };
    };

    specialisation.withParentDelete.configuration = { ... }: {
      services.influxdb2.provision = {
        organizations.someorg.present = false;
        # Deleting the parent implies:
        #organizations.someorg.buckets.somebucket.present = false;
        #organizations.someorg.auths.sometoken.present = false;
      };
    };

    specialisation.withNewTokens.configuration = { ... }: {
      services.influxdb2.provision = {
        organizations.default = {
          auths.operator = {
            operator = true;
            description = "new optoken";
            tokenFile = pkgs.writeText "tmp-tok" "newoptoken";
          };
          auths.allaccess = {
            operator = true;
            description = "new allaccess";
            tokenFile = pkgs.writeText "tmp-tok" "newallaccess";
          };
          auths.specifics = {
            description = "new specifics";
            readPermissions = ["users" "tasks"];
            writePermissions = ["tasks"];
            tokenFile = pkgs.writeText "tmp-tok" "newspecificstoken";
          };
        };
      };
    };
  };

  testScript = { nodes, ... }:
    let
      specialisations = "${nodes.machine.system.build.toplevel}/specialisation";
      tokenArg = "--token verysecureadmintoken";
    in ''
      def assert_contains(haystack, needle):
          if needle not in haystack:
              print("The haystack that will cause the following exception is:")
              print("---")
              print(haystack)
              print("---")
              raise Exception(f"Expected string '{needle}' was not found")

      def assert_lacks(haystack, needle):
          if needle in haystack:
              print("The haystack that will cause the following exception is:")
              print("---")
              print(haystack, end="")
              print("---")
              raise Exception(f"Unexpected string '{needle}' was found")

      machine.wait_for_unit("influxdb2.service")

      machine.fail("curl --fail -X POST 'http://localhost:8086/api/v2/signin' -u admin:wrongpassword")
      machine.succeed("curl --fail -X POST 'http://localhost:8086/api/v2/signin' -u admin:ExAmPl3PA55W0rD")

      out = machine.succeed("influx org list ${tokenArg}")
      assert_contains(out, "default")
      assert_lacks(out, "myorg")
      assert_contains(out, "someorg")

      out = machine.succeed("influx bucket list ${tokenArg} --org default")
      assert_contains(out, "default")

      machine.fail("influx bucket list ${tokenArg} --org myorg")

      out = machine.succeed("influx bucket list ${tokenArg} --org someorg")
      assert_contains(out, "somebucket")

      out = machine.succeed("influx user list ${tokenArg}")
      assert_contains(out, "admin")
      assert_lacks(out, "myuser")
      assert_contains(out, "someuser")

      out = machine.succeed("influx auth list ${tokenArg}")
      assert_lacks(out, "operator token")
      assert_contains(out, "some auth token")

      with subtest("withModifications"):
        machine.succeed('${specialisations}/withModifications/bin/switch-to-configuration test')
        machine.wait_for_unit("influxdb2.service")

        out = machine.succeed("influx org list ${tokenArg}")
        assert_contains(out, "default")
        assert_contains(out, "myorg")
        assert_contains(out, "someorg")

        out = machine.succeed("influx bucket list ${tokenArg} --org myorg")
        assert_contains(out, "mybucket")

        out = machine.succeed("influx bucket list ${tokenArg} --org someorg")
        assert_lacks(out, "somebucket")

        out = machine.succeed("influx user list ${tokenArg}")
        assert_contains(out, "admin")
        assert_contains(out, "myuser")
        assert_lacks(out, "someuser")

        out = machine.succeed("influx auth list ${tokenArg}")
        assert_contains(out, "operator token")
        assert_lacks(out, "some auth token")

        # Make sure the user token is also usable
        machine.succeed("influx auth list --token someusertoken")

      with subtest("keepsUnrelated"):
        machine.succeed('${nodes.machine.system.build.toplevel}/bin/switch-to-configuration test')
        machine.wait_for_unit("influxdb2.service")

        out = machine.succeed("influx org list ${tokenArg}")
        assert_contains(out, "default")
        assert_contains(out, "myorg")
        assert_contains(out, "someorg")

        out = machine.succeed("influx bucket list ${tokenArg} --org default")
        assert_contains(out, "default")

        out = machine.succeed("influx bucket list ${tokenArg} --org myorg")
        assert_contains(out, "mybucket")

        out = machine.succeed("influx bucket list ${tokenArg} --org someorg")
        assert_contains(out, "somebucket")

        out = machine.succeed("influx user list ${tokenArg}")
        assert_contains(out, "admin")
        assert_contains(out, "myuser")
        assert_contains(out, "someuser")

        out = machine.succeed("influx auth list ${tokenArg}")
        assert_contains(out, "operator token")
        assert_contains(out, "some auth token")

      with subtest("withParentDelete"):
        machine.succeed('${specialisations}/withParentDelete/bin/switch-to-configuration test')
        machine.wait_for_unit("influxdb2.service")

        out = machine.succeed("influx org list ${tokenArg}")
        assert_contains(out, "default")
        assert_contains(out, "myorg")
        assert_lacks(out, "someorg")

        out = machine.succeed("influx bucket list ${tokenArg} --org default")
        assert_contains(out, "default")

        out = machine.succeed("influx bucket list ${tokenArg} --org myorg")
        assert_contains(out, "mybucket")

        machine.fail("influx bucket list ${tokenArg} --org someorg")

        out = machine.succeed("influx user list ${tokenArg}")
        assert_contains(out, "admin")
        assert_contains(out, "myuser")
        assert_contains(out, "someuser")

        out = machine.succeed("influx auth list ${tokenArg}")
        assert_contains(out, "operator token")
        assert_lacks(out, "some auth token")

      with subtest("withNewTokens"):
        machine.succeed('${specialisations}/withNewTokens/bin/switch-to-configuration test')
        machine.wait_for_unit("influxdb2.service")

        out = machine.succeed("influx auth list ${tokenArg}")
        assert_contains(out, "operator token")
        assert_contains(out, "some auth token")
        assert_contains(out, "new optoken")
        assert_contains(out, "new allaccess")
        assert_contains(out, "new specifics")
    '';
})