compose_test.go

package importer

import (
	"bytes"
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"io"
	"os"
	"path/filepath"
	"syscall"
	"testing"
	"time"

	"github.com/opencontainers/go-digest"
	"github.com/stretchr/testify/require"
	"go.podman.io/image/v5/types"

	"github.com/leosocy/diffah/internal/imageio"
	"github.com/leosocy/diffah/pkg/diff"
	"github.com/leosocy/diffah/pkg/exporter"
)

func openBaseline(t *testing.T, path string) types.ImageSource {
	t.Helper()
	ref, err := imageio.OpenArchiveRef(path)
	require.NoError(t, err)
	src, err := ref.NewImageSource(context.Background(), nil)
	require.NoError(t, err)
	t.Cleanup(func() { _ = src.Close() })
	return src
}

func TestBundleImageSource_GetManifest_ReturnsStoredBytes(t *testing.T) {
	bundlePath := buildTestBundle(t, "svc-a")
	b, err := extractBundle(bundlePath, t.TempDir())
	require.NoError(t, err)
	t.Cleanup(b.cleanup)

	img := b.sidecar.Images[0]
	mfPath := filepath.Join(b.blobDir, img.Target.ManifestDigest.Algorithm().String(),
		img.Target.ManifestDigest.Encoded())
	mfBytes, err := os.ReadFile(mfPath)
	require.NoError(t, err)

	src := &bundleImageSource{
		blobDir:      b.blobDir,
		manifest:     mfBytes,
		manifestMime: img.Target.MediaType,
		sidecar:      b.sidecar,
		baseline:     openBaseline(t, "../../testdata/fixtures/v1_oci.tar"),
		imageName:    img.Name,
		spool:        NewBaselineSpool(t.TempDir()),
	}

	gotBytes, gotMime, err := src.GetManifest(context.Background(), nil)
	require.NoError(t, err)
	require.Equal(t, mfBytes, gotBytes)
	require.Equal(t, img.Target.MediaType, gotMime)
	require.Equal(t, digest.FromBytes(gotBytes), img.Target.ManifestDigest)
}

func TestBundleImageSource_GetBlob_FullEncoding_ReturnsVerifiedBytes(t *testing.T) {
	bundlePath := buildTestBundle(t, "svc-a")
	b, err := extractBundle(bundlePath, t.TempDir())
	require.NoError(t, err)
	t.Cleanup(b.cleanup)

	img := b.sidecar.Images[0]
	mfPath := filepath.Join(b.blobDir, img.Target.ManifestDigest.Algorithm().String(),
		img.Target.ManifestDigest.Encoded())
	mfBytes, err := os.ReadFile(mfPath)
	require.NoError(t, err)

	var fullDigest digest.Digest
	for d, entry := range b.sidecar.Blobs {
		if entry.Encoding == diff.EncodingFull {
			fullDigest = d
			break
		}
	}
	require.NotEmpty(t, fullDigest)

	src := &bundleImageSource{
		blobDir:      b.blobDir,
		manifest:     mfBytes,
		manifestMime: img.Target.MediaType,
		sidecar:      b.sidecar,
		baseline:     openBaseline(t, "../../testdata/fixtures/v1_oci.tar"),
		imageName:    img.Name,
		spool:        NewBaselineSpool(t.TempDir()),
	}

	rc, size, err := src.GetBlob(context.Background(), types.BlobInfo{Digest: fullDigest}, nil)
	require.NoError(t, err)
	defer rc.Close()
	got, err := io.ReadAll(rc)
	require.NoError(t, err)
	require.Equal(t, int64(len(got)), size)
	require.Equal(t, fullDigest, digest.FromBytes(got))
}

func TestBundleImageSource_GetBlob_PatchEncoding_DecodesAndVerifies(t *testing.T) {
	outDir := t.TempDir()
	bp := filepath.Join(outDir, "bundle.tar")
	err := exporter.Export(context.Background(), exporter.Options{
		Pairs: []exporter.Pair{{
			Name:        "svc-a",
			BaselineRef: "oci-archive:../../testdata/fixtures/v1_oci.tar",
			TargetRef:   "oci-archive:../../testdata/fixtures/v2_oci.tar",
		}},
		Platform:    "linux/amd64",
		IntraLayer:  "auto",
		OutputPath:  bp,
		ToolVersion: "test",
		CreatedAt:   time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC),
	})
	require.NoError(t, err)
	b, err := extractBundle(bp, t.TempDir())
	require.NoError(t, err)
	t.Cleanup(b.cleanup)

	var patchDigest digest.Digest
	for d, entry := range b.sidecar.Blobs {
		if entry.Encoding == diff.EncodingPatch {
			patchDigest = d
			break
		}
	}
	if patchDigest == "" {
		t.Skip("fixtures produced no patch-encoded layer; nothing to cover")
	}

	img := b.sidecar.Images[0]
	mfPath := filepath.Join(b.blobDir, img.Target.ManifestDigest.Algorithm().String(),
		img.Target.ManifestDigest.Encoded())
	mfBytes, err := os.ReadFile(mfPath)
	require.NoError(t, err)

	src := &bundleImageSource{
		blobDir:      b.blobDir,
		manifest:     mfBytes,
		manifestMime: img.Target.MediaType,
		sidecar:      b.sidecar,
		baseline:     openBaseline(t, "../../testdata/fixtures/v1_oci.tar"),
		imageName:    img.Name,
		spool:        NewBaselineSpool(t.TempDir()),
		scratchDir:   t.TempDir(),
	}

	rc, size, err := src.GetBlob(context.Background(), types.BlobInfo{Digest: patchDigest}, nil)
	require.NoError(t, err)
	defer rc.Close()
	decoded, err := io.ReadAll(rc)
	require.NoError(t, err)
	require.Equal(t, int64(len(decoded)), size)
	require.Equal(t, patchDigest, digest.FromBytes(decoded), "decoded blob must match expected digest")
}

func TestBundleImageSource_GetBlob_PatchEncoding_CorruptedBlob_RaisesAssemblyMismatch(t *testing.T) {
	outDir := t.TempDir()
	bp := filepath.Join(outDir, "bundle.tar")
	err := exporter.Export(context.Background(), exporter.Options{
		Pairs: []exporter.Pair{{
			Name:        "svc-a",
			BaselineRef: "oci-archive:../../testdata/fixtures/v1_oci.tar",
			TargetRef:   "oci-archive:../../testdata/fixtures/v2_oci.tar",
		}},
		Platform:    "linux/amd64",
		IntraLayer:  "auto",
		OutputPath:  bp,
		ToolVersion: "test",
		CreatedAt:   time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC),
	})
	require.NoError(t, err)
	b, err := extractBundle(bp, t.TempDir())
	require.NoError(t, err)
	t.Cleanup(b.cleanup)

	var patchDigest digest.Digest
	for d, entry := range b.sidecar.Blobs {
		if entry.Encoding == diff.EncodingPatch {
			patchDigest = d
			break
		}
	}
	if patchDigest == "" {
		t.Skip("fixtures produced no patch-encoded layer; nothing to cover")
	}

	patchPath := filepath.Join(b.blobDir, patchDigest.Algorithm().String(), patchDigest.Encoded())
	require.NoError(t, os.WriteFile(patchPath, []byte("not a real zstd patch"), 0o600))

	img := b.sidecar.Images[0]
	mfPath := filepath.Join(b.blobDir, img.Target.ManifestDigest.Algorithm().String(),
		img.Target.ManifestDigest.Encoded())
	mfBytes, err := os.ReadFile(mfPath)
	require.NoError(t, err)

	src := &bundleImageSource{
		blobDir:      b.blobDir,
		manifest:     mfBytes,
		manifestMime: img.Target.MediaType,
		sidecar:      b.sidecar,
		baseline:     openBaseline(t, "../../testdata/fixtures/v1_oci.tar"),
		imageName:    img.Name,
		spool:        NewBaselineSpool(t.TempDir()),
		scratchDir:   t.TempDir(),
	}
	rc, _, err := src.GetBlob(context.Background(), types.BlobInfo{Digest: patchDigest}, nil)
	if err == nil {
		// Streaming verifyingReadCloser surfaces the corruption on Read/EOF
		// rather than at GetBlob (DecodeStream may produce some output before
		// the digest mismatch is detected on EOF). Drain to surface the err.
		_, err = io.ReadAll(rc)
		_ = rc.Close()
	}
	require.Error(t, err)
}

func TestBundleImageSource_GetBlob_BaselineDelegation_Verified(t *testing.T) {
	outDir := t.TempDir()
	bp := filepath.Join(outDir, "bundle.tar")
	err := exporter.Export(context.Background(), exporter.Options{
		Pairs: []exporter.Pair{{
			Name:        "svc-a",
			BaselineRef: "oci-archive:../../testdata/fixtures/v1_oci.tar",
			TargetRef:   "oci-archive:../../testdata/fixtures/v2_oci.tar",
		}},
		Platform:    "linux/amd64",
		IntraLayer:  "off",
		OutputPath:  bp,
		ToolVersion: "test",
		CreatedAt:   time.Date(2026, 1, 1, 0, 0, 0, 0, time.UTC),
	})
	require.NoError(t, err)
	b, err := extractBundle(bp, t.TempDir())
	require.NoError(t, err)
	t.Cleanup(b.cleanup)

	img := b.sidecar.Images[0]
	mfPath := filepath.Join(b.blobDir, img.Target.ManifestDigest.Algorithm().String(),
		img.Target.ManifestDigest.Encoded())
	mfBytes, err := os.ReadFile(mfPath)
	require.NoError(t, err)

	var mf struct {
		Layers []struct {
			Digest digest.Digest `json:"digest"`
		} `json:"layers"`
	}
	require.NoError(t, json.Unmarshal(mfBytes, &mf))

	var requiredDigest digest.Digest
	for _, l := range mf.Layers {
		if _, ok := b.sidecar.Blobs[l.Digest]; !ok {
			requiredDigest = l.Digest
			break
		}
	}
	if requiredDigest == "" {
		t.Skip("all target layers shipped; no baseline-delegated blob to cover")
	}

	src := &bundleImageSource{
		blobDir:      b.blobDir,
		manifest:     mfBytes,
		manifestMime: img.Target.MediaType,
		sidecar:      b.sidecar,
		baseline:     openBaseline(t, "../../testdata/fixtures/v1_oci.tar"),
		imageName:    img.Name,
		spool:        NewBaselineSpool(t.TempDir()),
	}
	rc, size, err := src.GetBlob(context.Background(), types.BlobInfo{Digest: requiredDigest}, nil)
	require.NoError(t, err)
	defer rc.Close()
	got, err := io.ReadAll(rc)
	require.NoError(t, err)
	require.Equal(t, int64(len(got)), size)
	require.Equal(t, requiredDigest, digest.FromBytes(got))
}

// TestServePatch_BlobNotFound_WrapsB1 verifies that when servePatch's
// baseline fetch surfaces a "blob not found" signal (registry-shape
// "blob unknown to registry" string here), the error is wrapped as
// *ErrMissingPatchSource carrying the originating image, the shipped
// patch digest, and the missing patch-from digest. Other failure modes
// (auth/TLS/network/timeout) keep their existing fmt.Errorf wrapping —
// covered indirectly by the existing CategoryEnvironment classification
// in pkg/diff/classify_registry.go.
func TestServePatch_BlobNotFound_WrapsB1(t *testing.T) {
	patchBytes := []byte("ignored")
	target := digest.FromBytes([]byte("target"))
	patchSrc := digest.FromBytes([]byte("missing-source"))

	dir := t.TempDir()
	blobDir := filepath.Join(dir, "blobs")
	if err := os.MkdirAll(filepath.Join(blobDir, target.Algorithm().String()), 0o755); err != nil {
		t.Fatal(err)
	}
	patchPath := filepath.Join(blobDir, target.Algorithm().String(), target.Encoded())
	if err := os.WriteFile(patchPath, patchBytes, 0o644); err != nil {
		t.Fatal(err)
	}

	src := &bundleImageSource{
		blobDir:   blobDir,
		imageName: "svc-x",
		baseline:  &fakeBlobNotFoundSource{},
		spool:     NewBaselineSpool(t.TempDir()),
		sidecar:   &diff.Sidecar{},
	}
	entry := diff.BlobEntry{
		Encoding:        diff.EncodingPatch,
		PatchFromDigest: patchSrc,
	}
	_, _, err := src.servePatch(context.Background(), target, entry, nil)

	var b1 *ErrMissingPatchSource
	if !errors.As(err, &b1) {
		t.Fatalf("expected ErrMissingPatchSource, got %T: %v", err, err)
	}
	if b1.PatchFromDigest != patchSrc {
		t.Errorf("PatchFromDigest = %v, want %v", b1.PatchFromDigest, patchSrc)
	}
	if b1.ShippedDigest != target {
		t.Errorf("ShippedDigest = %v, want %v", b1.ShippedDigest, target)
	}
	if b1.ImageName != "svc-x" {
		t.Errorf("ImageName = %q, want %q", b1.ImageName, "svc-x")
	}
}

// fakeFixedBytesSource is a minimal types.ImageSource that always returns
// fixed bytes from GetBlob — used to drive a digest-mismatch through
// fetchVerifiedBaselineBlob without standing up a registry fixture.
type fakeFixedBytesSource struct{ bytes []byte }

func (*fakeFixedBytesSource) Reference() types.ImageReference { return nil }
func (*fakeFixedBytesSource) Close() error                    { return nil }
func (*fakeFixedBytesSource) GetManifest(context.Context, *digest.Digest) ([]byte, string, error) {
	return nil, "", nil
}
func (*fakeFixedBytesSource) HasThreadSafeGetBlob() bool { return true }
func (*fakeFixedBytesSource) GetSignatures(context.Context, *digest.Digest) ([][]byte, error) {
	return nil, nil
}
func (*fakeFixedBytesSource) LayerInfosForCopy(context.Context, *digest.Digest) ([]types.BlobInfo, error) {
	return nil, nil
}
func (s *fakeFixedBytesSource) GetBlob(context.Context, types.BlobInfo, types.BlobInfoCache) (io.ReadCloser, int64, error) {
	return io.NopCloser(bytes.NewReader(s.bytes)), int64(len(s.bytes)), nil
}

// TestGetBlob_BaselineDigestMismatch_RewrapsWithImageName verifies that
// when the spool's digest-verification gate fires (fetched bytes' digest
// does not match the requested digest), fetchVerifiedBaselineBlob
// repopulates ImageName on the returned *diff.ErrBaselineBlobDigestMismatch.
// Spool sees one digest at a time and is per-Import; the per-image label
// is added at the call site so operator-facing diagnostics still name the
// image being applied. Regression guard for PR3 backend swap.
func TestGetBlob_BaselineDigestMismatch_RewrapsWithImageName(t *testing.T) {
	wrongDigest := digest.FromBytes([]byte("requested-digest-source"))
	actualBytes := []byte("actual-bytes-with-different-digest")

	src := &bundleImageSource{
		blobDir:   t.TempDir(),
		imageName: "svc-z",
		baseline:  &fakeFixedBytesSource{bytes: actualBytes},
		spool:     NewBaselineSpool(t.TempDir()),
		sidecar:   &diff.Sidecar{Blobs: map[digest.Digest]diff.BlobEntry{}},
	}
	_, _, err := src.GetBlob(context.Background(),
		types.BlobInfo{Digest: wrongDigest}, nil)

	var mismatch *diff.ErrBaselineBlobDigestMismatch
	if !errors.As(err, &mismatch) {
		t.Fatalf("expected *diff.ErrBaselineBlobDigestMismatch, got %T: %v", err, err)
	}
	if mismatch.ImageName != "svc-z" {
		t.Errorf("ImageName = %q, want svc-z (rewrap dropped per-image label)", mismatch.ImageName)
	}
	if mismatch.Digest != wrongDigest.String() {
		t.Errorf("Digest = %q, want %q", mismatch.Digest, wrongDigest)
	}
	if mismatch.Got != digest.FromBytes(actualBytes).String() {
		t.Errorf("Got = %q, want %q", mismatch.Got, digest.FromBytes(actualBytes))
	}
}

// fakeBlobNotFoundSource is a minimal types.ImageSource that always returns
// a "blob unknown" error from GetBlob — the registry-shape error verified
// in pkg/importer/errors_test.go::TestIsBlobNotFound.
type fakeBlobNotFoundSource struct{}

func (*fakeBlobNotFoundSource) Reference() types.ImageReference { return nil }
func (*fakeBlobNotFoundSource) Close() error                    { return nil }
func (*fakeBlobNotFoundSource) GetManifest(context.Context, *digest.Digest) ([]byte, string, error) {
	return nil, "", nil
}
func (*fakeBlobNotFoundSource) HasThreadSafeGetBlob() bool { return true }
func (*fakeBlobNotFoundSource) GetSignatures(context.Context, *digest.Digest) ([][]byte, error) {
	return nil, nil
}
func (*fakeBlobNotFoundSource) LayerInfosForCopy(context.Context, *digest.Digest) ([]types.BlobInfo, error) {
	return nil, nil
}
func (*fakeBlobNotFoundSource) GetBlob(context.Context, types.BlobInfo, types.BlobInfoCache) (io.ReadCloser, int64, error) {
	return nil, 0, fmt.Errorf("fetching blob: blob unknown to registry")
}

// TestGetBlob_BaselineOnlyMissing_WrapsB2 verifies that when GetBlob's
// baseline-only-reuse branch (the path taken when the target manifest
// references a layer the bundle did not ship) hits a "blob not found"
// signal from the baseline, the error is wrapped as
// *ErrMissingBaselineReuseLayer carrying the image name and the missing
// layer digest. Auth/TLS/network errors keep their existing fmt.Errorf
// wrapping (covered indirectly by classify_registry.go's
// CategoryEnvironment classification).
func TestGetBlob_BaselineOnlyMissing_WrapsB2(t *testing.T) {
	missing := digest.FromBytes([]byte("missing-baseline-layer"))

	src := &bundleImageSource{
		blobDir:   t.TempDir(),
		imageName: "svc-y",
		baseline:  &fakeBlobNotFoundSource{},
		spool:     NewBaselineSpool(t.TempDir()),
		sidecar:   &diff.Sidecar{Blobs: map[digest.Digest]diff.BlobEntry{}},
	}
	_, _, err := src.GetBlob(context.Background(),
		types.BlobInfo{Digest: missing}, nil)

	var b2 *ErrMissingBaselineReuseLayer
	if !errors.As(err, &b2) {
		t.Fatalf("expected ErrMissingBaselineReuseLayer, got %T: %v", err, err)
	}
	if b2.LayerDigest != missing {
		t.Errorf("LayerDigest = %v, want %v", b2.LayerDigest, missing)
	}
	if b2.ImageName != "svc-y" {
		t.Errorf("ImageName = %v, want svc-y", b2.ImageName)
	}
}

// TestGetBlob_BaselineReuse_StreamsFromFile verifies that a baseline-only
// layer (absent from sidecar.Blobs) is streamed from the spool file as an
// *os.File, not buffered into []byte and wrapped in a bytes.NewReader.
// This is the hardening-PR2 contract: for a 1 GiB baseline layer the old
// path held 1 GiB of heap; the new path holds one OS file descriptor.
func TestGetBlob_BaselineReuse_StreamsFromFile(t *testing.T) {
	payload := []byte("baseline-only-reuse-layer-payload-for-streaming")
	d := digest.FromBytes(payload)

	src := &bundleImageSource{
		blobDir:   t.TempDir(),
		imageName: "svc-stream",
		baseline:  &fakeFixedBytesSource{bytes: payload},
		spool:     NewBaselineSpool(t.TempDir()),
		sidecar:   &diff.Sidecar{Blobs: map[digest.Digest]diff.BlobEntry{}},
	}

	rc, size, err := src.GetBlob(context.Background(), types.BlobInfo{Digest: d}, nil)
	require.NoError(t, err)
	defer rc.Close()

	f, ok := rc.(*os.File)
	require.True(t, ok, "expected *os.File (streamed from spool), got %T", rc)

	got, err := io.ReadAll(f)
	require.NoError(t, err)
	require.Equal(t, payload, got)

	st, err := f.Stat()
	require.NoError(t, err)
	require.Equal(t, st.Size(), size, "reported size must match file stat, not len([]byte)")
}

func TestGetBlob_BaselineReuse_CloseWithoutReadClosesFileDescriptor(t *testing.T) {
	payload := []byte("baseline-only-reuse-layer-fd-check")
	d := digest.FromBytes(payload)

	src := &bundleImageSource{
		blobDir:   t.TempDir(),
		imageName: "svc-fd",
		baseline:  &fakeFixedBytesSource{bytes: payload},
		spool:     NewBaselineSpool(t.TempDir()),
		sidecar:   &diff.Sidecar{Blobs: map[digest.Digest]diff.BlobEntry{}},
	}

	rc, _, err := src.GetBlob(context.Background(), types.BlobInfo{Digest: d}, nil)
	require.NoError(t, err)
	f, ok := rc.(*os.File)
	require.True(t, ok, "expected *os.File, got %T", rc)
	path := f.Name()

	var st syscall.Stat_t
	fd := int(f.Fd())
	require.NoError(t, syscall.Fstat(fd, &st), "expected %s file descriptor to be open", path)
	require.NoError(t, rc.Close())
	require.ErrorIs(t, syscall.Fstat(fd, &st), syscall.EBADF,
		"early Close must release the baseline-only file descriptor")
}

// TestFetchVerifiedBaselineBlob_ReturnsReadCloser verifies that
// fetchVerifiedBaselineBlob returns an *os.File opened on the spool path
// rather than a []byte buffer. The spool already verified the digest on
// the streaming pass, so the returned file needs no additional
// verification.
func TestFetchVerifiedBaselineBlob_ReturnsReadCloser(t *testing.T) {
	payload := []byte("fetch-verified-baseline-blob-payload")
	d := digest.FromBytes(payload)

	src := &bundleImageSource{
		blobDir:   t.TempDir(),
		imageName: "svc-rc",
		baseline:  &fakeFixedBytesSource{bytes: payload},
		spool:     NewBaselineSpool(t.TempDir()),
		sidecar:   &diff.Sidecar{Blobs: map[digest.Digest]diff.BlobEntry{}},
	}

	rc, size, err := src.fetchVerifiedBaselineBlob(context.Background(), d, nil)
	require.NoError(t, err)
	defer rc.Close()

	f, ok := rc.(*os.File)
	require.True(t, ok, "expected *os.File, got %T", rc)

	got, err := io.ReadAll(f)
	require.NoError(t, err)
	require.Equal(t, payload, got)
	require.Equal(t, int64(len(payload)), size)
}

func TestVerifyingReadCloser_CloseBeforeEOFSurfacesError(t *testing.T) {
	payload := []byte("verify-on-close-payload")
	expected := digest.FromBytes(payload)
	path := filepath.Join(t.TempDir(), "blob")
	require.NoError(t, os.WriteFile(path, payload, 0o600))

	f, err := os.Open(path)
	require.NoError(t, err)
	rc := &verifyingReadCloser{
		f: f, expected: expected, hasher: expected.Algorithm().Hash(),
		imageName: "svc-close", kind: kindShipped,
	}

	buf := make([]byte, 4)
	n, err := rc.Read(buf)
	require.NoError(t, err)
	require.Equal(t, 4, n)

	err = rc.Close()
	var incomplete *diff.ErrBlobIncompletelyConsumed
	require.ErrorAs(t, err, &incomplete)
	require.Equal(t, "svc-close", incomplete.ImageName)
	require.Equal(t, expected.String(), incomplete.Digest)
}

func TestBundleImageSource_CloseSurfacesReaderCloseError(t *testing.T) {
	payload := []byte("source-close-observes-reader-close")
	d := digest.FromBytes(payload)
	blobDir := filepath.Join(t.TempDir(), "blobs")
	digestDir := filepath.Join(blobDir, d.Algorithm().String())
	require.NoError(t, os.MkdirAll(digestDir, 0o700))
	require.NoError(t, os.WriteFile(filepath.Join(digestDir, d.Encoded()), payload, 0o600))

	src := &bundleImageSource{blobDir: blobDir, imageName: "svc-close"}
	rc, _, err := src.serveFull(d)
	require.NoError(t, err)
	buf := make([]byte, 4)
	_, err = rc.Read(buf)
	require.NoError(t, err)

	require.Error(t, rc.Close())
	var incomplete *diff.ErrBlobIncompletelyConsumed
	require.ErrorAs(t, src.Close(), &incomplete)
	require.Equal(t, "svc-close", incomplete.ImageName)
}

func TestClassifyCopyError_PreservesPrimaryCopyError(t *testing.T) {
	closeErr := &diff.ErrBlobIncompletelyConsumed{Kind: "shipped", Digest: "sha256:test"}
	src := &bundleImageSource{closeErr: closeErr}
	dest := fakeDestRef{}

	err := classifyCopyError(dest, src, context.Canceled)

	require.ErrorIs(t, err, context.Canceled)
	var incomplete *diff.ErrBlobIncompletelyConsumed
	require.False(t, errors.As(err, &incomplete), "copy error should stay primary when another failure exists")
	require.ErrorContains(t, err, closeErr.Error())
}

func TestClassifyCopyError_ReturnsTypedCloseErrorWhenOnlyFailure(t *testing.T) {
	closeErr := &diff.ErrBlobIncompletelyConsumed{Kind: "shipped", Digest: "sha256:test"}
	src := &bundleImageSource{closeErr: closeErr}
	dest := fakeDestRef{}

	err := classifyCopyError(dest, src, fmt.Errorf(" (src: %s)", closeErr.Error()))

	var incomplete *diff.ErrBlobIncompletelyConsumed
	require.ErrorAs(t, err, &incomplete)
	require.Equal(t, closeErr, incomplete)
}

func TestVerifyingReadCloser_CloseAfterEOFReturnsNil(t *testing.T) {
	payload := []byte("verify-after-eof-payload")
	expected := digest.FromBytes(payload)
	path := filepath.Join(t.TempDir(), "blob")
	require.NoError(t, os.WriteFile(path, payload, 0o600))

	f, err := os.Open(path)
	require.NoError(t, err)
	rc := &verifyingReadCloser{
		f: f, expected: expected, hasher: expected.Algorithm().Hash(),
		imageName: "svc-close", kind: kindShipped,
	}

	got, err := io.ReadAll(rc)
	require.NoError(t, err)
	require.Equal(t, payload, got)
	require.NoError(t, rc.Close())
}