// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ERC20Burnable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";
import {VRFV2PlusClient} from "@chainlink/contracts/src/v0.8/vrf/dev/libraries/VRFV2PlusClient.sol";
import {BMCIlluminatiPass} from "src/BMCIlluminatiPass.sol";

contract ProofBMC is ERC20, ERC20Burnable {
    constructor() ERC20("BMC", "BMC") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @dev Mirrors the mainnet VRFCoordinatorV2_5 (0xD7f8...893a) request path: the key hash is NOT
///      validated at request time ("Note we do not check whether the keyHash is valid to save gas.
///      The consequence for users is that they can send requests for invalid keyHashes which will
///      simply not be fulfilled."). Only registered key hashes are ever fulfilled by a node.
///      Verified on a mainnet fork at block 26175613: s_provingKeys(keccak256("500 gwei lane"))
///      returns (false, 0) and requestRandomWords with it still succeeds.
contract ProofCoordinator {
    bytes32 public constant REGISTERED_500_GWEI = 0x3fd2fec10d06ee8f65e7f2e95f5c56511359ece3f33960ad8a866ae24a8ff10b;

    struct Req {
        address consumer;
        bytes32 keyHash;
        uint32 callbackGasLimit;
    }

    uint256 public nonce;
    mapping(uint256 => Req) public requests;

    function s_provingKeys(bytes32 keyHash) external pure returns (bool exists, uint64 maxGas) {
        if (keyHash == REGISTERED_500_GWEI) return (true, 500 gwei);
        return (false, 0);
    }

    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata req) external returns (uint256 id) {
        // No key hash validation, exactly like the real coordinator.
        id = uint256(keccak256(abi.encode(req.keyHash, msg.sender, req.subId, ++nonce)));
        requests[id] = Req(msg.sender, req.keyHash, req.callbackGasLimit);
    }

    /// @dev A VRF node only fulfils requests for a key it holds: unregistered key hash => never.
    function nodeFulfil(uint256 id, uint256 word) external returns (bool ok) {
        Req memory r = requests[id];
        require(r.keyHash == REGISTERED_500_GWEI, "no node holds this key: never fulfilled");
        uint256[] memory words = new uint256[](1);
        words[0] = word;
        (ok,) = r.consumer.call{gas: r.callbackGasLimit}(
            abi.encodeWithSignature("rawFulfillRandomWords(uint256,uint256[])", id, words)
        );
    }
}

/// @notice Fails on the current code: `setVRFConfig` accepts a key hash the coordinator has no
///         proving key for, `mintMystery` then burns 350,000 BMC into a request that no node will
///         ever fulfil, and the token stays Pending forever. Passes once the contract either
///         validates the key hash against the coordinator (`s_provingKeys(keyHash).exists`) before
///         accepting it, or refuses to burn BMC for a request that can never be served.
contract ProofUnregisteredKeyHash is Test {
    ProofBMC bmc;
    ProofCoordinator coord;
    BMCIlluminatiPass pass;
    address owner = makeAddr("owner");
    address buyer = makeAddr("buyer");
    bytes32 constant WRONG_KEY_HASH = keccak256("500 gwei lane"); // same placeholder the repo tests use

    function setUp() public {
        bmc = new ProofBMC();
        coord = new ProofCoordinator();
        pass = new BMCIlluminatiPass(owner, address(bmc), address(coord));
        vm.prank(owner);
        pass.setGenesisImagesCID("cid");
        for (uint256 i = 0; i < 40; i++) {
            address who = address(uint160(0x1000 + i));
            bmc.mint(who, 1_000_000e18);
            vm.startPrank(who);
            bmc.approve(address(pass), 1_000_000e18);
            pass.mintGenesis();
            vm.stopPrank();
        }
    }

    function test_WrongKeyHashMustNotBurnBMCIntoAnUnfulfillableRequest() public {
        (bool exists,) = coord.s_provingKeys(WRONG_KEY_HASH);
        assertFalse(exists, "precondition: key hash is not registered");

        vm.prank(owner);
        try pass.setVRFConfig(42, WRONG_KEY_HASH, 500_000, 3, false) {}
        catch {
            // Fixed variant A: the unregistered key hash is rejected at configuration time.
            return;
        }

        bmc.mint(buyer, 350_000e18);
        vm.startPrank(buyer);
        bmc.approve(address(pass), 350_000e18);
        uint256 supplyBefore = bmc.totalSupply();
        try pass.mintMystery() returns (uint256 tokenId, uint256 requestId) {
            vm.stopPrank();
            // The request exists but can never be fulfilled by any VRF node.
            vm.expectRevert(bytes("no node holds this key: never fulfilled"));
            coord.nodeFulfil(requestId, 1);
            vm.warp(block.timestamp + 365 days);
            pass.finalizeReveals(10);
            // Fixed variant B: BMC must not be gone while the token can never be revealed.
            bool burned = bmc.totalSupply() == supplyBefore - 350_000e18;
            bool stuck = pass.tierOf(tokenId) == BMCIlluminatiPass.Tier.Pending;
            assertFalse(burned && stuck, "350,000 BMC burned for a token that can never be revealed");
        } catch {
            // Fixed variant C: the mint refuses a request that cannot be served; the burn rolled back.
            vm.stopPrank();
            assertEq(bmc.balanceOf(buyer), 350_000e18, "burn rolled back");
        }
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ERC20Burnable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";
import {VRFV2PlusClient} from "@chainlink/contracts/src/v0.8/vrf/dev/libraries/VRFV2PlusClient.sol";
import {BMCIlluminatiPass} from "src/BMCIlluminatiPass.sol";

contract ProofBMC2 is ERC20, ERC20Burnable {
    constructor() ERC20("BMC", "BMC") {}

    function mint(address to, uint256 amount) external {
        _mint(to, amount);
    }
}

/// @dev Minimal VRF v2.5 coordinator stand-in. Requests are recorded; the test decides which ones a
///      node ever fulfils (the real coordinator never fulfils a request whose key hash has no
///      registered proving key, or whose subscription is never funded).
contract ProofCoordinator2 {
    struct Req {
        address consumer;
        uint32 callbackGasLimit;
    }

    uint256 public nonce;
    mapping(uint256 => Req) public requests;

    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata req) external returns (uint256 id) {
        id = uint256(keccak256(abi.encode(req.keyHash, msg.sender, req.subId, ++nonce)));
        requests[id] = Req(msg.sender, req.callbackGasLimit);
    }

    function fulfil(uint256 id, uint256 word) external returns (bool ok) {
        Req memory r = requests[id];
        uint256[] memory words = new uint256[](1);
        words[0] = word;
        (ok,) = r.consumer.call{gas: r.callbackGasLimit}(
            abi.encodeWithSignature("rawFulfillRandomWords(uint256,uint256[])", id, words)
        );
    }
}

/// @notice Fails on the current code: token 41's request is never fulfilled (wrong key hash on the
///         first config, corrected by the owner afterwards). Tokens 42 and 43 are minted under the
///         corrected config and their random words ARE delivered, yet `finalizeReveals` can never
///         reveal them because it only walks forward from the first unrevealed token, and there is
///         no timeout or recovery path. Three holders burned 1,050,000 BMC for tokens frozen in
///         Pending forever. Passes once a timeout recovery exists that lets delivered randomness be
///         used (first-delivered-word-wins) instead of waiting forever on one dead request.
contract ProofStuckRequestFreezesLaterReveals is Test {
    ProofBMC2 bmc;
    ProofCoordinator2 coord;
    BMCIlluminatiPass pass;
    address owner = makeAddr("owner");

    function setUp() public {
        bmc = new ProofBMC2();
        coord = new ProofCoordinator2();
        pass = new BMCIlluminatiPass(owner, address(bmc), address(coord));
        vm.prank(owner);
        pass.setGenesisImagesCID("cid");
        for (uint256 i = 0; i < 40; i++) {
            address who = address(uint160(0x1000 + i));
            bmc.mint(who, 1_000_000e18);
            vm.startPrank(who);
            bmc.approve(address(pass), 1_000_000e18);
            pass.mintGenesis();
            vm.stopPrank();
        }
    }

    function _mystery(address who) internal returns (uint256 id, uint256 req) {
        bmc.mint(who, 350_000e18);
        vm.startPrank(who);
        bmc.approve(address(pass), 350_000e18);
        (id, req) = pass.mintMystery();
        vm.stopPrank();
    }

    function test_DeliveredRandomnessMustBecomeUsableAfterTimeout() public {
        // Owner configures a key hash the coordinator has no proving key for (accepted silently).
        vm.prank(owner);
        pass.setVRFConfig(42, keccak256("typo"), 500_000, 3, false);
        (uint256 t41,) = _mystery(makeAddr("alice")); // request never fulfilled by any node
        assertEq(t41, 41);

        // Owner notices and corrects the configuration. Later mints are served normally.
        vm.prank(owner);
        pass.setVRFConfig(42, 0x3fd2fec10d06ee8f65e7f2e95f5c56511359ece3f33960ad8a866ae24a8ff10b, 500_000, 3, false);
        (uint256 t42, uint256 r42) = _mystery(makeAddr("bob"));
        (uint256 t43, uint256 r43) = _mystery(makeAddr("carol"));
        assertTrue(coord.fulfil(r42, 0xB0B));
        assertTrue(coord.fulfil(r43, 0xCA401));
        assertEq(uint8(pass.revealStatusOf(t42)), uint8(BMCIlluminatiPass.RevealStatus.RandomnessStored));
        assertEq(uint8(pass.revealStatusOf(t43)), uint8(BMCIlluminatiPass.RevealStatus.RandomnessStored));

        // A year passes; token 41's request is still unfulfilled. Anyone tries to finalize.
        vm.warp(block.timestamp + 365 days);
        vm.roll(block.number + 2_600_000);
        pass.finalizeReveals(100);
        pass.finalizeReveals(100);

        assertEq(pass.totalBurned(), 40 * 1_000_000e18 + 3 * 350_000e18, "1,050,000 BMC burned for 3 pending tokens");
        // Tokens whose randomness was delivered must be revealable; they are not.
        assertTrue(pass.tierOf(t42) != BMCIlluminatiPass.Tier.Pending, "token 42 frozen behind dead request for 41");
        assertTrue(pass.tierOf(t43) != BMCIlluminatiPass.Tier.Pending, "token 43 frozen behind dead request for 41");
        // And token 41 itself must be recoverable after a timeout rather than dead forever.
        assertTrue(pass.tierOf(t41) != BMCIlluminatiPass.Tier.Pending, "token 41 has no timeout recovery");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {VRFCoordinatorV2_5Mock} from "@chainlink/contracts/src/v0.8/vrf/mocks/VRFCoordinatorV2_5Mock.sol";
import {ERC20} from "@openzeppelin/contracts/token/ERC20/ERC20.sol";
import {ERC20Burnable} from "@openzeppelin/contracts/token/ERC20/extensions/ERC20Burnable.sol";
import {BMCIlluminatiPass} from "src/BMCIlluminatiPass.sol";

contract Bmc is ERC20Burnable {
    constructor() ERC20("BMC", "BMC") {}
    function mint(address to, uint256 a) external { _mint(to, a); }
}

contract Coord is VRFCoordinatorV2_5Mock {
    constructor() VRFCoordinatorV2_5Mock(0.1 ether, 1e9, 4e15) {}
    function s_provingKeys(bytes32) external pure returns (bool, uint64) { return (true, 500 gwei); }
}

/// Unfunded subscription at sale close: anyone opens request 1 (accepted, unserviceable), then after
/// the timeout anyone opens request 2 - no VRF node misbehaved. Once funded, both fulfilments are
/// valid at the same time and whoever lands one first (coordinator.fulfillRandomWords has no caller
/// restriction; proofs are public in the mempool) chooses the seed. Expected: at most one candidate.
contract OverlapCandidatesTest is Test {
    bytes32 constant KH = 0x3fd2fec10d06ee8f65e7f2e95f5c56511359ece3f33960ad8a866ae24a8ff10b;
    Bmc bmc;
    Coord c;
    BMCIlluminatiPass pass;
    uint256 subId;
    address alice = makeAddr("alice");

    function setUp() public {
        bmc = new Bmc();
        c = new Coord();
        subId = c.createSubscription(); // NOT funded yet
        pass = new BMCIlluminatiPass(makeAddr("owner"), address(bmc), address(c), subId, KH, false, 30 days, 0);
        c.addConsumer(subId, address(pass));
        for (uint256 i; i < 40; i++) _mint(address(uint160(0x9000 + i)), true);
        for (uint256 i; i < 30; i++) _mint(alice, false);
        vm.warp(pass.mysterySaleEnd());
    }

    function _mint(address who, bool genesis) internal {
        uint256 p = genesis ? 1_000_000e18 : 350_000e18;
        bmc.mint(who, p);
        vm.startPrank(who);
        bmc.approve(address(pass), p);
        genesis ? pass.mintGenesis() : pass.mintMystery();
        vm.stopPrank();
    }

    function _aliceGenesis(uint256 req) internal returns (uint256 n) {
        uint256 snap = vm.snapshotState();
        c.fulfillRandomWords(req, address(pass)); // any caller may submit
        pass.finalizeReveals(30);
        for (uint256 id = 41; id <= 70; id++) if (pass.tierOf(id) == BMCIlluminatiPass.Tier.Genesis) n++;
        vm.revertToState(snap);
    }

    function test_unfundedSubscriptionLetsAnyoneAccumulateSeedCandidates() public {
        uint256[] memory reqs = new uint256[](2);
        uint256 open;
        try pass.requestSeed() returns (uint256 r) { reqs[open++] = r; } catch {}
        vm.roll(block.number + pass.SEED_REQUEST_TIMEOUT_BLOCKS());
        try pass.requestSeed() returns (uint256 r) { reqs[open++] = r; } catch {}

        c.fundSubscription(subId, 100 ether); // anyone funds; every open request is now serviceable
        if (open == 2) {
            uint256 g0 = _aliceGenesis(reqs[0]);
            uint256 g1 = _aliceGenesis(reqs[1]);
            emit log_named_uint("alice genesis if request 1 lands first", g0);
            emit log_named_uint("alice genesis if request 2 lands first", g1);
        }
        assertLe(open, 1, "two simultaneously serviceable seed candidates: the first lander picks the seed");
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {BMCIlluminatiPass} from "src/BMCIlluminatiPass.sol";
import {VRFV2PlusClient} from "@chainlink/contracts/src/v0.8/vrf/dev/libraries/VRFV2PlusClient.sol";

/// @dev Minimal 18-decimal token with OpenZeppelin ERC20Burnable-style burnFrom semantics.
contract ProofBMC {
    string public constant name = "BMC Illuminati";
    string public constant symbol = "BMC";
    uint8 public constant decimals = 18;
    uint256 public totalSupply;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
        totalSupply += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function burnFrom(address account, uint256 amount) external {
        uint256 a = allowance[account][msg.sender];
        require(a >= amount, "allowance");
        allowance[account][msg.sender] = a - amount;
        require(balanceOf[account] >= amount, "balance");
        balanceOf[account] -= amount;
        totalSupply -= amount;
    }
}

/// @dev Coordinator stand-in mirroring the mainnet VRFCoordinatorV2_5 surface the pass can read:
///      `s_provingKeys` (registered lane), `getSubscription` (reverts InvalidSubscription for an
///      unknown id, like SubscriptionAPI), `s_consumers` and `pendingRequestExists`.
///      `requestRandomWords` reverts InvalidSubscription for an unknown subscription and
///      InvalidConsumer when the caller is not listed, exactly like the real coordinator.
contract ProofCoordinator {
    error InvalidSubscription();
    error InvalidConsumer(uint256 subId, address consumer);

    struct Sub {
        address owner;
        address[] consumers;
    }

    mapping(bytes32 => bool) private _keys;
    mapping(uint256 => Sub) private _subs;
    mapping(address => mapping(uint256 => bool)) private _active;
    uint256 public nextRequestId = 1;

    function registerKey(bytes32 keyHash) external {
        _keys[keyHash] = true;
    }

    function createSubscription(uint256 subId, address owner) external {
        _subs[subId].owner = owner;
    }

    function addConsumer(uint256 subId, address consumer) external {
        _subs[subId].consumers.push(consumer);
        _active[consumer][subId] = true;
    }

    function s_provingKeys(bytes32 keyHash) external view returns (bool exists, uint64 maxGas) {
        exists = _keys[keyHash];
        maxGas = exists ? 500 gwei : 0;
    }

    function getSubscription(uint256 subId)
        external
        view
        returns (uint96 balance, uint96 nativeBalance, uint64 reqCount, address subOwner, address[] memory consumers)
    {
        if (_subs[subId].owner == address(0)) revert InvalidSubscription();
        return (0, 0, 0, _subs[subId].owner, _subs[subId].consumers);
    }

    function s_consumers(address consumer, uint256 subId)
        external
        view
        returns (bool active, uint64 nonce, uint64 pendingReqCount)
    {
        return (_active[consumer][subId], 0, 0);
    }

    function pendingRequestExists(uint256) external pure returns (bool) {
        return false;
    }

    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata req) external returns (uint256 id) {
        if (_subs[req.subId].owner == address(0)) revert InvalidSubscription();
        if (!_active[msg.sender][req.subId]) revert InvalidConsumer(req.subId, msg.sender);
        id = nextRequestId++;
    }
}

/// @notice The pass verifies the pinned key hash on the coordinator before the first BMC is burned
///         (finding 8f0b2814) but never verifies the pinned SUBSCRIPTION_ID. With a subscription id
///         that does not exist on the coordinator, Genesis and Mystery mints burn BMC normally, and
///         the only seed path (`requestSeed`) reverts `InvalidSubscription` forever: every mystery
///         token stays pending with no recovery. The first burn must refuse an unusable subscription
///         exactly as it refuses an unregistered key hash.
contract Proof_UnverifiedSubscription is Test {
    bytes32 constant KEY_HASH = 0x3fd2fec10d06ee8f65e7f2e95f5c56511359ece3f33960ad8a866ae24a8ff10b;
    uint256 constant WRONG_SUB_ID = 777; // never created on the coordinator

    ProofBMC bmc;
    ProofCoordinator vrf;
    address owner = makeAddr("owner");
    address alice = makeAddr("alice");

    function setUp() public {
        bmc = new ProofBMC();
        vrf = new ProofCoordinator();
        vrf.registerKey(KEY_HASH);
    }

    function test_FirstBurnRefusesNonexistentSubscription() public {
        BMCIlluminatiPass pass =
            new BMCIlluminatiPass(owner, address(bmc), address(vrf), WRONG_SUB_ID, KEY_HASH, false, 30 days, 7 days);

        // Precondition: the coordinator has no such subscription, so no seed request can ever succeed.
        vm.expectRevert(ProofCoordinator.InvalidSubscription.selector);
        vrf.getSubscription(WRONG_SUB_ID);

        bmc.mint(alice, 1_000_000e18);
        vm.startPrank(alice);
        bmc.approve(address(pass), 1_000_000e18);
        // Expected: the mint refuses (as it does for an unregistered key hash) and nothing is burned.
        // Actual on the current code: the mint succeeds and 1,000,000 BMC is destroyed for a
        // collection whose mystery seed can never be requested.
        vm.expectRevert();
        pass.mintGenesis();
        vm.stopPrank();

        assertEq(bmc.balanceOf(alice), 1_000_000e18, "no BMC may be burned into an unusable subscription");
        assertEq(pass.totalMinted(), 0);
    }
}

// SPDX-License-Identifier: MIT
pragma solidity 0.8.26;

import {Test} from "forge-std/Test.sol";
import {BMCIlluminatiPass} from "src/BMCIlluminatiPass.sol";
import {VRFV2PlusClient} from "@chainlink/contracts/src/v0.8/vrf/dev/libraries/VRFV2PlusClient.sol";

/// @dev Minimal 18-decimal token with OpenZeppelin ERC20Burnable-style burnFrom semantics.
contract ProofBMC {
    string public constant name = "BMC Illuminati";
    string public constant symbol = "BMC";
    uint8 public constant decimals = 18;
    uint256 public totalSupply;
    mapping(address => uint256) public balanceOf;
    mapping(address => mapping(address => uint256)) public allowance;

    function mint(address to, uint256 amount) external {
        balanceOf[to] += amount;
        totalSupply += amount;
    }

    function approve(address spender, uint256 amount) external returns (bool) {
        allowance[msg.sender][spender] = amount;
        return true;
    }

    function burnFrom(address account, uint256 amount) external {
        uint256 a = allowance[account][msg.sender];
        require(a >= amount, "allowance");
        allowance[account][msg.sender] = a - amount;
        require(balanceOf[account] >= amount, "balance");
        balanceOf[account] -= amount;
        totalSupply -= amount;
    }
}

/// @dev Mirrors the three behaviours of the mainnet VRFCoordinatorV2_5 that matter here:
///      `s_provingKeys` getter, `getSubscription` (reverts InvalidSubscription for an unknown id),
///      and `requestRandomWords` refusing a caller that is not a consumer of the subscription
///      (InvalidConsumer) or an unknown subscription (InvalidSubscription).
contract ProofCoordinator {
    error InvalidSubscription();
    error InvalidConsumer(uint256 subId, address consumer);

    struct Sub {
        bool exists;
        address owner;
        address[] consumers;
    }

    mapping(bytes32 => bool) private _keys;
    mapping(uint256 => Sub) private _subs;
    uint256 public nextRequestId = 1;

    function setKeyRegistered(bytes32 keyHash, bool v) external {
        _keys[keyHash] = v;
    }

    function s_provingKeys(bytes32 keyHash) external view returns (bool exists, uint64 maxGas) {
        exists = _keys[keyHash];
        maxGas = exists ? 500 gwei : 0;
    }

    function createSubscription(uint256 subId) external {
        _subs[subId].exists = true;
        _subs[subId].owner = msg.sender;
    }

    function addConsumer(uint256 subId, address consumer) external {
        require(_subs[subId].exists && _subs[subId].owner == msg.sender, "not sub owner");
        _subs[subId].consumers.push(consumer);
    }

    function getSubscription(uint256 subId)
        external
        view
        returns (uint96 balance, uint96 nativeBalance, uint64 reqCount, address subOwner, address[] memory consumers)
    {
        if (!_subs[subId].exists) revert InvalidSubscription();
        return (0, 0, 0, _subs[subId].owner, _subs[subId].consumers);
    }

    function _isConsumer(uint256 subId, address c) private view returns (bool) {
        address[] storage cs = _subs[subId].consumers;
        for (uint256 i; i < cs.length; ++i) {
            if (cs[i] == c) return true;
        }
        return false;
    }

    function requestRandomWords(VRFV2PlusClient.RandomWordsRequest calldata req) external returns (uint256 id) {
        if (!_subs[req.subId].exists) revert InvalidSubscription();
        if (!_isConsumer(req.subId, msg.sender)) revert InvalidConsumer(req.subId, msg.sender);
        id = nextRequestId++;
    }
}

/// @notice FAILS on the current code: the first mint verifies the key hash on the coordinator but
///         never verifies that the pass is a consumer of the immutable SUBSCRIPTION_ID. With a wrong,
///         unknown or not-yet-configured subscription, BMC is burned on every mint, and after the
///         sale closes `requestSeed()` reverts forever (InvalidConsumer / InvalidSubscription), with
///         no function able to change the subscription. PASSES once the first mint refuses, before
///         any burn, when `getSubscription(SUBSCRIPTION_ID).consumers` does not contain this contract.
contract Proof_SubscriptionNotValidatedBeforeBurn is Test {
    bytes32 constant KEY_HASH = 0x3fd2fec10d06ee8f65e7f2e95f5c56511359ece3f33960ad8a866ae24a8ff10b;
    uint256 constant GOOD_SUB = 777;
    uint256 constant WRONG_SUB = 778; // e.g. a typo of the real id: nobody owns it, nobody can add a consumer

    ProofBMC bmc;
    ProofCoordinator vrf;
    address owner = makeAddr("owner");
    address subOwner = makeAddr("subOwner");
    address alice = makeAddr("alice");

    function setUp() public {
        bmc = new ProofBMC();
        vrf = new ProofCoordinator();
        vrf.setKeyRegistered(KEY_HASH, true);
        vm.prank(subOwner);
        vrf.createSubscription(GOOD_SUB);
        bmc.mint(alice, 3 * 1_000_000e18);
    }

    function _mintGenesis(BMCIlluminatiPass p, address who) internal returns (bool ok) {
        vm.startPrank(who);
        bmc.approve(address(p), 1_000_000e18);
        (ok,) = address(p).call(abi.encodeCall(p.mintGenesis, ()));
        vm.stopPrank();
    }

    function test_FirstMintRefusesWhenPassIsNotAConsumerOfTheSubscription() public {
        // 1. Unknown subscription id (constructor accepts any non-zero id; nothing can fix this later).
        BMCIlluminatiPass wrong = new BMCIlluminatiPass(owner, address(bmc), address(vrf), WRONG_SUB, KEY_HASH, false, 30 days, 0);
        uint256 supplyBefore = bmc.totalSupply();
        bool ok = _mintGenesis(wrong, alice);
        // Expected (fixed code): refused before any burn, exactly like an unregistered key hash.
        assertFalse(ok, "mint must refuse: pass is not a consumer of SUBSCRIPTION_ID");
        assertEq(bmc.totalSupply(), supplyBefore, "no BMC may be burned into a collection that can never request its seed");
        assertEq(wrong.totalMinted(), 0);

        // 2. Existing subscription whose owner has not (yet) added the pass as consumer.
        BMCIlluminatiPass notYet = new BMCIlluminatiPass(owner, address(bmc), address(vrf), GOOD_SUB, KEY_HASH, false, 30 days, 0);
        supplyBefore = bmc.totalSupply();
        ok = _mintGenesis(notYet, alice);
        assertFalse(ok, "mint must refuse until the pass is a consumer");
        assertEq(bmc.totalSupply(), supplyBefore);

        // 3. Once the subscription owner adds the pass, minting proceeds and the seed can be requested.
        vm.prank(subOwner);
        vrf.addConsumer(GOOD_SUB, address(notYet));
        assertTrue(_mintGenesis(notYet, alice), "consumer registered: mint succeeds");
        assertEq(notYet.totalMinted(), 1);
    }
}