loopin_test.go

package loop

import (
	"context"
	"fmt"
	"math"
	"sync/atomic"
	"testing"
	"time"

	"github.com/btcsuite/btcd/btcutil"
	"github.com/btcsuite/btcd/wire"
	"github.com/lightninglabs/lndclient"
	"github.com/lightninglabs/loop/loopdb"
	"github.com/lightninglabs/loop/swap"
	"github.com/lightninglabs/loop/test"
	"github.com/lightninglabs/loop/utils"
	"github.com/lightningnetwork/lnd/chainntnfs"
	"github.com/lightningnetwork/lnd/clock"
	invpkg "github.com/lightningnetwork/lnd/invoices"
	"github.com/lightningnetwork/lnd/lntypes"
	"github.com/lightningnetwork/lnd/routing/route"
	"github.com/lightningnetwork/lnd/zpay32"
	"github.com/stretchr/testify/require"
	"google.golang.org/grpc/codes"
	"google.golang.org/grpc/status"
)

var (
	testLoopInRequest = LoopInRequest{
		Amount:         btcutil.Amount(50000),
		MaxSwapFee:     btcutil.Amount(1000),
		HtlcConfTarget: 2,
		Initiator:      "test",
	}
)

// probeInvoicesMock is a controllable InvoicesClient mock used by probe tests.
// It allows the test to block and inspect CancelInvoice context behavior.
type probeInvoicesMock struct {
	lndclient.InvoicesClient

	updateChan chan lndclient.InvoiceUpdate
	errChan    chan error

	cancelCalled chan struct{}
	cancelBlock  chan struct{}
	cancelCtxErr chan error
}

// probeInvoiceCancelMock allows tests to control individual cancellation RPCs.
type probeInvoiceCancelMock struct {
	cancelInvoice func(context.Context, lntypes.Hash) error
}

// CancelInvoice invokes the cancellation configured by the test.
func (p *probeInvoiceCancelMock) CancelInvoice(ctx context.Context,
	hash lntypes.Hash) error {

	return p.cancelInvoice(ctx, hash)
}

// cancelErrorInvoicesMock is an InvoicesClient that returns a configured
// cancellation error.
type cancelErrorInvoicesMock struct {
	lndclient.InvoicesClient

	err error
}

// CancelInvoice returns the cancellation error configured on the mock.
func (c *cancelErrorInvoicesMock) CancelInvoice(context.Context,
	lntypes.Hash) error {

	return c.err
}

// loopInQuoteServerMock is a swap server mock that quotes a configurable
// loop-in swap fee.
type loopInQuoteServerMock struct {
	*serverMock

	swapFee btcutil.Amount
}

// GetLoopInQuote returns a loop-in quote with the configured swap fee.
func (s *loopInQuoteServerMock) GetLoopInQuote(context.Context,
	btcutil.Amount, route.Vertex, *route.Vertex, [][]zpay32.HopHint, string,
	uint32, bool) (*LoopInQuote, error) {

	return &LoopInQuote{
		SwapFee:   s.swapFee,
		CltvDelta: testChargeOnChainCltvDelta,
	}, nil
}

// TestIsInvoiceAlreadySettledError verifies the local and gRPC error forms
// recognized by the already-settled classifier.
func TestIsInvoiceAlreadySettledError(t *testing.T) {
	t.Parallel()

	testCases := []struct {
		name     string
		err      error
		expected bool
	}{
		{
			name:     "sentinel",
			err:      invpkg.ErrInvoiceAlreadySettled,
			expected: true,
		},
		{
			name: "wrapped sentinel",
			err: fmt.Errorf(
				"cancel invoice: %w",
				invpkg.ErrInvoiceAlreadySettled,
			),
			expected: true,
		},
		{
			name: "grpc representation",
			err: status.Error(
				codes.Unknown,
				invpkg.ErrInvoiceAlreadySettled.Error(),
			),
			expected: true,
		},
		{
			name: "different grpc status",
			err: status.Error(
				codes.FailedPrecondition,
				invpkg.ErrInvoiceAlreadySettled.Error(),
			),
		},
		{
			name: "different error",
			err:  fmt.Errorf("cancel invoice failed"),
		},
		{
			name: "nil",
		},
	}

	for _, testCase := range testCases {
		t.Run(testCase.name, func(t *testing.T) {
			require.Equal(
				t, testCase.expected,
				isInvoiceAlreadySettledError(testCase.err),
			)
		})
	}
}

// TestProcessHtlcSpendIgnoresGRPCAlreadySettled verifies that the timeout path
// completes normally when invoice cancellation reports an already-settled
// invoice.
func TestProcessHtlcSpendIgnoresGRPCAlreadySettled(t *testing.T) {
	defer test.Guard(t)()

	// Initialize a loop-in so the test uses the same contract and HTLC
	// scripts as the production flow.
	testCtx := newLoopInTestContext(t)
	cfg := newSwapConfig(
		&testCtx.lnd.LndServices, testCtx.store, testCtx.server, nil,
		clock.NewTestClock(time.Unix(123, 0)),
	)

	initResult, err := newLoopInSwap(
		context.Background(), cfg, 600, &testLoopInRequest,
	)
	require.NoError(t, err)
	testCtx.store.AssertLoopInStored()

	// Return the gRPC status observed when lnd transports its
	// ErrInvoiceAlreadySettled sentinel across the RPC boundary.
	cfg.lnd.Invoices = &cancelErrorInvoicesMock{
		err: status.Error(
			codes.Unknown,
			invpkg.ErrInvoiceAlreadySettled.Error(),
		),
	}

	// Confirmation processing normally selects the HTLC version that was
	// found on chain. Select the initialized version explicitly because this
	// test calls processHtlcSpend directly.
	if initResult.swap.htlcP2TR != nil {
		initResult.swap.htlc = initResult.swap.htlcP2TR
	} else {
		initResult.swap.htlc = initResult.swap.htlcP2WSH
	}
	require.NotNil(t, initResult.swap.htlc)

	// Construct a timeout spend so processHtlcSpend takes the invoice
	// cancellation branch.
	timeoutWitness, err := initResult.swap.htlc.GenTimeoutWitness([]byte{1})
	require.NoError(t, err)

	timeoutTx := &wire.MsgTx{
		TxIn: []*wire.TxIn{
			{
				Witness: timeoutWitness,
			},
		},
	}

	// The already-settled status must be suppressed while the swap still
	// transitions to its terminal timeout state.
	err = initResult.swap.processHtlcSpend(
		context.Background(), &chainntnfs.SpendDetail{
			SpendingTx:        timeoutTx,
			SpenderInputIndex: 0,
		}, 100,
	)
	require.NoError(t, err)
	require.Equal(t, loopdb.StateFailTimeout, initResult.swap.state)
}

// TestLoopInCancelsProbeInvoiceOnInitiationFailure checks that a failed swap
// initiation cancels the probe invoice. The probe watcher stops with the
// initiation call, so nothing else would fail back a probe HTLC that the server
// routes afterwards. This covers a failed call, and a call that succeeds
// without the probe having reached the client, which fails the initiation
// with a probe error.
func TestLoopInCancelsProbeInvoiceOnInitiationFailure(t *testing.T) {
	testCases := []struct {
		name      string
		serverErr bool
		expectErr string
	}{
		{
			name:      "server error",
			serverErr: true,
			expectErr: "cannot initiate swap",
		},
		{
			name:      "missing probe",
			expectErr: "probe error",
		},
	}

	for _, testCase := range testCases {
		t.Run(testCase.name, func(t *testing.T) {
			defer test.Guard(t)()

			testCtx := newLoopInTestContext(t)
			if testCase.serverErr {
				testCtx.server.expectedSwapAmt =
					testLoopInRequest.Amount + 1
			} else {
				testCtx.server.skipProbe = true
			}
			cfg := newSwapConfig(
				&testCtx.lnd.LndServices, testCtx.store,
				testCtx.server, nil,
				clock.NewTestClock(time.Unix(123, 0)),
			)

			_, err := newLoopInSwap(
				context.Background(), cfg, 600,
				&testLoopInRequest,
			)
			require.ErrorContains(t, err, testCase.expectErr)

			probeSubscription :=
				<-testCtx.lnd.SingleInvoiceSubcribeChannel
			select {
			case canceled := <-testCtx.lnd.FailInvoiceChannel:
				require.Equal(
					t, probeSubscription.Hash, canceled,
				)

			case <-time.After(test.Timeout):
				t.Fatal("probe invoice was not canceled")
			}
		})
	}
}

// TestLoopInSkipsCanceledProbeOnInitiationFailure checks that a failure after
// the probe has arrived does not repeat the watcher's successful cancellation.
func TestLoopInSkipsCanceledProbeOnInitiationFailure(t *testing.T) {
	defer test.Guard(t)()

	testCtx := newLoopInTestContext(t)
	cfg := newSwapConfig(
		&testCtx.lnd.LndServices, testCtx.store, testCtx.server, nil,
		clock.NewTestClock(time.Unix(123, 0)),
	)

	// The server completes the probe, but returns an expiry too far in the
	// future for the client to accept the swap.
	testCtx.server.height = 600 + MaxLoopInAcceptDelta
	_, err := newLoopInSwap(
		context.Background(), cfg, 600, &testLoopInRequest,
	)
	require.ErrorIs(t, err, ErrExpiryTooFar)

	// The server mock consumed the watcher's cancellation. Deferred cleanup
	// must observe its success without sending another cancellation.
	select {
	case <-testCtx.lnd.FailInvoiceChannel:
		t.Fatal("probe invoice cancellation was repeated")
	default:
	}
}

// TestProbeInvoiceCancelerRemembersSuccess verifies that only a successful
// cancellation suppresses future RPCs. All failures, including invoice-not-found
// errors from lnd, must remain visible and allow another attempt.
func TestProbeInvoiceCancelerRemembersSuccess(t *testing.T) {
	t.Parallel()

	testCases := []struct {
		name      string
		firstErr  error
		wantCalls int
	}{
		{
			name:      "success",
			wantCalls: 1,
		},
		{
			name:      "RPC failure",
			firstErr:  fmt.Errorf("cancel failed"),
			wantCalls: 2,
		},
		{
			name:      "invoice not found",
			firstErr:  invpkg.ErrInvoiceNotFound,
			wantCalls: 2,
		},
		{
			name: "invoice not found over gRPC",
			firstErr: status.Error(
				codes.Unknown, invpkg.ErrInvoiceNotFound.Error(),
			),
			wantCalls: 2,
		},
	}

	for _, testCase := range testCases {
		t.Run(testCase.name, func(t *testing.T) {
			probeHash := lntypes.Hash{1}
			calls := 0
			invoices := &probeInvoiceCancelMock{
				cancelInvoice: func(_ context.Context,
					hash lntypes.Hash) error {

					require.Equal(t, probeHash, hash)
					calls++
					if calls == 1 {
						return testCase.firstErr
					}
					return nil
				},
			}
			cancelProbe := newProbeInvoiceCanceler(invoices, probeHash)
			ctx := context.Background()

			require.ErrorIs(t, cancelProbe(ctx), testCase.firstErr)
			require.NoError(t, cancelProbe(ctx))
			require.NoError(t, cancelProbe(ctx))
			require.Equal(t, testCase.wantCalls, calls)
		})
	}
}

// TestProbeInvoiceCancelerSerializesCalls verifies that concurrent callers
// share a successful cancellation and that a waiting caller's deadline does
// not depend on the in-flight RPC returning.
func TestProbeInvoiceCancelerSerializesCalls(t *testing.T) {
	t.Parallel()

	const waiters = 8
	ctx, cancel := context.WithTimeout(context.Background(), test.Timeout)
	defer cancel()

	var calls atomic.Int32
	started := make(chan struct{}, waiters+2)
	release := make(chan struct{})
	invoices := &probeInvoiceCancelMock{
		cancelInvoice: func(ctx context.Context, _ lntypes.Hash) error {
			calls.Add(1)
			started <- struct{}{}
			select {
			case <-release:
				return nil
			case <-ctx.Done():
				return ctx.Err()
			}
		},
	}
	cancelProbe := newProbeInvoiceCanceler(invoices, lntypes.Hash{1})
	results := make(chan error, waiters+1)
	go func() {
		results <- cancelProbe(ctx)
	}()

	select {
	case <-started:
	case <-ctx.Done():
		t.Fatal("first cancellation did not start")
	}

	// The first RPC stays blocked while the second caller exhausts its
	// budget. No second RPC should be started, nor should the first be
	// canceled by the waiting caller's timeout.
	waitCtx, waitCancel := context.WithTimeout(ctx, 50*time.Millisecond)
	defer waitCancel()
	require.ErrorIs(t, cancelProbe(waitCtx), context.DeadlineExceeded)
	require.EqualValues(t, 1, calls.Load())
	select {
	case err := <-results:
		t.Fatalf("in-flight cancellation stopped early: %v", err)
	default:
	}

	for range waiters {
		go func() {
			results <- cancelProbe(ctx)
		}()
	}
	close(release)

	for range waiters + 1 {
		select {
		case err := <-results:
			require.NoError(t, err)
		case <-ctx.Done():
			t.Fatal("cancellation callers did not finish")
		}
	}
	require.EqualValues(t, 1, calls.Load())
}

// SubscribeSingleInvoice returns the mock's preconfigured channels.
func (p *probeInvoicesMock) SubscribeSingleInvoice(_ context.Context,
	_ lntypes.Hash) (<-chan lndclient.InvoiceUpdate, <-chan error, error) {

	return p.updateChan, p.errChan, nil
}

// CancelInvoice signals that cancellation was requested, blocks until released
// by the test, then reports ctx.Err() so the test can assert context liveness.
func (p *probeInvoicesMock) CancelInvoice(ctx context.Context,
	_ lntypes.Hash) error {

	close(p.cancelCalled)
	<-p.cancelBlock
	p.cancelCtxErr <- ctx.Err()

	return nil
}

// TestAwaitProbeCancelInvoiceUsesLiveContext checks that probe-invoice cleanup
// runs with a live context. Specifically, after probe success we cancel the
// parent context before allowing CancelInvoice to proceed, and verify the
// CancelInvoice call still observes ctx.Err() == nil.
func TestAwaitProbeCancelInvoiceUsesLiveContext(t *testing.T) {
	t.Parallel()

	invoices := &probeInvoicesMock{
		updateChan:   make(chan lndclient.InvoiceUpdate, 1),
		errChan:      make(chan error, 1),
		cancelCalled: make(chan struct{}),
		cancelBlock:  make(chan struct{}),
		cancelCtxErr: make(chan error, 1),
	}
	lnd := lndclient.LndServices{
		Invoices: invoices,
	}

	ctx, cancel := context.WithCancel(context.Background())
	defer cancel()
	probeHash := lntypes.Hash{1}
	cancelProbe := newProbeInvoiceCanceler(invoices, probeHash)
	probeResult, err := awaitProbe(ctx, lnd, probeHash, cancelProbe)
	require.NoError(t, err)

	invoices.updateChan <- lndclient.InvoiceUpdate{
		Invoice: lndclient.Invoice{
			State: invpkg.ContractAccepted,
		},
	}

	require.NoError(t, <-probeResult)

	select {
	case <-invoices.cancelCalled:
	case <-time.After(time.Second):
		t.Fatal("timed out waiting for CancelInvoice call")
	}

	cancel()
	close(invoices.cancelBlock)

	select {
	case cancelCtxErr := <-invoices.cancelCtxErr:
		require.NoError(t, cancelCtxErr)

	case <-time.After(time.Second):
		t.Fatal("timed out waiting for CancelInvoice to return")
	}
}

// TestLoopInSuccess tests the success scenario where the swap completes the
// happy flow.
func TestLoopInSuccess(t *testing.T) {
	t.Run("stable protocol", func(t *testing.T) {
		testLoopInSuccess(t)
	})

	t.Run("experimental protocol", func(t *testing.T) {
		loopdb.EnableExperimentalProtocol()
		defer loopdb.ResetCurrentProtocolVersion()

		testLoopInSuccess(t)
	})
}

// TestLoopInSwapInvoiceRouteHintsMatchProbe asserts that explicit route hints
// are preserved on both loop-in invoices so the swap invoice matches the probe
// invoice.
func TestLoopInSwapInvoiceRouteHintsMatchProbe(t *testing.T) {
	t.Parallel()

	ctx := newLoopInTestContext(t)
	cfg := newSwapConfig(
		&ctx.lnd.LndServices, ctx.store, ctx.server, nil,
		clock.NewTestClock(time.Unix(123, 0)),
	)

	req := testLoopInRequest
	req.RouteHints = testLoopInRouteHints()

	_, err := newLoopInSwap(t.Context(), cfg, 600, &req)
	require.NoError(t, err)

	_, swapRouteHints, _, _, err := swap.DecodeInvoice(
		ctx.lnd.ChainParams, ctx.server.swapInvoice,
	)
	require.NoError(t, err)

	_, probeRouteHints, _, _, err := swap.DecodeInvoice(
		ctx.lnd.ChainParams, ctx.server.probeInvoice,
	)
	require.NoError(t, err)

	test.RequireRouteHintsEqual(t, req.RouteHints, probeRouteHints)
	test.RequireRouteHintsEqual(t, probeRouteHints, swapRouteHints)
}

// TestLoopInValidatesSwapFee verifies that invalid quotes cannot create
// invoices and that valid fees retain the exact invoice amount.
func TestLoopInValidatesSwapFee(t *testing.T) {
	t.Parallel()

	const amount = btcutil.Amount(50_000)
	tests := []struct {
		name        string
		fee         btcutil.Amount
		maxFee      btcutil.Amount
		expectedErr error
	}{
		{
			name:        "negative",
			fee:         -1,
			maxFee:      1_000,
			expectedErr: ErrInvalidSwapFee,
		},
		{
			name:        "minimum integer",
			fee:         math.MinInt64,
			maxFee:      1_000,
			expectedErr: ErrInvalidSwapFee,
		},
		{
			// The invoice amount in msat wraps to 384 msat.
			name:        "wrapped small invoice",
			fee:         amount - 18_446_744_073_709_552,
			maxFee:      1_000,
			expectedErr: ErrInvalidSwapFee,
		},
		{
			// The invoice amount in msat wraps to zero, which lnd
			// turns into an invoice that accepts any amount.
			name:        "wrapped zero value invoice",
			fee:         amount - (1 << 61),
			maxFee:      1_000,
			expectedErr: ErrInvalidSwapFee,
		},
		{
			name:        "equal to amount",
			fee:         amount,
			maxFee:      amount,
			expectedErr: ErrInvalidSwapFee,
		},
		{
			name:        "above amount",
			fee:         amount + 1,
			maxFee:      amount + 1,
			expectedErr: ErrInvalidSwapFee,
		},
		{
			name:        "maximum integer",
			fee:         math.MaxInt64,
			maxFee:      math.MaxInt64,
			expectedErr: ErrInvalidSwapFee,
		},
		{
			name:        "above maximum",
			fee:         1_001,
			maxFee:      1_000,
			expectedErr: ErrSwapFeeTooHigh,
		},
		{
			name:   "zero fee",
			fee:    0,
			maxFee: 1_000,
		},
		{
			name:   "positive fee",
			fee:    1_000,
			maxFee: 1_000,
		},
		{
			name:   "one sat remaining",
			fee:    amount - 1,
			maxFee: amount - 1,
		},
	}

	for _, tc := range tests {
		t.Run(tc.name, func(t *testing.T) {
			t.Parallel()

			testCtx := newLoopInTestContext(t)
			lnd := testCtx.lnd
			server := &loopInQuoteServerMock{
				serverMock: testCtx.server,
				swapFee:    tc.fee,
			}
			cfg := newSwapConfig(
				&lnd.LndServices, testCtx.store, server, nil,
				clock.NewTestClock(time.Unix(123, 0)),
			)

			req := testLoopInRequest
			req.Amount = amount
			req.MaxSwapFee = tc.maxFee

			_, err := newLoopInSwap(t.Context(), cfg, 600, &req)
			if tc.expectedErr != nil {
				require.ErrorIs(t, err, tc.expectedErr)

				// The quote is rejected before an invoice is
				// created or the swap is sent to the server.
				require.Empty(t, lnd.Invoices)
				require.Empty(
					t, lnd.SingleInvoiceSubcribeChannel,
				)
				require.Empty(t, server.swapInvoice)
				require.Empty(t, server.probeInvoice)

				return
			}
			require.NoError(t, err)

			// Both invoices carry the swap amount minus the fee.
			for _, invoice := range []string{
				server.swapInvoice, server.probeInvoice,
			} {
				_, _, _, invoiceAmt, err := swap.DecodeInvoice(
					lnd.ChainParams, invoice,
				)
				require.NoError(t, err)
				require.Equal(t, amount-tc.fee, invoiceAmt)
			}
		})
	}
}

func testLoopInSuccess(t *testing.T) {
	defer test.Guard(t)()

	ctx := newLoopInTestContext(t)

	height := int32(600)
	startTime := time.Unix(123, 0)

	cfg := newSwapConfig(
		&ctx.lnd.LndServices, ctx.store, ctx.server, nil,
		clock.NewTestClock(startTime),
	)

	expectedLastHop := &route.Vertex{0x02}

	req := &testLoopInRequest
	req.LastHop = expectedLastHop

	initResult, err := newLoopInSwap(
		context.Background(), cfg,
		height, req,
	)
	require.NoError(t, err)

	inSwap := initResult.swap
	require.Equal(t, startTime, inSwap.InitiationTime)

	ctx.store.AssertLoopInStored()

	errChan := make(chan error)
	go func() {
		err := inSwap.execute(context.Background(), ctx.cfg, height)
		if err != nil {
			log.Error(err)
		}
		errChan <- err
	}()

	swapInfo := <-ctx.statusChan
	require.Equal(t, loopdb.StateInitiated, swapInfo.State)

	// Check that the SwapInfo contains the provided last hop.
	require.Equal(t, expectedLastHop, swapInfo.LastHop)

	// Check that the SwapInfo does not contain an outgoing chan set.
	require.Nil(t, swapInfo.OutgoingChanSet)

	ctx.assertState(loopdb.StateHtlcPublished)
	ctx.store.AssertLoopInState(loopdb.StateHtlcPublished)

	// Expect htlc to be published.
	htlcTx := <-ctx.lnd.SendOutputsChannel

	// We expect our cost to use the mock fee rate we set for our conf
	// target.
	cost := loopdb.SwapCost{
		Onchain: getTxFee(&htlcTx, test.DefaultMockFee.FeePerKVByte()),
	}

	// Expect the same state to be written again with the htlc tx hash
	// and on chain fee.
	state := ctx.store.AssertLoopInState(loopdb.StateHtlcPublished)
	require.NotNil(t, state.HtlcTxHash)
	require.Equal(t, cost, state.Cost)

	// Expect register for htlc conf (only one, since the htlc is p2tr).
	<-ctx.lnd.RegisterConfChannel

	// Confirm htlc.
	ctx.lnd.ConfChannel <- &chainntnfs.TxConfirmation{
		Tx: &htlcTx,
	}

	// Client starts listening for spend of htlc.
	<-ctx.lnd.RegisterSpendChannel

	// Client starts listening for swap invoice updates.
	ctx.assertSubscribeInvoice(ctx.server.swapHash)

	// Server has already paid invoice before spending the htlc. Signal
	// settled.
	ctx.updateInvoiceState(49000, invpkg.ContractSettled)

	// Swap is expected to move to the state InvoiceSettled
	ctx.assertState(loopdb.StateInvoiceSettled)
	ctx.store.AssertLoopInState(loopdb.StateInvoiceSettled)

	// Server spends htlc.
	successTx := wire.MsgTx{}
	witness, err := inSwap.htlc.GenSuccessWitness(
		[]byte{}, inSwap.contract.Preimage,
	)
	require.NoError(t, err)

	successTx.AddTxIn(&wire.TxIn{
		Witness: witness,
	})

	ctx.lnd.SpendChannel <- &chainntnfs.SpendDetail{
		SpendingTx:        &successTx,
		SpenderInputIndex: 0,
	}

	ctx.assertState(loopdb.StateSuccess)
	ctx.store.AssertLoopInState(loopdb.StateSuccess)

	require.NoError(t, <-errChan)
}

// testLoopInRouteHints returns deterministic explicit route hints that can be
// encoded into loop-in invoices for regression tests.
func testLoopInRouteHints() [][]zpay32.HopHint {
	_, pubKey1 := test.CreateKey(11)
	_, pubKey2 := test.CreateKey(12)
	_, pubKey3 := test.CreateKey(13)

	return [][]zpay32.HopHint{
		{
			{
				NodeID:                    pubKey1,
				ChannelID:                 1,
				FeeBaseMSat:               10,
				FeeProportionalMillionths: 20,
				CLTVExpiryDelta:           30,
			},
			{
				NodeID:                    pubKey2,
				ChannelID:                 2,
				FeeBaseMSat:               11,
				FeeProportionalMillionths: 21,
				CLTVExpiryDelta:           31,
			},
		},
		{
			{
				NodeID:                    pubKey3,
				ChannelID:                 3,
				FeeBaseMSat:               12,
				FeeProportionalMillionths: 22,
				CLTVExpiryDelta:           32,
			},
		},
	}
}

// TestLoopInTimeout tests scenarios where the server doesn't sweep the htlc
// and the client is forced to reclaim the funds using the timeout tx.
func TestLoopInTimeout(t *testing.T) {
	testAmt := int64(testLoopInRequest.Amount)
	testCases := []struct {
		name          string
		externalValue int64
	}{
		{
			name:          "internal htlc",
			externalValue: 0,
		},
		{
			name:          "external htlc",
			externalValue: testAmt,
		},
		{
			name:          "external htlc amount too high",
			externalValue: testAmt + 1,
		},
		{
			name:          "external htlc amount too low",
			externalValue: testAmt - 1,
		},
	}

	for _, next := range []bool{false, true} {
		for _, testCase := range testCases {
			name := testCase.name
			if next {
				name += " experimental protocol"
			}

			t.Run(name, func(t *testing.T) {
				if next {
					loopdb.EnableExperimentalProtocol()
					defer loopdb.ResetCurrentProtocolVersion()
				}

				testLoopInTimeout(t, testCase.externalValue)
			})
		}
	}
}

func testLoopInTimeout(t *testing.T, externalValue int64) {
	defer test.Guard(t)()

	ctx := newLoopInTestContext(t)

	height := int32(600)

	cfg := newSwapConfig(
		&ctx.lnd.LndServices, ctx.store, ctx.server, nil,
		clock.NewTestClock(time.Unix(123, 0)),
	)

	req := testLoopInRequest
	if externalValue != 0 {
		req.ExternalHtlc = true
	}

	initResult, err := newLoopInSwap(
		context.Background(), cfg,
		height, &req,
	)
	require.NoError(t, err)
	inSwap := initResult.swap

	ctx.store.AssertLoopInStored()

	errChan := make(chan error)
	go func() {
		err := inSwap.execute(context.Background(), ctx.cfg, height)
		if err != nil {
			log.Error(err)
		}
		errChan <- err
	}()

	ctx.assertState(loopdb.StateInitiated)

	ctx.assertState(loopdb.StateHtlcPublished)
	ctx.store.AssertLoopInState(loopdb.StateHtlcPublished)

	var (
		htlcTx wire.MsgTx
		cost   loopdb.SwapCost
	)

	if externalValue == 0 {
		// Expect htlc to be published.
		htlcTx = <-ctx.lnd.SendOutputsChannel

		cost = loopdb.SwapCost{
			Onchain: getTxFee(
				&htlcTx, test.DefaultMockFee.FeePerKVByte(),
			),
		}

		// Expect the same state to be written again with the htlc tx
		// hash and cost.
		state := ctx.store.AssertLoopInState(loopdb.StateHtlcPublished)
		require.NotNil(t, state.HtlcTxHash)
		require.Equal(t, cost, state.Cost)
	} else {
		// Create an external htlc publish tx.
		var pkScript []byte
		if !IsTaprootSwap(&inSwap.SwapContract) {
			pkScript = inSwap.htlcP2WSH.PkScript
		} else {
			pkScript = inSwap.htlcP2TR.PkScript
		}

		htlcTx = wire.MsgTx{
			TxOut: []*wire.TxOut{
				{
					PkScript: pkScript,
					Value:    externalValue,
				},
			},
		}
	}

	// Expect register for htlc conf.
	<-ctx.lnd.RegisterConfChannel

	// Confirm htlc.
	ctx.lnd.ConfChannel <- &chainntnfs.TxConfirmation{
		Tx: &htlcTx,
	}

	isInvalidAmt := externalValue != 0 && externalValue != int64(req.Amount)
	handleHtlcExpiry(
		t, ctx, inSwap, htlcTx, cost, errChan, isInvalidAmt,
	)
}

func handleHtlcExpiry(t *testing.T, ctx *loopInTestContext, inSwap *loopInSwap,
	htlcTx wire.MsgTx, cost loopdb.SwapCost, errChan chan error,
	isInvalidAmount bool) {

	if isInvalidAmount {
		ctx.store.AssertLoopInState(loopdb.StateFailIncorrectHtlcAmt)
		ctx.assertState(loopdb.StateFailIncorrectHtlcAmt)
	}

	// Client starts listening for spend of htlc.
	<-ctx.lnd.RegisterSpendChannel

	// Client starts listening for swap invoice updates.
	ctx.assertSubscribeInvoice(ctx.server.swapHash)

	// Let htlc expire.
	ctx.blockEpochChan <- inSwap.LoopInContract.CltvExpiry

	// Before refunding, the client cancels the swap invoice so that the
	// server can no longer pay it.
	require.Equal(t, ctx.server.swapHash, <-ctx.lnd.FailInvoiceChannel)

	// Expect a signing request for the htlc tx output value.
	signReq := <-ctx.lnd.SignOutputRawChannel
	require.Equal(
		t, htlcTx.TxOut[0].Value,
		signReq.SignDescriptors[0].Output.Value,
		"invalid signing amount",
	)

	// Expect timeout tx to be published.
	timeoutTx := <-ctx.lnd.TxPublishChannel

	label := fmt.Sprintf("loopin-timeout-%x", inSwap.hash[:6])

	// We can just get our sweep fee as we would in the swap code because
	// our estimate is static.
	fee, err := inSwap.sweeper.GetSweepFee(
		context.Background(), inSwap.htlc.AddTimeoutToEstimator,
		inSwap.timeoutAddr, TimeoutTxConfTarget, label,
	)
	require.NoError(t, err)
	cost.Onchain += fee

	// Confirm timeout tx.
	ctx.lnd.SpendChannel <- &chainntnfs.SpendDetail{
		SpendingTx:        timeoutTx,
		SpenderInputIndex: 0,
	}

	// Now that timeout tx has confirmed, the client should be able to
	// safely cancel the swap invoice.
	<-ctx.lnd.FailInvoiceChannel

	// Signal that the invoice was canceled.
	ctx.updateInvoiceState(0, invpkg.ContractCanceled)

	var state loopdb.SwapStateData
	if isInvalidAmount {
		state = ctx.store.AssertLoopInState(
			loopdb.StateFailIncorrectHtlcAmtSwept,
		)
		ctx.assertState(loopdb.StateFailIncorrectHtlcAmtSwept)
	} else {
		ctx.assertState(loopdb.StateFailTimeout)
		state = ctx.store.AssertLoopInState(loopdb.StateFailTimeout)
	}
	require.Equal(t, cost, state.Cost)

	require.NoError(t, <-errChan)
}

// TestLoopInResume tests resuming swaps in various states.
func TestLoopInResume(t *testing.T) {
	storedVersion := []loopdb.ProtocolVersion{
		loopdb.ProtocolVersionUnrecorded,
		loopdb.ProtocolVersionHtlcV2,
		loopdb.ProtocolVersionHtlcV3,
		loopdb.ProtocolVersionMuSig2,
	}

	testCases := []struct {
		name    string
		state   loopdb.SwapState
		expired bool
	}{
		{
			name:    "initiated",
			state:   loopdb.StateInitiated,
			expired: false,
		},
		{
			name:    "initiated expired",
			state:   loopdb.StateInitiated,
			expired: true,
		},
		{
			name:    "htlc published",
			state:   loopdb.StateHtlcPublished,
			expired: false,
		},
	}

	for _, next := range []bool{false, true} {
		for _, version := range storedVersion {
			for _, testCase := range testCases {
				name := fmt.Sprintf(
					"%v %v", testCase, version.String(),
				)
				if next {
					name += " next protocol"
				}

				t.Run(name, func(t *testing.T) {
					testLoopInResume(
						t, testCase.state,
						testCase.expired,
						version,
					)
				})
			}
		}
	}
}

func testLoopInResume(t *testing.T, state loopdb.SwapState, expired bool,
	storedVersion loopdb.ProtocolVersion) {

	defer test.Guard(t)()
	ctxb := context.Background()

	ctx := newLoopInTestContext(t)
	cfg := newSwapConfig(
		&ctx.lnd.LndServices, ctx.store, ctx.server, nil,
		clock.NewTestClock(time.Unix(123, 0)),
	)

	// Create sender and receiver keys.
	_, senderPubKey := test.CreateKey(1)
	_, receiverPubKey := test.CreateKey(2)

	var senderKey, receiverKey [33]byte
	copy(receiverKey[:], receiverPubKey.SerializeCompressed())
	copy(senderKey[:], senderPubKey.SerializeCompressed())

	contract := &loopdb.LoopInContract{
		HtlcConfTarget: 2,
		SwapContract: loopdb.SwapContract{
			Preimage:        testPreimage,
			AmountRequested: 100000,
			CltvExpiry:      744,
			HtlcKeys: loopdb.HtlcKeys{
				SenderScriptKey:        senderKey,
				SenderInternalPubKey:   senderKey,
				ReceiverScriptKey:      receiverKey,
				ReceiverInternalPubKey: receiverKey,
			},
			MaxSwapFee:      60000,
			MaxMinerFee:     50000,
			ProtocolVersion: storedVersion,
		},
	}
	pendSwap := &loopdb.LoopIn{
		Contract: contract,
		Loop: loopdb.Loop{
			Events: []*loopdb.LoopEvent{
				{
					SwapStateData: loopdb.SwapStateData{
						State: state,
					},
				},
			},
			Hash: testPreimage.Hash(),
		},
	}

	// If we have already published the htlc, we expect our cost to already
	// be published.
	var cost loopdb.SwapCost
	if state == loopdb.StateHtlcPublished {
		cost = loopdb.SwapCost{
			Onchain: 999,
		}
		pendSwap.Loop.Events[0].Cost = cost
	}

	htlc, err := utils.GetHtlc(
		testPreimage.Hash(), &contract.SwapContract,
		cfg.lnd.ChainParams,
	)
	require.NoError(t, err)

	err = ctx.store.CreateLoopIn(ctxb, testPreimage.Hash(), contract)
	require.NoError(t, err)

	inSwap, err := resumeLoopInSwap(context.Background(), cfg, pendSwap)
	require.NoError(t, err)

	var height int32
	if expired {
		height = 740
	} else {
		height = 600
	}

	errChan := make(chan error)
	go func() {
		err := inSwap.execute(context.Background(), ctx.cfg, height)
		if err != nil {
			log.Error(err)
		}
		errChan <- err
	}()

	defer func() {
		require.NoError(t, <-errChan)

		select {
		case <-ctx.lnd.SendOutputsChannel:
			t.Fatal("unexpected tx published")
		default:
		}
	}()

	var htlcTx wire.MsgTx
	if state == loopdb.StateInitiated {
		ctx.assertState(loopdb.StateInitiated)

		if expired {
			ctx.assertState(loopdb.StateFailTimeout)
			return
		}

		ctx.assertState(loopdb.StateHtlcPublished)
		ctx.store.AssertLoopInState(loopdb.StateHtlcPublished)

		// Expect htlc to be published.
		htlcTx = <-ctx.lnd.SendOutputsChannel
		cost = loopdb.SwapCost{
			Onchain: getTxFee(
				&htlcTx, test.DefaultMockFee.FeePerKVByte(),
			),
		}

		// Expect the same state to be written again with the htlc tx
		// hash.
		state := ctx.store.AssertLoopInState(loopdb.StateHtlcPublished)
		require.NotNil(t, state.HtlcTxHash)
	} else {
		ctx.assertState(loopdb.StateHtlcPublished)

		htlcTx.AddTxOut(&wire.TxOut{
			PkScript: htlc.PkScript,
			Value:    int64(contract.AmountRequested),
		})
	}

	// Expect register for htlc conf.
	<-ctx.lnd.RegisterConfChannel

	// Confirm htlc.
	ctx.lnd.ConfChannel <- &chainntnfs.TxConfirmation{
		Tx: &htlcTx,
	}

	// Client starts listening for spend of htlc.
	<-ctx.lnd.RegisterSpendChannel

	// Client starts listening for swap invoice updates.
	ctx.assertSubscribeInvoice(testPreimage.Hash())

	// Server has already paid invoice before spending the htlc. Signal
	// settled.
	amtPaid := btcutil.Amount(49000)
	ctx.updateInvoiceState(amtPaid, invpkg.ContractSettled)

	// Swap is expected to move to the state InvoiceSettled
	ctx.assertState(loopdb.StateInvoiceSettled)
	ctx.store.AssertLoopInState(loopdb.StateInvoiceSettled)

	// Server spends htlc.
	successTx := wire.MsgTx{}
	witness, err := htlc.GenSuccessWitness([]byte{}, testPreimage)
	require.NoError(t, err)

	successTx.AddTxIn(&wire.TxIn{
		Witness: witness,
	})
	successTxHash := successTx.TxHash()

	ctx.lnd.SpendChannel <- &chainntnfs.SpendDetail{
		SpendingTx:        &successTx,
		SpenderTxHash:     &successTxHash,
		SpenderInputIndex: 0,
	}

	ctx.assertState(loopdb.StateSuccess)
	finalState := ctx.store.AssertLoopInState(loopdb.StateSuccess)

	// We expect our server fee to reflect as the difference between htlc
	// value and invoice amount paid. We use our original on-chain cost, set
	// earlier in the test, because we expect this value to be unchanged.
	cost.Server = btcutil.Amount(htlcTx.TxOut[0].Value) - amtPaid
	require.Equal(t, cost, finalState.Cost)
}

// TestAbandonPublishedHtlcState advances a loop-in swap to StateHtlcPublished,
// then abandons it and ensures that executing the same swap would not progress.
func TestAbandonPublishedHtlcState(t *testing.T) {
	defer test.Guard(t)()

	ctx := newLoopInTestContext(t)

	height := int32(600)

	cfg, inSwap, err := startNewLoopIn(t, ctx, height)
	require.NoError(t, err)

	advanceToPublishedHtlc(t, ctx)

	// The client requests to abandon the published htlc state.
	inSwap.abandonChan <- struct{}{}

	// Ensure that the swap is now in the StateFailAbandoned state.
	ctx.assertState(loopdb.StateFailAbandoned)

	// Ensure that the swap is also in the StateFailAbandoned state in the
	// database.
	ctx.store.AssertLoopInState(loopdb.StateFailAbandoned)

	// Ensure that the swap was abandoned and the execution stopped.
	err = <-ctx.errChan
	require.Error(t, err)
	require.Contains(t, err.Error(), "swap hash abandoned by client")

	// We re-instantiate the swap and ensure that it does not progress.
	pendSwap := &loopdb.LoopIn{
		Contract: &inSwap.LoopInContract,
		Loop: loopdb.Loop{
			Events: []*loopdb.LoopEvent{
				{
					SwapStateData: loopdb.SwapStateData{
						State: inSwap.state,
					},
				},
			},
			Hash: testPreimage.Hash(),
		},
	}
	resumedSwap, err := resumeLoopInSwap(
		context.Background(), cfg, pendSwap,
	)
	require.NoError(t, err)

	// Execute the abandoned swap.
	go func() {
		err := resumedSwap.execute(
			context.Background(), ctx.cfg, height,
		)
		if err != nil {
			log.Error(err)
		}
		ctx.errChan <- err
	}()

	// Ensure that the swap is still in the StateFailAbandoned state.
	swapInfo := <-ctx.statusChan
	require.Equal(t, loopdb.StateFailAbandoned, swapInfo.State)

	// Ensure that the execution flagged the abandoned swap as finalized.
	err = <-ctx.errChan
	require.Error(t, err)
	require.Equal(t, ErrSwapFinalized, err)
}

// TestAbandonSettledInvoiceState advances a loop-in swap to
// StateInvoiceSettled, then abandons it and ensures that executing the same
// swap would not progress.
func TestAbandonSettledInvoiceState(t *testing.T) {
	defer test.Guard(t)()

	ctx := newLoopInTestContext(t)

	height := int32(600)

	cfg, inSwap, err := startNewLoopIn(t, ctx, height)
	require.NoError(t, err)

	advanceToPublishedHtlc(t, ctx)

	// Client starts listening for swap invoice updates.
	ctx.assertSubscribeInvoice(ctx.server.swapHash)

	// Server has already paid invoice before spending the htlc. Signal
	// settled.
	ctx.updateInvoiceState(49000, invpkg.ContractSettled)

	// Swap is expected to move to the state InvoiceSettled
	ctx.assertState(loopdb.StateInvoiceSettled)
	ctx.store.AssertLoopInState(loopdb.StateInvoiceSettled)

	// The client requests to abandon the published htlc state.
	inSwap.abandonChan <- struct{}{}

	// Ensure that the swap is now in the StateFailAbandoned state.
	ctx.assertState(loopdb.StateFailAbandoned)

	// Ensure that the swap is also in the StateFailAbandoned state in the
	// database.
	ctx.store.AssertLoopInState(loopdb.StateFailAbandoned)

	// Ensure that the swap was abandoned and the execution stopped.
	err = <-ctx.errChan
	require.Error(t, err)
	require.Contains(t, err.Error(), "swap hash abandoned by client")

	// We re-instantiate the swap and ensure that it does not progress.
	pendSwap := &loopdb.LoopIn{
		Contract: &inSwap.LoopInContract,
		Loop: loopdb.Loop{
			Events: []*loopdb.LoopEvent{
				{
					SwapStateData: loopdb.SwapStateData{
						State: inSwap.state,
					},
				},
			},
			Hash: testPreimage.Hash(),
		},
	}
	resumedSwap, err := resumeLoopInSwap(context.Background(), cfg, pendSwap)
	require.NoError(t, err)

	// Execute the abandoned swap.
	go func() {
		err := resumedSwap.execute(
			context.Background(), ctx.cfg, height,
		)
		if err != nil {
			log.Error(err)
		}
		ctx.errChan <- err
	}()

	// Ensure that the swap is still in the StateFailAbandoned state.
	swapInfo := <-ctx.statusChan
	require.Equal(t, loopdb.StateFailAbandoned, swapInfo.State)

	// Ensure that the execution flagged the abandoned swap as finalized.
	err = <-ctx.errChan
	require.Error(t, err)
	require.Equal(t, ErrSwapFinalized, err)
}

func advanceToPublishedHtlc(t *testing.T, ctx *loopInTestContext) SwapInfo {
	swapInfo := <-ctx.statusChan
	require.Equal(t, loopdb.StateInitiated, swapInfo.State)

	ctx.assertState(loopdb.StateHtlcPublished)
	ctx.store.AssertLoopInState(loopdb.StateHtlcPublished)

	// Expect htlc to be published.
	htlcTx := <-ctx.lnd.SendOutputsChannel

	// Expect the same state to be written again with the htlc tx hash
	// and on chain fee.
	ctx.store.AssertLoopInState(loopdb.StateHtlcPublished)

	// Expect register for htlc conf (only one, since the htlc is p2tr).
	<-ctx.lnd.RegisterConfChannel

	// Confirm htlc.
	ctx.lnd.ConfChannel <- &chainntnfs.TxConfirmation{
		Tx: &htlcTx,
	}

	// Client starts listening for spend of htlc.
	<-ctx.lnd.RegisterSpendChannel
	return swapInfo
}

func startNewLoopIn(t *testing.T, ctx *loopInTestContext, height int32) (
	*swapConfig, *loopInSwap, error) {

	cfg := newSwapConfig(
		&ctx.lnd.LndServices, ctx.store, ctx.server, nil,
		clock.NewTestClock(time.Unix(123, 0)),
	)

	req := &testLoopInRequest

	initResult, err := newLoopInSwap(
		context.Background(), cfg,
		height, req,
	)
	require.NoError(t, err)

	inSwap := initResult.swap

	ctx.store.AssertLoopInStored()

	go func() {
		err := inSwap.execute(context.Background(), ctx.cfg, height)
		if err != nil {
			log.Error(err)
		}
		ctx.errChan <- err
	}()

	return cfg, inSwap, err
}

// refundGateInvoices returns scripted errors for invoice cancellations and
// forwards every other call to the mock invoices client.
type refundGateInvoices struct {
	lndclient.InvoicesClient

	cancelErrs chan error
}

// CancelInvoice returns the next scripted error, or forwards the call.
func (r *refundGateInvoices) CancelInvoice(ctx context.Context,
	hash lntypes.Hash) error {

	select {
	case err := <-r.cancelErrs:
		if err != nil {
			return err
		}

	default:
	}

	return r.InvoicesClient.CancelInvoice(ctx, hash)
}

// refundGateLightning returns scripted errors for invoice lookups and
// forwards every other call to the mock lightning client.
type refundGateLightning struct {
	lndclient.LightningClient

	lookupErrs chan error
}

// LookupInvoice returns the next scripted error, or forwards the call.
func (r *refundGateLightning) LookupInvoice(ctx context.Context,
	hash lntypes.Hash) (*lndclient.Invoice, error) {

	select {
	case err := <-r.lookupErrs:
		if err != nil {
			return nil, err
		}

	default:
	}

	return r.LightningClient.LookupInvoice(ctx, hash)
}

// expiringLoopIn is a loop in whose confirmed htlc is about to expire.
type expiringLoopIn struct {
	ctx       *loopInTestContext
	swap      *loopInSwap
	htlcTx    wire.MsgTx
	invoices  *refundGateInvoices
	lightning *refundGateLightning
	errChan   chan error
}

// startExpiringLoopIn runs a loop in until its htlc confirmed and the client
// watches the htlc and the swap invoice.
func startExpiringLoopIn(t *testing.T) *expiringLoopIn {
	t.Helper()

	ctx := newLoopInTestContext(t)
	cfg := newSwapConfig(
		&ctx.lnd.LndServices, ctx.store, ctx.server, nil,
		clock.NewTestClock(time.Unix(123, 0)),
	)
	req := testLoopInRequest
	initResult, err := newLoopInSwap(
		context.Background(), cfg, 600, &req,
	)
	require.NoError(t, err)
	ctx.store.AssertLoopInStored()

	invoices := &refundGateInvoices{
		InvoicesClient: ctx.lnd.LndServices.Invoices,
		cancelErrs:     make(chan error, 4),
	}
	ctx.lnd.LndServices.Invoices = invoices

	lightning := &refundGateLightning{
		LightningClient: ctx.lnd.LndServices.Client,
		lookupErrs:      make(chan error, 4),
	}
	ctx.lnd.LndServices.Client = lightning

	errChan := make(chan error, 1)
	go func() {
		errChan <- initResult.swap.execute(
			context.Background(), ctx.cfg, 600,
		)
	}()

	ctx.assertState(loopdb.StateInitiated)
	ctx.assertState(loopdb.StateHtlcPublished)
	ctx.store.AssertLoopInState(loopdb.StateHtlcPublished)
	htlcTx := <-ctx.lnd.SendOutputsChannel
	ctx.store.AssertLoopInState(loopdb.StateHtlcPublished)

	<-ctx.lnd.RegisterConfChannel
	ctx.lnd.ConfChannel <- &chainntnfs.TxConfirmation{Tx: &htlcTx}
	<-ctx.lnd.RegisterSpendChannel
	ctx.assertSubscribeInvoice(ctx.server.swapHash)

	return &expiringLoopIn{
		ctx:       ctx,
		swap:      initResult.swap,
		htlcTx:    htlcTx,
		invoices:  invoices,
		lightning: lightning,
		errChan:   errChan,
	}
}

// requireNoRefund asserts that no refund is signed.
func (e *expiringLoopIn) requireNoRefund(t *testing.T) {
	t.Helper()

	select {
	case <-e.ctx.lnd.SignOutputRawChannel:
		t.Fatal("htlc refund was signed")

	case <-time.After(100 * time.Millisecond):
	}
}

// TestLoopInRefundGateSettledInvoice asserts that a refund is never published
// when the swap invoice turns out to be settled at the htlc expiry, even if
// the client has not seen the settlement yet.
func TestLoopInRefundGateSettledInvoice(t *testing.T) {
	defer test.Guard(t)()

	e := startExpiringLoopIn(t)
	e.invoices.cancelErrs <- status.Error(
		codes.Unknown, invpkg.ErrInvoiceAlreadySettled.Error(),
	)

	// The server paid the invoice, but its update has not arrived.
	invoice, err := e.ctx.lnd.Client.LookupInvoice(
		context.Background(), e.swap.hash,
	)
	require.NoError(t, err)
	invoice.State = invpkg.ContractSettled
	invoice.AmountPaid = invoice.Amount
	e.ctx.lnd.SetInvoice(invoice)

	e.ctx.blockEpochChan <- e.swap.LoopInContract.CltvExpiry
	e.ctx.store.AssertLoopInState(loopdb.StateInvoiceSettled)
	e.ctx.assertState(loopdb.StateInvoiceSettled)
	e.requireNoRefund(t)

	// The server cost is recorded without the invoice update.
	state := e.ctx.store.AssertLoopInState(loopdb.StateSuccess)
	e.ctx.assertState(loopdb.StateSuccess)
	require.Equal(t,
		e.swap.AmountRequested-invoice.Amount.ToSatoshis(),
		state.Cost.Server)
	require.Positive(t, state.Cost.Server)
	require.NoError(t, <-e.errChan)
	require.Positive(t, e.ctx.server.pushKeyCalls.Load())
}

// TestLoopInRefundGateSettledInvoiceLookupFailure asserts that a settled swap
// invoice whose paid amount can't be looked up blocks the refund without
// completing the swap, and that the next block looks up the amount again, so
// that the server cost is recorded.
func TestLoopInRefundGateSettledInvoiceLookupFailure(t *testing.T) {
	defer test.Guard(t)()

	e := startExpiringLoopIn(t)

	// The server paid the invoice, but its update has not arrived.
	invoice, err := e.ctx.lnd.Client.LookupInvoice(
		context.Background(), e.swap.hash,
	)
	require.NoError(t, err)
	invoice.State = invpkg.ContractSettled
	invoice.AmountPaid = invoice.Amount
	e.ctx.lnd.SetInvoice(invoice)

	// Both blocks find the invoice settled, but the first lookup of the
	// paid amount fails.
	settled := status.Error(
		codes.Unknown, invpkg.ErrInvoiceAlreadySettled.Error(),
	)
	e.invoices.cancelErrs <- settled
	e.invoices.cancelErrs <- settled
	e.lightning.lookupErrs <- status.Error(
		codes.Unavailable, "connection lost",
	)

	// Without the amount, the swap neither refunds nor completes.
	expiry := e.swap.LoopInContract.CltvExpiry
	e.ctx.blockEpochChan <- expiry
	e.requireNoRefund(t)
	select {
	case info := <-e.ctx.statusChan:
		t.Fatalf("swap moved to %v without the paid amount", info.State)

	default:
	}

	// The next block looks up the amount and completes the swap.
	e.ctx.blockEpochChan <- expiry + 1
	e.ctx.store.AssertLoopInState(loopdb.StateInvoiceSettled)
	e.ctx.assertState(loopdb.StateInvoiceSettled)
	state := e.ctx.store.AssertLoopInState(loopdb.StateSuccess)
	e.ctx.assertState(loopdb.StateSuccess)
	require.Equal(t,
		e.swap.AmountRequested-invoice.Amount.ToSatoshis(),
		state.Cost.Server)
	require.Positive(t, state.Cost.Server)
	require.NoError(t, <-e.errChan)
}

// TestLoopInRefundGateUnresolvedCancellation asserts that an invoice
// cancellation with an uncertain outcome defers the refund to a later block.
func TestLoopInRefundGateUnresolvedCancellation(t *testing.T) {
	defer test.Guard(t)()

	e := startExpiringLoopIn(t)
	e.invoices.cancelErrs <- status.Error(
		codes.Unavailable, "connection lost",
	)

	expiry := e.swap.LoopInContract.CltvExpiry
	e.ctx.blockEpochChan <- expiry
	e.requireNoRefund(t)

	// The next block cancels the invoice and refunds the htlc.
	e.ctx.blockEpochChan <- expiry + 1
	require.Equal(t, e.ctx.server.swapHash, <-e.ctx.lnd.FailInvoiceChannel)

	signReq := <-e.ctx.lnd.SignOutputRawChannel
	require.Equal(t, e.htlcTx.TxOut[0].Value,
		signReq.SignDescriptors[0].Output.Value)
	timeoutTx := <-e.ctx.lnd.TxPublishChannel

	e.ctx.lnd.SpendChannel <- &chainntnfs.SpendDetail{
		SpendingTx:        timeoutTx,
		SpenderInputIndex: 0,
	}
	<-e.ctx.lnd.FailInvoiceChannel
	e.ctx.updateInvoiceState(0, invpkg.ContractCanceled)
	e.ctx.assertState(loopdb.StateFailTimeout)
	e.ctx.store.AssertLoopInState(loopdb.StateFailTimeout)
	require.NoError(t, <-e.errChan)

	// A canceled invoice never reveals the htlc key.
	require.Zero(t, e.ctx.server.pushKeyCalls.Load())
}

// TestLoopInCanceledInvoiceKeepsHtlcKey asserts that the htlc key is not
// revealed after the swap invoice was canceled, not even on later blocks.
func TestLoopInCanceledInvoiceKeepsHtlcKey(t *testing.T) {
	defer test.Guard(t)()

	e := startExpiringLoopIn(t)
	e.ctx.updateInvoiceState(0, invpkg.ContractCanceled)

	expiry := e.swap.LoopInContract.CltvExpiry
	e.ctx.blockEpochChan <- expiry - 2
	e.ctx.blockEpochChan <- expiry - 1
	time.Sleep(100 * time.Millisecond)
	require.Zero(t, e.ctx.server.pushKeyCalls.Load())

	// The update already reported the cancellation, so the refund doesn't
	// cancel the invoice again.
	e.ctx.blockEpochChan <- expiry
	<-e.ctx.lnd.SignOutputRawChannel
	timeoutTx := <-e.ctx.lnd.TxPublishChannel
	require.Empty(t, e.ctx.lnd.FailInvoiceChannel)
	e.ctx.lnd.SpendChannel <- &chainntnfs.SpendDetail{
		SpendingTx:        timeoutTx,
		SpenderInputIndex: 0,
	}
	<-e.ctx.lnd.FailInvoiceChannel
	e.ctx.assertState(loopdb.StateFailTimeout)
	e.ctx.store.AssertLoopInState(loopdb.StateFailTimeout)
	require.NoError(t, <-e.errChan)
	require.Zero(t, e.ctx.server.pushKeyCalls.Load())
}

// TestLoopInRefundGateDeletedInvoice asserts that a swap invoice that lnd no
// longer knows, for example one that its garbage collection deleted after an
// earlier cancellation, counts as canceled: the expired htlc is refunded, and
// the swap completes without an update of the deleted invoice.
func TestLoopInRefundGateDeletedInvoice(t *testing.T) {
	defer test.Guard(t)()

	e := startExpiringLoopIn(t)
	notFound := status.Error(
		codes.Unknown, invpkg.ErrInvoiceNotFound.Error(),
	)

	// Both the cancellation before the refund and the one after it find
	// no invoice.
	e.invoices.cancelErrs <- notFound
	e.invoices.cancelErrs <- notFound

	e.ctx.blockEpochChan <- e.swap.LoopInContract.CltvExpiry
	select {
	case signReq := <-e.ctx.lnd.SignOutputRawChannel:
		require.Equal(t, e.htlcTx.TxOut[0].Value,
			signReq.SignDescriptors[0].Output.Value)

	case <-time.After(test.Timeout):
		t.Fatal("htlc refund was not signed")
	}
	timeoutTx := <-e.ctx.lnd.TxPublishChannel

	e.ctx.lnd.SpendChannel <- &chainntnfs.SpendDetail{
		SpendingTx:        timeoutTx,
		SpenderInputIndex: 0,
	}
	e.ctx.assertState(loopdb.StateFailTimeout)
	e.ctx.store.AssertLoopInState(loopdb.StateFailTimeout)
	require.NoError(t, <-e.errChan)
	require.Zero(t, e.ctx.server.pushKeyCalls.Load())
}