Query piped nodes when counting with -R/-F (#22)

With piped input, `-C` skipped the query and counted the piped lines' second column, so `... | node-lookup -R -C` reported the upstream fact instead of each node's role.

- query each piped node for `-R`/`-F` with `-C` and count the results
- count piped lines directly only for bare `-C` with piped input; `-C` with `-j`/`-1`/`-2` still requires `-R`/`-F`
- validate flags before reading stdin so invalid combos never block on an open pipe
- add tests for piped count paths, rejected combos and validation ordering

Reviewed-on: #22
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

main_test.go

@@ -8,7 +8,9 @@ import (
 	"os"
 	"path/filepath"
 	"strings"
+	"sync/atomic"
 	"testing"
+	"time"
 
 	"gopkg.in/yaml.v3"
 )
@@ -872,3 +874,151 @@ func TestRun_AllFacts_PrintsSortedByName(t *testing.T) {
 		t.Fatalf("facts not sorted by name: %v", lines)
 	}
 }
+
+// ---- run: count with piped stdin --------------------------------------------
+
+func withStdin(t *testing.T, content string) {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "stdin")
+	if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	f, err := os.Open(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	old := os.Stdin
+	os.Stdin = f
+	t.Cleanup(func() { os.Stdin = old; _ = f.Close() })
+}
+
+const pipedLookup = "hosta.main.unkin.net puppetdbapi.service.consul\nhostb.main.unkin.net puppetdbapi.service.consul\n"
+
+func TestRun_CountPipedWithRoleQueriesEachNode(t *testing.T) {
+	withStdin(t, pipedLookup)
+	var queried atomic.Int32
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		queried.Add(1)
+		_ = json.NewEncoder(w).Encode([]fact{{Certname: "h", Name: "enc_role", Value: rawJSON("roles::vault")}})
+	}))
+	t.Cleanup(srv.Close)
+	cfg := config{PuppetDBURL: srv.URL, RoleFact: "enc_role"}
+
+	out := strings.TrimSpace(captureStdout(t, func() {
+		if err := run(cfg, "", "", "", true, false, false, false, false, true, false, false, false); err != nil {
+			t.Fatalf("run returned error: %v", err)
+		}
+	}))
+	if out != "2: roles::vault" {
+		t.Fatalf("expected role counts of piped nodes, got: %q", out)
+	}
+	if n := queried.Load(); n != 2 {
+		t.Fatalf("expected one query per piped node, got %d", n)
+	}
+}
+
+func TestRun_CountPipedWithoutQueryCountsInput(t *testing.T) {
+	withStdin(t, pipedLookup+"hostc.main.unkin.net other\n")
+	cfg := config{PuppetDBURL: "http://unused", RoleFact: "enc_role"}
+
+	out := strings.TrimSpace(captureStdout(t, func() {
+		if err := run(cfg, "", "", "", false, false, false, false, false, true, false, false, false); err != nil {
+			t.Fatalf("run returned error: %v", err)
+		}
+	}))
+	if out != "1: other\n2: puppetdbapi.service.consul" {
+		t.Fatalf("expected counts of piped values, got: %q", out)
+	}
+}
+
+func TestRun_CountWithoutStdinRequiresRoleOrFact(t *testing.T) {
+	devnull, err := os.Open(os.DevNull)
+	if err != nil {
+		t.Fatal(err)
+	}
+	old := os.Stdin
+	os.Stdin = devnull
+	t.Cleanup(func() { os.Stdin = old; _ = devnull.Close() })
+
+	err = run(config{PuppetDBURL: "http://unused"}, "", "", "", false, false, false, false, false, true, false, false, false)
+	if err == nil || !strings.Contains(err.Error(), "-R or -F") {
+		t.Fatalf("expected -R/-F requirement error, got: %v", err)
+	}
+}
+
+func TestRun_CountPipedWithFactQueriesEachNode(t *testing.T) {
+	withStdin(t, pipedLookup)
+	var queried atomic.Int32
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if !strings.Contains(r.URL.Query().Get("query"), "osfamily") {
+			t.Errorf("expected osfamily query, got %q", r.URL.Query().Get("query"))
+		}
+		queried.Add(1)
+		_ = json.NewEncoder(w).Encode([]fact{{Certname: "h", Name: "osfamily", Value: rawJSON("RedHat")}})
+	}))
+	t.Cleanup(srv.Close)
+	cfg := config{PuppetDBURL: srv.URL, RoleFact: "enc_role"}
+
+	out := strings.TrimSpace(captureStdout(t, func() {
+		if err := run(cfg, "", "osfamily", "", false, false, false, false, false, true, false, false, false); err != nil {
+			t.Fatalf("run returned error: %v", err)
+		}
+	}))
+	if out != "2: RedHat" {
+		t.Fatalf("expected fact counts of piped nodes, got: %q", out)
+	}
+	if n := queried.Load(); n != 2 {
+		t.Fatalf("expected one query per piped node, got %d", n)
+	}
+}
+
+func TestRun_CountPipedWithOtherOutputFlagsRequiresRoleOrFact(t *testing.T) {
+	for name, mutate := range map[string]func(*runArgs){
+		"json":      func(a *runArgs) { a.jsonMode = true },
+		"nodeOnly":  func(a *runArgs) { a.nodeOnly = true },
+		"valueOnly": func(a *runArgs) { a.valueOnly = true },
+	} {
+		t.Run(name, func(t *testing.T) {
+			withStdin(t, pipedLookup)
+			a := runArgs{cfg: config{PuppetDBURL: "http://unused"}, count: true}
+			mutate(&a)
+			var err error
+			out := captureStdout(t, func() {
+				err = run(a.cfg, "", "", "", false, false, false, a.nodeOnly, a.valueOnly, true, false, a.jsonMode, false)
+			})
+			if err == nil || !strings.Contains(err.Error(), "-R or -F") {
+				t.Fatalf("expected -R/-F requirement error, got: %v (output %q)", err, out)
+			}
+		})
+	}
+}
+
+func TestRun_InvalidFlagsErrorWithoutReadingOpenPipe(t *testing.T) {
+	for name, a := range map[string]runArgs{
+		"match":     {match: "foo"},
+		"countJSON": {count: true, jsonMode: true},
+	} {
+		t.Run(name, func(t *testing.T) {
+			r, w, err := os.Pipe()
+			if err != nil {
+				t.Fatal(err)
+			}
+			old := os.Stdin
+			os.Stdin = r
+			t.Cleanup(func() { os.Stdin = old; _ = w.Close(); _ = r.Close() })
+
+			done := make(chan error, 1)
+			go func() {
+				done <- run(config{PuppetDBURL: "http://unused"}, "", "", a.match, false, false, false, false, false, a.count, false, a.jsonMode, false)
+			}()
+			select {
+			case err := <-done:
+				if err == nil || !strings.Contains(err.Error(), "-R or -F") {
+					t.Fatalf("expected -R/-F requirement error, got: %v", err)
+				}
+			case <-time.After(2 * time.Second):
+				t.Fatal("run blocked on an open, empty stdin pipe before validating flags")
+			}
+		})
+	}
+}