// Command fairness-snapshot appends the continuous adverse impact four fifths time series. For each
// organization (or a single passed org), it computes the current adverse impact report and APPENDS one
// eeo.fairness_snapshots row per demographic group bucket, stamping the AEDT model version in force.
// Run on a schedule (a cron, the same way mm-opp-sync runs), it builds the time series that proves on
// every release the platform is not drifting into disparate impact. It is append only and safe to rerun.
//
// Isolation: this job runs as the COMPLIANCE role, the ONLY role granted the eeo schema. The application
// role and the AI path get nothing. When no -org is passed, the orgs to snapshot are enumerated from the
// distinct organization_id values in audit_logs, which is outside RLS and granted to the compliance role,
// so the job needs no cross org read of the tenant data. Each snapshot then runs inside a tenant
// transaction, so RLS scopes the report join and the snapshot insert to that one org.
//
// Output is GROUP LEVEL AGGREGATE only: orgs snapshotted, group rows written, and any below threshold
// count. No individual PII is read, computed, or printed.
//
// Env (server side only): MM_COMPLIANCE_DATABASE_URL (the compliance DSN, NOBYPASSRLS, required).
// Flags: -org (optional, a single organization uuid; default is every org with AEDT activity).
//
// Build and run FIPS validated: CGO_ENABLED=0 GOFIPS140=v1.0.0 go build, run with GODEBUG=fips140=on.
package main

import (
	"context"
	"crypto/fips140"
	"crypto/pbkdf2"
	"crypto/sha256"
	"errors"
	"flag"
	"log"
	"os"
	"strings"
	"time"

	"github.com/google/uuid"
	"github.com/jackc/pgx/v5/pgxpool"

	"github.com/missionworkforce/missionmatch/internal/modules/eeo"
	"github.com/missionworkforce/missionmatch/internal/platform/database"
	"github.com/missionworkforce/missionmatch/internal/platform/tenant"
)

func main() {
	orgFlag := flag.String("org", "", "snapshot a single organization uuid (default: every org with AEDT activity)")
	flag.Parse()

	// FIPS self test: derive one PBKDF2 key under the active crypto module and fail closed if it errors,
	// so a build that dropped the validated module is caught at boot, the same in build FIPS gate the api
	// and import-bench binaries use.
	if err := fipsSelfTest(); err != nil {
		log.Fatalf("fairness-snapshot: FIPS self test (PBKDF2 HMAC SHA 256) failed: %v", err)
	}
	log.Printf("fairness-snapshot: fips_enabled=%v module=%s", fips140.Enabled(), fips140.Version())

	dsn := strings.TrimSpace(os.Getenv("MM_COMPLIANCE_DATABASE_URL"))
	if dsn == "" {
		log.Fatal("fairness-snapshot: set MM_COMPLIANCE_DATABASE_URL (the compliance role DSN, the only path to the eeo schema)")
	}

	ctx, cancel := context.WithTimeout(context.Background(), 10*time.Minute)
	defer cancel()

	pool, err := database.NewPool(ctx, dsn)
	if err != nil {
		log.Fatalf("fairness-snapshot: connect: %v", err)
	}
	defer pool.Close()

	// Fail closed unless this is the NOBYPASSRLS compliance role. A BYPASSRLS DSN here would let the
	// report join and the snapshot insert escape RLS and mix demographics across orgs.
	if err := database.AssertRole(ctx, pool, database.ComplianceRoleName()); err != nil {
		log.Fatalf("fairness-snapshot: compliance pool role check: %v", err)
	}

	svc := eeo.NewService(tenant.New(pool))

	orgs, err := resolveOrgs(ctx, pool, *orgFlag)
	if err != nil {
		log.Fatalf("fairness-snapshot: resolve orgs: %v", err)
	}
	// THE ASSERTION THAT CLOSES THE LIE, finding D1b. Producing zero organizations while organizations
	// demonstrably exist is a LOUD FAILURE, never a quiet exit 0. The old behaviour printed "no
	// organizations to snapshot" and exited successfully every night for the life of the deployment, so
	// systemd recorded success, nothing alerted, and the AEDT compliance artifact was simply never
	// produced. An empty result is only acceptable when the platform genuinely holds no organizations.
	if len(orgs) == 0 {
		var exists bool
		// The existence check must be INDEPENDENT of the enumeration. Asking the same function twice, which
		// the first version of this fix did, produces an assertion that can never fire.
		if e := pool.QueryRow(ctx, `SELECT eeo_any_organization_exists()`).Scan(&exists); e != nil {
			log.Fatalf("fairness-snapshot: resolved zero organizations AND could not confirm whether any "+
				"exist: %v. Refusing to report success on an unknown state.", e)
		}
		if exists {
			log.Fatal("fairness-snapshot: resolved ZERO organizations while the directory says organizations " +
				"exist. This is the D1b failure mode and it must never exit 0: the adverse impact snapshot " +
				"is a compliance artifact, and silently producing nothing is worse than crashing.")
		}
		log.Print("fairness-snapshot: no organizations exist to snapshot, which is a real empty state")
		return
	}

	now := time.Now().UTC()
	var snapshotted, totalGroups, totalBelow int
	for _, org := range orgs {
		sum, serr := svc.SnapshotAdverseImpact(tenant.WithOrg(ctx, org.String()), now)
		if serr != nil {
			// One org failing must not abort the schedule for the rest. Log the org id (not PII) and move on.
			log.Printf("fairness-snapshot: org %s snapshot failed: %v", org, serr)
			continue
		}
		snapshotted++
		totalGroups += sum.GroupsWritten
		totalBelow += sum.BelowThreshold
		log.Printf("fairness-snapshot: org %s snapshotted %d groups, %d below threshold, model %s",
			org, sum.GroupsWritten, sum.BelowThreshold, sum.ModelVersion)
	}
	log.Printf("fairness-snapshot: done, %d orgs snapshotted, %d group rows written, %d below the 0.80 threshold",
		snapshotted, totalGroups, totalBelow)
}

// resolveOrgs returns the orgs to snapshot. A passed -org is used verbatim (after validation). Otherwise
// the orgs are the distinct non null organization_id values in audit_logs, which is OUTSIDE RLS and
// granted to the compliance role, so the job enumerates the orgs with AEDT activity without a cross org
// read of any tenant scoped table.
func resolveOrgs(ctx context.Context, pool *pgxpool.Pool, orgFlag string) ([]uuid.UUID, error) {
	if s := strings.TrimSpace(orgFlag); s != "" {
		id, err := uuid.Parse(s)
		if err != nil {
			return nil, errors.New("fairness-snapshot: -org is not a valid uuid: " + s)
		}
		return []uuid.UUID{id}, nil
	}
	// ENUMERATED THROUGH THE DIRECTORY, via a narrow SECURITY DEFINER function that returns organization
	// ids and nothing else. Reading audit_logs here was the D1b defect: this job holds the NOBYPASSRLS
	// compliance role by design, and asking a role that can see nothing without an org context to discover
	// which contexts exist can only ever return nothing.
	rows, err := pool.Query(ctx, `SELECT organization_id FROM eeo_snapshot_organizations()`)
	if err != nil {
		return nil, err
	}
	defer rows.Close()
	var out []uuid.UUID
	for rows.Next() {
		var id uuid.UUID
		if e := rows.Scan(&id); e != nil {
			return nil, e
		}
		out = append(out, id)
	}
	return out, rows.Err()
}

// fipsSelfTest derives one PBKDF2 HMAC SHA 256 key at a representative cost under the active crypto
// module. It fails closed if the module is absent or errors, so a non FIPS build is caught at boot.
func fipsSelfTest() error {
	_, err := pbkdf2.Key(sha256.New, "fairness-snapshot-self-test", []byte("fairness-snapshot-salt"), 600000, 32)
	return err
}