package careers

import (
	"strings"
	"testing"
)

// The public token is the URL key for an unauthenticated surface, so what counts as one is worth pinning.
func TestValidToken(t *testing.T) {
	good, err := NewPostingToken()
	if err != nil {
		t.Fatalf("mint: %v", err)
	}
	if !validToken(good) {
		t.Errorf("a minted token %q was rejected by its own validator", good)
	}
	if len(good) != 32 {
		t.Errorf("a minted token is %d characters, expected 32 for 16 random bytes", len(good))
	}
	// Two mints must differ, or the token is not random and every posting shares a URL.
	other, _ := NewPostingToken()
	if other == good {
		t.Error("two minted tokens are identical, the token is not random")
	}
	for _, bad := range []string{
		"", "short", strings.Repeat("a", 65), "UPPERCASE1234567890abcd",
		"has-a-dash-1234567890ab", "has_underscore1234567890", "has space 1234567890abcd",
		"../../etc/passwd12345678", "'; DROP TABLE job_postings--",
	} {
		if validToken(bad) {
			t.Errorf("%q must not be a valid public token", bad)
		}
	}
}

// The public apply path is the one endpoint anybody can post to, so its address check is the first line.
func TestPlausibleEmail(t *testing.T) {
	for _, good := range []string{"a@b.co", "first.last+tag@sub.example.com"} {
		if !plausibleEmail(good) {
			t.Errorf("%q is a usable address and was rejected", good)
		}
	}
	for _, bad := range []string{
		"", "nobody", "no at sign.com", "a@b", "a b@c.com", "x@y.com, z@y.com", "<a@b.co>",
		"a@b.co\r\nBcc: evil@x.test",
	} {
		if plausibleEmail(bad) {
			t.Errorf("%q is not a usable address and was accepted", bad)
		}
	}
}

func TestClipBounds(t *testing.T) {
	if got := clip(strings.Repeat("x", 9000), 5000); len(got) != 5000 {
		t.Errorf("clip did not bound: %d", len(got))
	}
	if got := clip("short", 5000); got != "short" {
		t.Errorf("clip altered a short value: %q", got)
	}
}

// THE STRUCTURAL GUARANTEE for the public surface. The Posting type is what a stranger sees, so it must not
// carry a single field that comes from the requisition: not a rate, not a margin, not a client name. This
// asserts the shape rather than trusting a code review, because the leak would be silent.
func TestPublicPostingCarriesNoInternalFields(t *testing.T) {
	src := readSource(t, "careers.go")
	i := strings.Index(src, "type Posting struct {")
	if i < 0 {
		t.Fatal("Posting type not found")
	}
	body := src[i:]
	body = body[:strings.Index(body, "\n}")]
	for _, forbidden := range []string{
		"BillRate", "bill_rate", "PayRate", "pay_rate", "Margin", "margin",
		"ClientID", "client_id", "ClientName", "client_name", "RequisitionID", "requisition_id",
		"OwnerUserID", "owner_user_id", "Openings", "Priority",
	} {
		if strings.Contains(body, forbidden) {
			t.Errorf("the PUBLIC Posting type carries %q, which belongs to the requisition and must never be published", forbidden)
		}
	}
	// And the public read must not select from requisitions at all.
	for _, fn := range []string{"func (s *Service) ListPublicPostings(", "func (s *Service) GetPublicPosting("} {
		j := strings.Index(src, fn)
		if j < 0 {
			t.Fatalf("%s not found", fn)
		}
		b := src[j:]
		if k := strings.Index(b, "\nfunc "); k > 0 {
			b = b[:k]
		}
		if strings.Contains(b, "requisitions") {
			t.Errorf("%s reads the requisitions table; the public copy must be its own text", fn)
		}
	}
}

// Consent is not optional and not assumed, because a record whose legal basis is blank cannot be defended.
func TestConsentIsRequired(t *testing.T) {
	src := readSource(t, "careers.go")
	i := strings.Index(src, "func (s *Service) Apply(")
	if i < 0 {
		t.Fatal("Apply not found")
	}
	body := src[i:]
	if j := strings.Index(body, "\nfunc "); j > 0 {
		body = body[:j]
	}
	if !strings.Contains(body, "if !in.Consented {") {
		t.Error("Apply no longer refuses a submission without consent")
	}
	if !strings.Contains(body, "consented_at") {
		t.Error("Apply no longer records when consent was given")
	}
}