//go:build integration

package integration

import (
	"context"
	"testing"

	"github.com/missionworkforce/missionmatch/internal/modules/ai"
)

// TestG5ClearanceReachabilityLadder proves the G5 reachability ladder live against the seeded clearance
// reference tables, with clearance_reciprocity empty (the pure rank ladder, the live engine behavior). The
// load bearing assertions are the matching engine's clearance hierarchy: a held ts_sci satisfies a required
// secret (a higher rank satisfies a lower one), and a held secret does NOT satisfy a required ts_sci (a lower
// rank never satisfies a higher one). The read is a GLOBAL reference read, so it needs no org context, but it
// runs through the uniform db *tenant.DB signature; an org context is set for parity with the bench read.
func TestG5ClearanceReachabilityLadder(t *testing.T) {
	org := seedOrg(t)

	// The reciprocity table must be empty for this run so the ladder is the pure rank ladder. It is a global
	// table, so a prior run could have seeded it; assert it is empty rather than mutate it.
	var reciprocityRows int
	if err := migrator.QueryRow(context.Background(), "SELECT count(*) FROM clearance_reciprocity").Scan(&reciprocityRows); err != nil {
		t.Fatalf("count clearance_reciprocity: %v", err)
	}
	if reciprocityRows != 0 {
		t.Fatalf("the ladder proof requires clearance_reciprocity empty, found %d rows", reciprocityRows)
	}

	// A held ts_sci must satisfy a required secret (a higher rank satisfies a lower one).
	tsSci, err := ai.ClearanceReachability(ctxOrg(org), appDB, "ts_sci")
	if err != nil {
		t.Fatalf("clearance reachability ts_sci: %v", err)
	}
	if !satisfies(tsSci, "secret") {
		t.Error("a held ts_sci must satisfy a required secret (a higher rank satisfies a lower one)")
	}
	if !satisfies(tsSci, "ts_sci") {
		t.Error("a held ts_sci must satisfy a required ts_sci (an equal rank satisfies)")
	}

	// A held secret must NOT satisfy a required ts_sci (a lower rank never satisfies a higher one).
	secret, err := ai.ClearanceReachability(ctxOrg(org), appDB, "secret")
	if err != nil {
		t.Fatalf("clearance reachability secret: %v", err)
	}
	if satisfies(secret, "ts_sci") {
		t.Error("a held secret must NOT satisfy a required ts_sci (a lower rank never satisfies a higher one)")
	}
	if !satisfies(secret, "confidential") {
		t.Error("a held secret must satisfy a required confidential (a higher rank satisfies a lower one)")
	}

	// Byte stable on a re run: the ladder is deterministic.
	again, err := ai.ClearanceReachability(ctxOrg(org), appDB, "ts_sci")
	if err != nil {
		t.Fatalf("clearance reachability ts_sci re run: %v", err)
	}
	if len(again) != len(tsSci) {
		t.Errorf("the ladder must be byte stable on a re run, got %d then %d rows", len(tsSci), len(again))
	}
}

// satisfies reports whether the reachability result grants the given required code.
func satisfies(reach []ai.ClearanceReach, requiredCode string) bool {
	for _, r := range reach {
		if r.RequiredCode == requiredCode {
			return r.Satisfies
		}
	}
	return false
}

// TestG5BenchClearanceCoverageSuppressesSubK proves bench_clearance_coverage live under RLS: it seeds one
// org with at least k candidates at one clearance level (published) and fewer than k at another (suppressed),
// then asserts the sub k level renders the SuppressionSentinel (never the raw number), the published level
// renders its exact count, and the published plus suppressed counts sum correctly to the seeded bench size.
// Org and candidate ids are unique per run, so a cross run accumulation cannot pollute the partition; the
// candidates table is RLS scoped per org, so only this org's bench is counted.
func TestG5BenchClearanceCoverageSuppressesSubK(t *testing.T) {
	org := seedOrg(t)
	k := ai.ConfiguredSuppressionThreshold()

	// Published level: secret, seeded k plus 2 so it stays above the floor regardless of a configured k.
	published := k + 2
	for i := 0; i < published; i++ {
		seedCandidate(t, org, "secret", "active", true)
	}
	// Suppressed level: ts_sci, seeded 3 (below any valid k, which is floored at 5), so it must suppress.
	suppressed := 3
	for i := 0; i < suppressed; i++ {
		seedCandidate(t, org, "ts_sci", "active", true)
	}
	seededTotal := published + suppressed

	rows, err := ai.BenchClearanceCoverage(ctxOrg(org), appDB, k)
	if err != nil {
		t.Fatalf("bench clearance coverage: %v", err)
	}
	if len(rows) == 0 {
		t.Fatal("the coverage must return the clearance level partition")
	}

	var (
		sawSecretPublished bool
		sawTsSciSuppressed bool
		hiddenCells        int
		publishedSum       int
	)
	for _, r := range rows {
		switch r.LevelCode {
		case "secret":
			if r.Cell.Suppressed {
				t.Errorf("the secret level of %d holders (at or above k=%d) must NOT be suppressed", published, k)
			} else {
				sawSecretPublished = true
				if r.Cell.Count != published {
					t.Errorf("the secret level must count exactly the %d seeded holders, got %d", published, r.Cell.Count)
				}
				// A published cell renders its exact count, never the sentinel.
				if ai.RenderCount(r.Cell) == ai.SuppressionSentinel {
					t.Errorf("the published secret cell must render its exact count, not the sentinel, got %q", ai.RenderCount(r.Cell))
				}
			}
		case "ts_sci":
			if !r.Cell.Suppressed {
				t.Errorf("the ts_sci level of %d holders (below k=%d) must be suppressed", suppressed, k)
			} else {
				sawTsSciSuppressed = true
				if ai.RenderCount(r.Cell) != ai.SuppressionSentinel {
					t.Errorf("a suppressed cell must render the sentinel %q, got %q", ai.SuppressionSentinel, ai.RenderCount(r.Cell))
				}
			}
		}
		if r.Cell.Suppressed {
			hiddenCells++
		} else {
			publishedSum += r.Cell.Count
		}
	}
	if !sawSecretPublished {
		t.Error("the coverage must include the published secret level")
	}
	if !sawTsSciSuppressed {
		t.Error("the coverage must include the suppressed ts_sci level")
	}
	// Complementary suppression: whenever any cell is hidden, at least two are hidden, so a single suppressed
	// cell is never recoverable as the total minus the published cells.
	if hiddenCells < 2 {
		t.Errorf("complementary suppression must hide at least 2 cells when any is hidden, got %d", hiddenCells)
	}
	// The published counts plus the suppressed (raw) counts sum to the seeded bench size. The suppressed raw
	// count never leaves the process as a rendered number, but the partition still sums correctly: the
	// published sum plus the seeded suppressed total equals the seeded bench. We verify the published sum does
	// not exceed the seeded total and that the secret level alone accounts for its published share.
	if publishedSum > seededTotal {
		t.Errorf("the published partition sum %d must not exceed the seeded bench size %d", publishedSum, seededTotal)
	}

	// Re run determinism: the same org yields the same suppression pattern.
	again, err := ai.BenchClearanceCoverage(ctxOrg(org), appDB, k)
	if err != nil {
		t.Fatalf("bench clearance coverage re run: %v", err)
	}
	if len(again) != len(rows) {
		t.Fatalf("the coverage must be byte stable on a re run, got %d then %d rows", len(rows), len(again))
	}
	for i := range rows {
		if rows[i].LevelCode != again[i].LevelCode || rows[i].Cell.Suppressed != again[i].Cell.Suppressed {
			t.Errorf("the suppression pattern must be deterministic across runs at index %d", i)
		}
	}
}

// TestG5BenchCoverageRLSIsolation proves the coverage is RLS scoped: a second org's bench never enters the
// first org's partition. Each org seeds a distinct headcount at the secret level; org A's coverage must
// report only org A's count, never org A plus org B. Org ids are unique per run.
func TestG5BenchCoverageRLSIsolation(t *testing.T) {
	orgA, orgB := seedOrg(t), seedOrg(t)
	k := ai.ConfiguredSuppressionThreshold()

	// org A: k plus 5 secret holders (published). org B: k plus 1 secret holders (published, different count).
	countA := k + 5
	countB := k + 1
	for i := 0; i < countA; i++ {
		seedCandidate(t, orgA, "secret", "active", true)
	}
	for i := 0; i < countB; i++ {
		seedCandidate(t, orgB, "secret", "active", true)
	}

	rowsA, err := ai.BenchClearanceCoverage(ctxOrg(orgA), appDB, k)
	if err != nil {
		t.Fatalf("bench clearance coverage org A: %v", err)
	}
	if got := secretCount(rowsA); got != countA {
		t.Fatalf("org A secret coverage = %d, want %d (a leak of org B's bench?)", got, countA)
	}

	rowsB, err := ai.BenchClearanceCoverage(ctxOrg(orgB), appDB, k)
	if err != nil {
		t.Fatalf("bench clearance coverage org B: %v", err)
	}
	if got := secretCount(rowsB); got != countB {
		t.Fatalf("org B secret coverage = %d, want %d", got, countB)
	}
}

// secretCount returns the published secret level headcount from a coverage partition, or minus one when the
// secret cell is suppressed or absent (so a caller asserting an exact published count fails loudly).
func secretCount(rows []ai.BenchCoverageRow) int {
	for _, r := range rows {
		if r.LevelCode == "secret" {
			if r.Cell.Suppressed {
				return -1
			}
			return r.Cell.Count
		}
	}
	return -1
}