package scrub

import (
	"strings"
	"testing"
)

// TestValidAbstractSignalPasses proves a contents free craft signal is accepted.
func TestValidAbstractSignalPasses(t *testing.T) {
	RegisterModelVersion("v1.0.0")
	b, err := Marshal(TeachingSignal{
		Pattern: "adjacent_skill_substitution_outcome", Band: BandMedium, Outcome: OutcomeApproved,
		Observations: 40, Successes: 31, ModelVersion: "v1.0.0",
	})
	if err != nil {
		t.Fatalf("a valid abstract signal must pass the boundary: %v", err)
	}
	if err := Validate(b); err != nil {
		t.Fatalf("Validate rejected its own Marshal output: %v", err)
	}
}

// TestClientFactsAreRefused is the core safety test: every shape of a client fact must be refused at the
// boundary. If any of these passes, a tenant's contents could reach the shared inference plane.
func TestClientFactsAreRefused(t *testing.T) {
	leaks := map[string]string{
		"uuid org":                            `{"pattern":"adjacent_skill_substitution_outcome","band":"medium","outcome":"approved","observations":1,"successes":1,"model_version":"11111111-1111-1111-1111-111111111111"}`,
		"uuid anywhere":                       `{"pattern":"adjacent_skill_substitution_outcome","band":"high","outcome":"approved","observations":1,"successes":1,"model_version":"v1.0.0 / a1b2c3d4-e5f6-7890-abcd-ef1234567890"}`,
		"email":                               `{"pattern":"adjacent_skill_substitution_outcome","band":"high","outcome":"approved","observations":1,"successes":1,"model_version":"jane.doe@agency.gov"}`,
		"free text smuggled in pattern":       `{"pattern":"candidate Jane Doe TS SCI resume text leaked here as a label","band":"high","outcome":"approved","observations":1,"successes":1,"model_version":"v1.0.0"}`,
		"unknown extra field (smuggled fact)": `{"pattern":"adjacent_skill_substitution_outcome","band":"high","outcome":"approved","observations":1,"successes":1,"model_version":"v1.0.0","candidate_id":"abc"}`,
		"impossible counts":                   `{"pattern":"adjacent_skill_substitution_outcome","band":"high","outcome":"approved","observations":1,"successes":9,"model_version":"v1.0.0"}`,
		"band out of vocabulary":              `{"pattern":"adjacent_skill_substitution_outcome","band":"0.873211","outcome":"approved","observations":1,"successes":1,"model_version":"v1.0.0"}`,
		"outcome out of vocabulary":           `{"pattern":"adjacent_skill_substitution_outcome","band":"high","outcome":"hired Jane at Org X","observations":1,"successes":1,"model_version":"v1.0.0"}`,
	}
	for name, raw := range leaks {
		if err := Validate([]byte(raw)); err == nil {
			t.Errorf("BOUNDARY BREACH: %q passed Validate but carries a client fact or escapes the vocabulary", name)
		}
	}
}

// TestMarshalRefusesToEmitALeak proves the convenience path cannot bypass the boundary: a model version
// that is actually a UUID (a client org id) is refused at Marshal, not just at Validate.
func TestMarshalRefusesToEmitALeak(t *testing.T) {
	if _, err := Marshal(TeachingSignal{
		Pattern: "clearance_gap_override_outcome", Band: BandLow, Outcome: OutcomeRejected,
		Observations: 2, Successes: 0, ModelVersion: "11111111-1111-1111-1111-111111111111",
	}); err == nil {
		t.Fatal("Marshal emitted a payload whose model_version is a UUID (a client fact)")
	}
}

// TestEmptyModelVersionIsRefused proves a craft signal that does not name its scoring contract is
// refused: model_version is required, a signal must always tie to the engine version that produced it.
func TestEmptyModelVersionIsRefused(t *testing.T) {
	raw := `{"pattern":"adjacent_skill_substitution_outcome","band":"high","outcome":"approved","observations":1,"successes":1,"model_version":""}`
	if err := Validate([]byte(raw)); err == nil {
		t.Fatal("a signal with an empty model_version passed the boundary, the scoring contract is unnamed")
	}
}

// TestUnregisteredModelVersionIsRefused proves a non empty but unregistered model_version is refused the
// same way an unknown Pattern is: it signals the scoring contract drifted out from under the signal.
func TestUnregisteredModelVersionIsRefused(t *testing.T) {
	raw := `{"pattern":"adjacent_skill_substitution_outcome","band":"high","outcome":"approved","observations":1,"successes":1,"model_version":"v9.9.9"}`
	if err := Validate([]byte(raw)); err == nil {
		t.Fatal("a signal with an unregistered model_version passed the boundary, a drifted version must be refused")
	}
}

// TestRegisteredModelVersionPasses proves the allow list seam works: once a caller registers a version,
// a signal on that version crosses the boundary. The producer calls RegisterModelVersion(engine.ModelVersion).
func TestRegisteredModelVersionPasses(t *testing.T) {
	RegisterModelVersion("v1.4.0")
	b, err := Marshal(TeachingSignal{
		Pattern: "reranker_label_agreement", Band: BandHigh, Outcome: OutcomeApproved,
		Observations: 12, Successes: 11, ModelVersion: "v1.4.0",
	})
	if err != nil {
		t.Fatalf("a signal on a registered model_version must pass the boundary: %v", err)
	}
	if err := Validate(b); err != nil {
		t.Fatalf("Validate rejected a registered model_version: %v", err)
	}
}

// TestNoFreeTextChannel proves the signal has no string field that can hold arbitrary contents: an
// overlong value in any string field is refused.
func TestNoFreeTextChannel(t *testing.T) {
	long := strings.Repeat("x", maxFieldLen+1)
	if _, err := Marshal(TeachingSignal{
		Pattern: "adjacent_skill_substitution_outcome", Band: BandHigh, Outcome: OutcomeApproved,
		Observations: 1, Successes: 1, ModelVersion: long,
	}); err == nil {
		t.Fatal("an overlong string field passed the boundary, the channel is not contents free")
	}
}