// Command aioe-run executes one deterministic pass of the Adaptive Intelligence Optimization
// Engine batch updater: it consumes the trailing outcome_events window per tenant, computes the
// bounded exponential moving average weight updates, and persists a new versioned weight profile
// plus the append only adjustment audit rows for every tenant whose evidence moved a weight. It is
// the scheduled nightly job behind the host timer (the same pattern as alert-sweep and mm-opp-sync),
// safe to rerun (a rerun inside the same UTC day consumes the identical window), and it NEVER runs
// on a request path.
//
// It connects ONLY as the dedicated missionmatch_aioe role, whose grants reach outcome_events,
// aioe_weight_profiles, aioe_weight_adjustments, and aioe_runs, and nothing else. That connection
// level restriction, proven denied on eeo by the integration suite, is why this binary is
// physically unable to read a candidate row or a protected attribute.
//
// Env (server side only): MM_AIOE_DATABASE_URL (the missionmatch_aioe DSN, required).
//
// Build and run FIPS validated: CGO_ENABLED=0 GOFIPS140=v1.0.0 go build, run with GODEBUG=fips140=on.
package main

import (
	"context"
	"crypto/fips140"
	"crypto/pbkdf2"
	"crypto/sha256"
	"log"
	"time"

	"github.com/missionworkforce/missionmatch/internal/aioe"
	"github.com/missionworkforce/missionmatch/internal/platform/config"
	"github.com/missionworkforce/missionmatch/internal/platform/database"
)

func main() {
	if err := fipsSelfTest(); err != nil {
		log.Fatalf("aioe-run: FIPS self test (PBKDF2 HMAC SHA 256) failed: %v", err)
	}
	log.Printf("aioe-run: fips_enabled=%v module=%s", fips140.Enabled(), fips140.Version())

	cfg, err := config.Load()
	if err != nil {
		log.Fatalf("aioe-run: config: %v", err)
	}
	if cfg.AioeDatabaseURL == "" {
		log.Fatal("aioe-run: MM_AIOE_DATABASE_URL (the missionmatch_aioe DSN) is required")
	}

	ctx, cancel := context.WithTimeout(context.Background(), 30*time.Minute)
	defer cancel()

	pool, err := database.NewPool(ctx, cfg.AioeDatabaseURL)
	if err != nil {
		log.Fatalf("aioe-run: pool: %v", err)
	}
	defer pool.Close()
	// Fail closed unless this is the dedicated aioe role: the role's narrow grants ARE the isolation
	// guarantee, so running the updater as any other role is refused outright.
	if err := database.AssertRole(ctx, pool, database.AIOERoleName()); err != nil {
		log.Fatalf("aioe-run: pool role check: %v", err)
	}

	updater := aioe.NewUpdater(pool, aioe.DefaultParams(), nil).WithShadow(cfg.AioeShadowMode)
	if cfg.AioeShadowMode {
		log.Printf("aioe-run: SHADOW mode, proposing candidate profiles for human promotion")
	}
	report, err := updater.RunAll(ctx, time.Now(), "schedule")
	if err != nil {
		log.Fatalf("aioe-run: %v", err)
	}
	// Counts only, never tenant content: the same output discipline as alert-sweep.
	log.Printf("aioe-run: done asOf=%s orgs=%d outcomes=%d profilesUpdated=%d",
		report.AsOf.Format(time.RFC3339), report.OrgsScanned, report.OutcomesSeen, report.ProfilesUpdated)
}

func fipsSelfTest() error {
	_, err := pbkdf2.Key(sha256.New, "aioe-run-self-test", []byte("aioe-run-salt"), 600000, 32)
	return err
}