package opportunities

import (
	"strings"
	"testing"
)

// THE INTAKE REFUSALS, tested where they are decided rather than through HTTP, because a validation rule
// that only exists in a handler is one route away from being bypassed.
//
// Every case here is one Joseph named: malformed, oversized, and locked files must be survived GRACEFULLY.
// Graceful means a named refusal a human can act on, never a panic and never a silent acceptance that
// becomes a corrupt row for the extraction pipeline to trip over later.

func TestMediaTypeAllowlistIsClosed(t *testing.T) {
	refused := []struct{ declared, name string }{
		{"application/x-msdownload", "payload.exe"},
		{"image/png", "screenshot.png"},
		{"application/octet-stream", "mystery.bin"},
		{"", "no-extension"},
	}
	for _, c := range refused {
		mt := normalizeMediaType(c.declared, c.name)
		if _, ok := allowedMediaTypes[mt]; ok {
			t.Fatalf("media type %q from (%q, %q) was ALLOWED and should not be", mt, c.declared, c.name)
		}
	}

	// POSITIVE CONTROL. If the allowlist refused everything these assertions would pass while the feature
	// was entirely broken, which is the failure mode this build keeps finding.
	allowed := []struct{ declared, name string }{
		{"application/pdf", "solicitation.pdf"},
		{"", "statement_of_work.pdf"},                   // recovered from the extension alone
		{"application/octet-stream", "attachment.docx"}, // browsers really do send this for a docx
		{"text/plain; charset=utf-8", "notes.txt"},      // parameters stripped
		{"APPLICATION/PDF", "SHOUTING.PDF"},             // case folded
	}
	for _, c := range allowed {
		mt := normalizeMediaType(c.declared, c.name)
		if _, ok := allowedMediaTypes[mt]; !ok {
			t.Fatalf("media type %q from (%q, %q) was REFUSED and should be allowed", mt, c.declared, c.name)
		}
	}
}

// WHAT GETS STORED IS ALWAYS A CLEAN TYPE FROM THE ALLOWLIST, never the caller's string. This is the
// assertion that makes the case above safe: a mangled declared type may be RECOVERED from the extension,
// and the recovered value is a literal key of the allowlist, so no control character, parameter, or
// attacker chosen text reaches the media_type column.
func TestStoredMediaTypeIsAlwaysAllowlistLiteral(t *testing.T) {
	for _, c := range []struct{ declared, name string }{
		{"text/plain\x00", "null-byte.txt"},
		{"text/plain; charset=\"><script>", "notes.txt"},
		{"application/pdf\r\nX-Injected: 1", "solicitation.pdf"},
		{"APPLICATION/PDF", "x.pdf"},
	} {
		mt := normalizeMediaType(c.declared, c.name)
		canonical, ok := allowedMediaTypes[mt]
		if !ok {
			continue // refused outright, also acceptable
		}
		if strings.ContainsAny(mt, "\x00\r\n;<>\" ") {
			t.Fatalf("stored media type %q from (%q, %q) carries characters that should never reach the column, "+
				"canonical extension %q", mt, c.declared, c.name, canonical)
		}
	}
}

// The document type vocabulary is closed for the same reason the egress class registry is: a permissive
// default is indistinguishable from having no rule at all.
func TestDocumentTypeVocabularyIsClosed(t *testing.T) {
	for _, bad := range []string{"invoice", "PWS", "sow ", "../../etc/passwd", "'; DROP TABLE"} {
		if validDocumentTypes[bad] {
			t.Fatalf("document_type %q was accepted into a closed vocabulary", bad)
		}
	}
	for _, good := range []string{"pws", "amendment", "solicitation", "attachment", "other"} {
		if !validDocumentTypes[good] {
			t.Fatalf("document_type %q should be valid and is not", good)
		}
	}
}

// THE SIZE CAP IS A CONSTANT, not configuration, and this test exists to make a future change to that a
// deliberate act rather than a quiet one.
func TestSizeCapIsWhatWeThinkItIs(t *testing.T) {
	const want = 64 << 20
	if MaxDocumentBytes != want {
		t.Fatalf("MaxDocumentBytes is %d, expected %d. If this change is intended, change the number here "+
			"too and say why in the commit, because the cap is a promise about memory use under load.",
			MaxDocumentBytes, want)
	}
}

// A DOCUMENT NAME IS NOT A PATH. Joseph's packages arrive as folders, and a file named with traversal
// segments must not be able to steer where anything is written.
func TestFileNamesCannotTraverse(t *testing.T) {
	for _, name := range []string{
		"../../../etc/passwd",
		"..\\..\\windows\\system32\\config",
		"/absolute/path/pws.pdf",
		"subdir/nested/pws.pdf",
	} {
		mt := normalizeMediaType("application/pdf", name)
		if _, ok := allowedMediaTypes[mt]; !ok {
			continue // refused earlier, which is also fine
		}
		// The service stores filepath.Base(name); assert the property that matters, that no separator
		// survives into what gets recorded.
		base := baseName(name)
		if strings.ContainsAny(base, `/\`) {
			t.Fatalf("file name %q reduced to %q, which still carries a path separator", name, base)
		}
	}
}

// baseName mirrors what Upload records, kept here so the test asserts the behaviour rather than the
// implementation detail of which standard library call produces it.
func baseName(p string) string {
	if i := strings.LastIndexAny(p, `/\`); i >= 0 {
		return p[i+1:]
	}
	return p
}