package intelligence

import (
	"testing"
	"time"

	"github.com/missionworkforce/missionmatch/internal/modules/matching/engine"
)

func TestClearanceProvenance(t *testing.T) {
	asOf := time.Date(2026, 6, 25, 0, 0, 0, 0, time.UTC)

	// Default (empty) provenance reads as self reported and NEVER verified.
	ci := Clearance(ClearanceFacts{Level: engine.ClearanceSecret, Status: engine.StatusActive}, asOf)
	if ci.Provenance != "self_reported" || ci.Verified {
		t.Fatalf("default must be self_reported and not verified, got %+v", ci)
	}
	if ci.ProvenanceLabel != "Self reported, not verified" {
		t.Errorf("default label: got %q", ci.ProvenanceLabel)
	}

	// A sponsor FSO verification reads as verified, with the date surfaced.
	vd := time.Date(2026, 1, 15, 0, 0, 0, 0, time.UTC)
	ci = Clearance(ClearanceFacts{Level: engine.ClearanceTSSCI, Status: engine.StatusActive, Provenance: "sponsor_verified", VerifiedAt: &vd}, asOf)
	if !ci.Verified || ci.ProvenanceLabel != "Sponsor FSO verified" {
		t.Fatalf("sponsor verified: got %+v", ci)
	}
	if ci.VerifiedAt == nil || *ci.VerifiedAt != "2026-01-15" {
		t.Errorf("verified_at: got %v", ci.VerifiedAt)
	}

	// A document on file is provenance, but NOT an authoritative FSO verification.
	ci = Clearance(ClearanceFacts{Level: engine.ClearanceSecret, Status: engine.StatusActive, Provenance: "document"}, asOf)
	if ci.Verified {
		t.Error("a document on file must not read as verified")
	}
	if ci.Provenance != "document" {
		t.Errorf("provenance: got %q want document", ci.Provenance)
	}
}