package main

import "testing"

// EXPORT CONTROL POLICY, with its own positive control.
//
// A refusal that has never been seen to fire is indistinguishable from one that is silently broken, and
// this build has been burned by that eight separate times. So the flagged fixtures below are SYNTHETIC and
// deliberate: they assert that the refusal happens, that it happens for the right reason, and, just as
// importantly, that a genuinely public attachment is still permitted, because a policy that refuses
// everything would produce identical evidence to one that works.

func TestExportControlledAttachmentIsRefused(t *testing.T) {
	cases := []struct {
		name string
		r    resource
		want string
	}{
		{
			name: "export controlled flag set",
			r:    resource{ID: "r1", Name: "itar_annex.pdf", Type: "file", ExportControlled: "1", AccessLevel: "public", FileExists: "1", DeletedFlag: "0"},
			want: skipExportControlled,
		},
		{
			name: "export controlled with an unexpected value still refused, fail closed",
			r:    resource{ID: "r2", Name: "annex.pdf", Type: "file", ExportControlled: "maybe", AccessLevel: "public", FileExists: "1"},
			want: skipExportControlled,
		},
		{
			name: "restricted access level",
			r:    resource{ID: "r3", Name: "cui.pdf", Type: "file", ExportControlled: "0", AccessLevel: "restricted", FileExists: "1"},
			want: skipNotPublic,
		},
		{
			name: "access status not public",
			r:    resource{ID: "r4", Name: "controlled.pdf", Type: "file", ExportControlled: "0", AccessStatus: "controlled", FileExists: "1"},
			want: skipNotPublic,
		},
		{
			name: "explicit access required",
			r:    resource{ID: "r5", Name: "gated.pdf", Type: "file", ExportControlled: "0", ExplicitAccess: "1", FileExists: "1"},
			want: skipNotPublic,
		},
		{
			name: "deleted",
			r:    resource{ID: "r6", Name: "gone.pdf", Type: "file", DeletedFlag: "1", FileExists: "1"},
			want: skipUnavailable,
		},
		{
			name: "a link is not a file",
			r:    resource{ID: "r7", Type: "link"},
			want: skipNotAFile,
		},
	}
	for _, c := range cases {
		t.Run(c.name, func(t *testing.T) {
			ok, reason := c.r.mayPull()
			if ok {
				t.Fatalf("%s was PERMITTED and must be refused. This is the assertion that keeps an export "+
					"controlled document out of a tenant corpus.", c.name)
			}
			if reason != c.want {
				t.Fatalf("%s refused for reason %q, want %q. The reason is not cosmetic: it decides whether "+
					"the refusal is counted as restricted in ingest_manifest.", c.name, reason, c.want)
			}
		})
	}
}

// THE POSITIVE CONTROL. Without it, a mayPull that returned false unconditionally would pass every
// assertion above while breaking the entire attachment pipeline.
func TestGenuinelyPublicAttachmentIsStillPermitted(t *testing.T) {
	r := resource{
		ID: "ok1", Name: "Solicitation - FA441725Q0323.pdf", Type: "file",
		MimeType: ".pdf", Size: 2300030,
		AccessLevel: "public", AccessStatus: "public",
		ExportControlled: "0", ExplicitAccess: "0", FileExists: "1", DeletedFlag: "0",
	}
	if ok, reason := r.mayPull(); !ok {
		t.Fatalf("a genuinely public federal attachment was refused as %q, which would make the whole "+
			"corpus pipeline silently useless", reason)
	}
	// The shape sam.gov actually returns, with empty optional fields, must also pass. Real payloads omit
	// fields, and a policy that only accepts fully populated records accepts almost nothing.
	sparse := resource{ID: "ok2", Name: "attachment.pdf", Type: "file", MimeType: ".pdf"}
	if ok, reason := sparse.mayPull(); !ok {
		t.Fatalf("an attachment with empty optional flags was refused as %q; real payloads omit fields", reason)
	}
}

// The restricted reasons must be the ones the manifest counts, or a refusal would happen and be invisible.
func TestRestrictedReasonsAreTheOnesCounted(t *testing.T) {
	counted := map[string]bool{skipExportControlled: true, skipNotPublic: true}
	for _, reason := range []string{skipExportControlled, skipNotPublic} {
		if !counted[reason] {
			t.Fatalf("%q is a restricted refusal that the manifest does not count", reason)
		}
	}
	// not_a_file and unavailable are deliberately NOT restricted: a broken link is not a compliance event
	// and counting it as one would inflate the number an assessor reads.
	for _, reason := range []string{skipNotAFile, skipUnavailable, skipTooLarge, skipDuplicate} {
		if counted[reason] {
			t.Fatalf("%q is counted as restricted and should not be; it is an availability or size fact, "+
				"not a compliance one", reason)
		}
	}
}