package scrub

import (
	"errors"
	"fmt"
	"strings"
	"testing"
)

// GATE 2, THE EXTERNAL BOUNDARY FIXTURES. The directive requires that a fixture containing a CANDIDATE ROW
// and a fixture of TENANT UPLOADED DOCUMENT TEXT each FAIL the scrub suite when placed ANYWHERE in an
// external bound payload.
//
// These fixtures are realistic rather than convenient, and writing them that way is what exposed the gap
// they now guard. A candidate row carrying an email is trivially caught by a marker scan and proves nothing.
// The interesting cases are the two that a careful person would actually produce and still get wrong:
//
//	a candidate row with the identifiers already stripped, which is still one named cleared human
//	a customer's own solicitation text, which contains no personal data at all
//
// Neither was caught by the original gate. The first is private because of WHAT IT IS, the second because
// of WHERE IT CAME FROM, and no pattern match on the bytes can recover either fact once a caller has
// flattened it into a string. That is why provenance is now the primary control.

// A candidate row as the product actually holds one, identifiers present.
const candidateRowWithIdentifiers = `{"id":"7c9e6679-7425-40de-944b-e07fc1f90ae7","full_name":"Dana Whitfield",` +
	`"email":"dana.whitfield@example.com","phone":"(703) 555-0142","clearance":"TS/SCI",` +
	`"skills":["Kubernetes","Splunk","Python"],"years_experience":12}`

// The same person after a caller has helpfully removed the obvious identifiers.
const candidateRowStripped = `Dana Whitfield, TS/SCI with CI polygraph, 12 years, Reston Virginia, ` +
	`Kubernetes and Splunk and Python, currently available, last screened for the PACAF cyber task order`

// An excerpt from a customer's own solicitation package. No personal data whatsoever.
const tenantDocumentText = `SECTION C.3.2 PERFORMANCE WORK STATEMENT. The contractor shall provide ` +
	`continuous monitoring of the enclave in accordance with the customer's internal baseline dated ` +
	`14 March, including the two unadvertised sites identified in Attachment J-7.`

// insertions places a fixture at the start, the middle, and the end of an otherwise innocuous payload, so
// "anywhere in the payload" is tested rather than assumed.
func insertions(fixture string) map[string]string {
	head := `{"task":"normalize","notice":"Solicitation W912DY-26-R-0001 seeks cybersecurity support."`
	tail := `,"model":"llama3.1:8b"}`
	return map[string]string{
		"at the start":  fixture + head + tail,
		"in the middle": head + `,"context":"` + fixture + `"` + tail,
		"at the end":    head + tail + fixture,
	}
}

// A candidate row declared with its TRUE provenance is refused outright, whatever class it claims.
func TestCandidateRowIsRefusedByProvenance(t *testing.T) {
	classes := []EgressClass{ClassPublicKnowledge, ClassPublicDataSummary, ClassOntologySuggest, ClassRequirementNormalize}
	for _, class := range classes {
		for where, payload := range insertions(candidateRowStripped) {
			err := AllowEgress([]Provenance{ProvenanceTenantRecord}, class, []byte(payload))
			if err == nil {
				t.Fatalf("class %s, candidate row %s: a tenant record left the local plane", class, where)
			}
			if !errors.Is(err, ErrEgressProvenanceForbidden) {
				t.Fatalf("class %s, candidate row %s: refused for the wrong reason: %v", class, where, err)
			}
		}
	}
}

// Tenant uploaded document text is private because of its PROVENANCE. It contains no personal data and must
// still never leave, because the class permitting external normalization exists for PUBLIC notice text only.
// No content scan could tell these two apart; only the source can.
func TestTenantUploadedDocumentTextIsRefused(t *testing.T) {
	for where, payload := range insertions(tenantDocumentText) {
		err := AllowEgress([]Provenance{ProvenanceTenantUpload}, ClassRequirementNormalize, []byte(payload))
		if err == nil {
			t.Fatalf("tenant document %s: a customer's own solicitation text left the local plane", where)
		}
		if !errors.Is(err, ErrEgressProvenanceForbidden) {
			t.Fatalf("tenant document %s: refused for the wrong reason: %v", where, err)
		}
	}
}

// The BACKSTOP still works: a caller that MISDECLARES a full candidate row as public cache data is caught
// by the marker scan on the uuid, the email, and the phone.
func TestBackstopCatchesAMisdeclaredCandidateRow(t *testing.T) {
	for where, payload := range insertions(candidateRowWithIdentifiers) {
		err := AllowEgress([]Provenance{ProvenancePublicCache}, ClassRequirementNormalize, []byte(payload))
		if err == nil {
			t.Fatalf("candidate row %s: a misdeclared candidate row passed the content backstop", where)
		}
		if !errors.Is(err, ErrEgressForbidden) {
			t.Fatalf("candidate row %s: refused for the wrong reason: %v", where, err)
		}
	}
}

// THE HONEST LIMIT OF THE BACKSTOP, asserted so nobody later mistakes it for a guarantee.
//
// A caller that misdeclares a STRIPPED candidate row as public cache data is NOT caught, because there is
// no uuid, no email, and no phone in the bytes, and prose about a cleared engineer is not distinguishable
// from prose about a contract by pattern matching. This is documented deliberately rather than left for
// someone to discover, and it is the entire argument for provenance being the primary control: content
// inspection cannot recover a fact that only the caller ever knew.
func TestBackstopLimitIsKnownAndDocumented(t *testing.T) {
	payload := insertions(candidateRowStripped)["in the middle"]
	err := AllowEgress([]Provenance{ProvenancePublicCache}, ClassRequirementNormalize, []byte(payload))
	if err != nil {
		t.Fatalf("the backstop now catches a misdeclared stripped row, which is an improvement but makes "+
			"this test wrong. Replace it with a real assertion rather than deleting the coverage: %v", err)
	}
	t.Log("KNOWN AND ACCEPTED: a MISDECLARED stripped candidate row passes the content backstop. " +
		"Provenance is the control that prevents it and is enforced by the tests above.")
}

// Every provenance outside the permitted two fails closed, including the empty one and one that does not
// exist. The vocabulary is closed for the same reason the intent registry is.
func TestProvenanceVocabularyIsClosed(t *testing.T) {
	for _, prov := range []Provenance{ProvenanceTenantUpload, ProvenanceTenantRecord, Provenance("something_new"), Provenance("")} {
		if err := AllowEgress([]Provenance{prov}, ClassRequirementNormalize, []byte("entirely harmless public text")); err == nil {
			t.Fatalf("provenance %q was permitted; the vocabulary must be closed", prov)
		}
	}
}

// The gate must still permit what it exists to permit, or the boundary is just an outage.
func TestGenuinelyPublicNoticeTextIsPermitted(t *testing.T) {
	public := `{"task":"normalize","notice":"Solicitation W912DY-26-R-0001, PACAF Cyber Systems Operations ` +
		`Support, NAICS 541512, response due 15 September 2026, Joint Base Pearl Harbor Hickam."}`
	if err := AllowEgress([]Provenance{ProvenancePublicCache}, ClassRequirementNormalize, []byte(public)); err != nil {
		t.Fatalf("the gate refused a genuinely public notice, making the external lane unusable: %v", err)
	}
	if err := AllowEgress([]Provenance{ProvenanceCuratedCard}, ClassPublicKnowledge, []byte("NYC Local Law 144 requires a bias audit.")); err != nil {
		t.Fatalf("the gate refused a curated knowledge card: %v", err)
	}
}

// POSITIVE CONTROL on the suite itself, required by the continuation protocol: prove the gate is actually
// running, or a suite that silently tests nothing would report the boundary as sound.
func TestSuitePositiveControl(t *testing.T) {
	if err := AllowEgress([]Provenance{ProvenancePublicCache}, ClassRequirementNormalize, []byte("")); err != nil {
		t.Fatalf("positive control broken: an empty public payload should pass, got %v", err)
	}
	if err := AllowEgress([]Provenance{ProvenancePublicCache}, EgressClass("SOMETHING_MADE_UP"), []byte("harmless")); err == nil {
		t.Fatal("positive control broken: an unknown egress class was permitted, so the gate is not running")
	}
}

// A readable inventory of what the boundary refuses and why, printed on failure so the reason is legible.
func TestBoundaryInventory(t *testing.T) {
	cases := []struct {
		name    string
		prov    Provenance
		payload string
		refuse  bool
	}{
		{"candidate row, declared tenant record", ProvenanceTenantRecord, candidateRowWithIdentifiers, true},
		{"stripped candidate row, declared tenant record", ProvenanceTenantRecord, candidateRowStripped, true},
		{"tenant document, declared tenant upload", ProvenanceTenantUpload, tenantDocumentText, true},
		{"candidate row MISdeclared as public cache", ProvenancePublicCache, candidateRowWithIdentifiers, true},
		{"public notice, declared public cache", ProvenancePublicCache, "Solicitation W912DY seeks cyber support.", false},
		{"public notice, NO provenance declared", Provenance(""), "Solicitation W912DY seeks cyber support.", true},
	}
	var report strings.Builder
	failed := false
	for _, c := range cases {
		err := AllowEgress([]Provenance{c.prov}, ClassRequirementNormalize, []byte(c.payload))
		got := err != nil
		status := "ok"
		if got != c.refuse {
			status = "WRONG"
			failed = true
		}
		report.WriteString(fmt.Sprintf("  %-48s refused=%-5v want=%-5v %s\n", c.name, got, c.refuse, status))
	}
	if failed {
		t.Fatalf("external boundary inventory:\n%s", report.String())
	}
}

// ONE TENANT ELEMENT POISONS THE WHOLE PAYLOAD. This is the semantics that matter once a composer draws on
// more than one row: a public notice with one paragraph of a customer's performance work statement pasted
// into it IS a customer's performance work statement, and a gate that permitted it because most of the
// payload was public would be worse than useless.
func TestOneTenantElementRefusesTheWholePayload(t *testing.T) {
	mixed := []Provenance{ProvenancePublicCache, ProvenancePublicCache, ProvenanceTenantUpload}
	payload := []byte("a mostly public notice with one private paragraph folded in")
	err := AllowEgress(mixed, ClassRequirementNormalize, payload)
	if err == nil {
		t.Fatal("a payload composed from two public rows and ONE tenant upload was allowed to leave")
	}
	if !errors.Is(err, ErrEgressProvenanceForbidden) {
		t.Fatalf("refused for the wrong reason: %v", err)
	}
	// And the all public case must still pass, or the rule is just an outage.
	if err := AllowEgress([]Provenance{ProvenancePublicCache, ProvenanceCuratedCard}, ClassRequirementNormalize, payload); err != nil {
		t.Fatalf("an all permitted set was refused: %v", err)
	}
}

// AN EMPTY PROVENANCE SET IS REFUSED. Silence is not permission: a payload nobody can account for is
// exactly the payload that should not leave, and before this an empty set would have passed every loop.
func TestEmptyProvenanceSetIsRefused(t *testing.T) {
	if err := AllowEgress(nil, ClassRequirementNormalize, []byte("harmless public text")); err == nil {
		t.Fatal("a payload with NO element provenance was allowed to leave")
	}
	if err := AllowEgress([]Provenance{}, ClassRequirementNormalize, []byte("harmless public text")); !errors.Is(err, ErrEgressNoProvenance) {
		t.Fatalf("an empty set was refused for the wrong reason: %v", err)
	}
}