package scrub

import (
	"os"
	"path/filepath"
	"regexp"
	"strings"
	"testing"
)

// THE BINDING SITE INVENTORY, ratified 28 July 2026.
//
// Provenance is bound AT ORIGIN by migration 0081: a DEFAULT supplies it, a CHECK bounds it, and a trigger
// overwrites any value on insert and refuses any change on update. The point of that design is that
// fabricating provenance should require touching a NAMED LOCATION that someone reviews, rather than typing
// a constant at a call site.
//
// This test is what makes that claim checkable. It enumerates every place provenance can be bound, asserts
// the migration actually binds each one, and FAILS if a provenance constant appears anywhere it should not,
// which is how a future call time declaration gets caught the day it is written rather than at an audit.

// bindingSites is the closed inventory. A table gains provenance ONLY by being added here and to the
// migration together, which is the reviewable moment this whole design exists to create.
var bindingSites = map[string]Provenance{
	"sam_opportunities":           ProvenancePublicCache,
	"opportunity_records":         ProvenancePublicCache,
	"opportunity_documents":       ProvenanceTenantUpload,
	"opportunity_document_chunks": ProvenanceTenantUpload,
	"opportunity_scope_items":     ProvenanceTenantRecord,
	"candidates":                  ProvenanceTenantRecord,
}

func repoRoot(t *testing.T) string {
	t.Helper()
	// This package sits at internal/platform/scrub, so the root is three levels up.
	root, err := filepath.Abs("../../..")
	if err != nil {
		t.Fatalf("resolve repo root: %v", err)
	}
	return root
}

// readMigration returns EVERY migration that binds provenance, concatenated.
//
// It read only 0081 at first, and kept passing after 0082 moved the binding for opportunity_documents and
// opportunity_document_chunks from a per table constant to a per source mapping. A test that passes while
// blind to the file doing the work is the failure mode this whole suite exists to prevent, so the set is
// enumerated and each file is REQUIRED to exist: deleting one fails the test rather than shrinking it.
func readMigration(t *testing.T) string {
	t.Helper()
	files := []string{
		"0081_provenance_at_origin.sql",
		"0082_provenance_by_source.sql",
	}
	var all strings.Builder
	for _, f := range files {
		b, err := os.ReadFile(filepath.Join(repoRoot(t), "db", "migrations", f))
		if err != nil {
			t.Fatalf("the origin binding migration %s is missing, which means provenance is no longer bound "+
				"at origin the way this suite believes: %v", f, err)
		}
		all.Write(b)
		all.WriteString("\n")
	}
	return all.String()
}

// THE SOURCE TO PROVENANCE MAPPING IS ASSERTED HERE, because 0082 made it the thing that decides whether a
// document may leave the local plane. Two properties matter and both are checked:
//
//	the PUBLIC sources are exactly the two intended ones, so widening the set is a visible diff here
//	the default is the RESTRICTIVE one, so a source_type nobody has thought of yet is private
func TestDocumentProvenanceMappingIsNarrowAndFailsClosed(t *testing.T) {
	sql := readMigration(t)
	if !strings.Contains(sql, "WHEN NEW.source_type IN ('sam_attachment', 'url_import') THEN 'public_cache'") {
		t.Fatal("the public source mapping is not the expected pair. If a source was added, add it here too " +
			"and say why in the commit, because every source in that list can reach an external model.")
	}
	if !strings.Contains(sql, "ELSE 'tenant_upload'") {
		t.Fatal("the mapping no longer defaults to tenant_upload. A permissive default here is a disclosure, " +
			"not an inconvenience.")
	}
	// source_type must be immutable, or a row could be inserted as an upload and relabelled an attachment,
	// laundering a customer's document into the public class after the fact.
	if !strings.Contains(sql, "source_type is immutable on") {
		t.Fatal("source_type is no longer immutable, so provenance can be changed indirectly by changing " +
			"what it derives from")
	}
}

// Every site in the inventory must actually be bound by the migration: the column, the CHECK that pins it
// to one value, and the trigger that makes it born rather than chosen.
func TestEveryBindingSiteIsBoundByTheMigration(t *testing.T) {
	sql := readMigration(t)
	for table, want := range bindingSites {
		if !strings.Contains(sql, "ALTER TABLE "+table+" ADD COLUMN IF NOT EXISTS provenance") {
			t.Errorf("%s: no provenance column is added by the migration", table)
		}
		if !strings.Contains(sql, "CHECK (provenance = '"+string(want)+"')") {
			t.Errorf("%s: the CHECK does not pin provenance to %s, so the row could be born wrong", table, want)
		}
		trigger := "CREATE TRIGGER trg_" + table + "_provenance BEFORE INSERT OR UPDATE ON " + table
		if !strings.Contains(sql, trigger) {
			t.Errorf("%s: no BEFORE INSERT OR UPDATE trigger, so a writer could CHOOSE its provenance and "+
				"the default would not stop it", table)
		}
		if !strings.Contains(sql, "provenance_is_born_not_chosen('"+string(want)+"')") {
			t.Errorf("%s: the trigger does not stamp %s", table, want)
		}
	}
}

// The migration must not bind a table that is NOT in the inventory. A silent addition is exactly the kind
// of change this inventory exists to force into the open.
func TestMigrationBindsNothingOutsideTheInventory(t *testing.T) {
	sql := readMigration(t)
	re := regexp.MustCompile(`CREATE TRIGGER trg_([a-z_]+)_provenance`)
	for _, m := range re.FindAllStringSubmatch(sql, -1) {
		table := m[1]
		if _, ok := bindingSites[table]; !ok {
			t.Errorf("the migration binds provenance on %q, which is not in the binding site inventory. "+
				"Add it here deliberately or remove it there.", table)
		}
	}
}

// THE ONE THAT CATCHES A REGRESSION. A provenance constant must not appear in application code outside this
// package. Its presence means somebody is DECLARING provenance rather than reading it from the row, which
// is the design this redesign removed.
func TestNoProvenanceConstantIsDeclaredInApplicationCode(t *testing.T) {
	root := repoRoot(t)
	// The constants themselves live here, and the tests in this package necessarily name them.
	skipDir := filepath.Join(root, "internal", "platform", "scrub")
	needle := regexp.MustCompile(`scrub\.Provenance(PublicCache|CuratedCard|TenantUpload|TenantRecord)\b`)

	var offenders []string
	for _, dir := range []string{"cmd", "internal"} {
		_ = filepath.Walk(filepath.Join(root, dir), func(path string, info os.FileInfo, err error) error {
			if err != nil || info.IsDir() {
				return nil
			}
			if strings.HasPrefix(path, skipDir) || !strings.HasSuffix(path, ".go") {
				return nil
			}
			// Test files may name a constant to build a fixture; production code may not.
			if strings.HasSuffix(path, "_test.go") {
				return nil
			}
			b, rerr := os.ReadFile(path)
			if rerr != nil {
				return nil
			}
			if needle.Match(b) {
				rel, _ := filepath.Rel(root, path)
				offenders = append(offenders, rel)
			}
			return nil
		})
	}
	if len(offenders) > 0 {
		t.Fatalf("provenance is DECLARED in application code at %v.\n"+
			"Provenance is bound at origin and must be READ from the stored row, never named as a constant "+
			"by the code composing a payload. If one of these genuinely needs a literal, that is a design "+
			"change and belongs in migration 0081 and this inventory, not at a call site.", offenders)
	}
}

// POSITIVE CONTROL on this inventory, required by the continuation protocol. If the detector cannot find a
// constant that is definitely there, the test above proves nothing and would pass an empty repository.
func TestBindingSiteDetectorPositiveControl(t *testing.T) {
	needle := regexp.MustCompile(`scrub\.Provenance(PublicCache|CuratedCard|TenantUpload|TenantRecord)\b`)
	planted := []byte("meta, err := ai.AllowExternal(\"x\", scrub.ProvenancePublicCache, class, payload)")
	if !needle.Match(planted) {
		t.Fatal("positive control FAILED: the detector cannot see a declared provenance constant, so the " +
			"regression test above is not actually testing anything")
	}
	clean := []byte("meta, err := ai.AllowExternal(\"x\", j.provs, class, payload)")
	if needle.Match(clean) {
		t.Fatal("positive control FAILED: the detector flags a payload that correctly reads provenance " +
			"from the row, which would make the test unusable")
	}
}

// The vocabulary in code and the vocabulary in the migration must be the same set, or a value could be
// storable that the gate has never heard of, which fails closed but confusingly.
func TestCodeAndMigrationVocabulariesAgree(t *testing.T) {
	sql := readMigration(t)
	for _, p := range []Provenance{ProvenancePublicCache, ProvenanceTenantUpload, ProvenanceTenantRecord} {
		if !strings.Contains(sql, "'"+string(p)+"'") {
			t.Errorf("provenance %q exists in code but is never bound by the migration", p)
		}
	}
	// curated_card is deliberately NOT bound by a table trigger yet: knowledge cards are curated through
	// the operator only curation path and do not have a provenance column. Recorded so its absence reads as
	// a decision rather than an omission.
	if strings.Contains(sql, "'curated_card'") {
		t.Log("curated_card is now bound by the migration; update this test's note")
	}
}