package ai

import (
	"strings"
	"testing"
)

// TestGraphClearanceIntentsAreRegistered proves the three G5 clearance intents are in the closed Registry,
// so ValidateRegistry asserts them at boot and ExecuteIntent can run them. A missing intent means the
// registration regressed.
func TestGraphClearanceIntentsAreRegistered(t *testing.T) {
	cases := map[string]int{
		IntentClearanceReachability:  1, // held_code
		IntentCompartmentRequirement: 1, // required_compartments
		IntentBenchClearanceCoverage: 0, // no SQL param (the threshold is a Go argument)
	}
	for name, wantParams := range cases {
		it, ok := IntentByName(name)
		if !ok {
			t.Fatalf("intent %q must be registered in the closed Registry", name)
		}
		if len(it.Params) != wantParams {
			t.Errorf("intent %q must bind exactly %d params, got %d", name, wantParams, len(it.Params))
		}
	}
}

// TestGraphClearanceIntentsPassTheReadOnlyGuard is the load bearing security assertion the task requires:
// each of the three new clearance SQL consts passes GuardReadOnlyQuery against the real ReadAllowlist with
// no error. A query that referenced a non allowlisted table, hid a mutation, or named an eeo marker would
// fail here, the same gate ValidateRegistry runs at boot and ExecuteIntent re runs at execution time.
func TestGraphClearanceIntentsPassTheReadOnlyGuard(t *testing.T) {
	for _, tc := range []struct {
		name string
		sql  string
	}{
		{"clearance_reachability", clearanceReachabilitySQL},
		{"compartment_requirement_closure", compartmentRequirementClosureSQL},
		{"bench_clearance_coverage", benchClearanceCoverageSQL},
	} {
		if err := GuardReadOnlyQuery(tc.sql, ReadAllowlist); err != nil {
			t.Errorf("the registered clearance intent %q must pass the read only guard: %v", tc.name, err)
		}
	}
}

// TestValidateRegistryWithClearanceIntents proves the whole closed Registry, now carrying the three G5
// clearance intents alongside the TAG, G3, G1, G9, G7, and G2 intents, validates at boot. This is the
// assertion the api boot runs.
func TestValidateRegistryWithClearanceIntents(t *testing.T) {
	if err := ValidateRegistry(); err != nil {
		t.Fatalf("ValidateRegistry must pass with the three G5 clearance intents registered: %v", err)
	}
}

// TestClearanceReferenceTablesInAllowlist pins that the four global clearance reference tables are in the
// read allowlist, so the reference intents that read them pass the guard. A regression that dropped one
// would surface here and at the guard test above.
func TestClearanceReferenceTablesInAllowlist(t *testing.T) {
	for _, tbl := range []string{"clearance_levels", "polygraph_types", "clearance_compartments", "clearance_reciprocity"} {
		if !ReadAllowlist[tbl] {
			t.Errorf("the clearance reference table %q must be in the read allowlist", tbl)
		}
	}
}

// TestClearanceReachabilityOrdersByRankWithTiebreaker pins the byte stable mandate: the reachability ladder
// ends its ORDER BY with the required code tiebreaker after the required rank, a total order over the cross
// joined levels, so the same held code yields byte identical rows.
func TestClearanceReachabilityOrdersByRankWithTiebreaker(t *testing.T) {
	lower := strings.ToLower(clearanceReachabilitySQL)
	idx := strings.LastIndex(lower, "order by")
	if idx < 0 {
		t.Fatal("the reachability ladder must be ordered for byte stability")
	}
	orderClause := lower[idx:]
	if !strings.Contains(orderClause, "req.rank") || !strings.Contains(orderClause, "req.code") {
		t.Errorf("the reachability ORDER BY must end with the required rank then the required code tiebreaker, got %q", orderClause)
	}
}

// TestBenchCoverageOrdersByRankWithTiebreaker pins the same byte stable mandate on the bench coverage
// partition: it ends its ORDER BY with the level code after the level rank, a total order over the levels.
func TestBenchCoverageOrdersByRankWithTiebreaker(t *testing.T) {
	lower := strings.ToLower(benchClearanceCoverageSQL)
	idx := strings.LastIndex(lower, "order by")
	if idx < 0 {
		t.Fatal("the bench coverage partition must be ordered for byte stability")
	}
	orderClause := lower[idx:]
	if !strings.Contains(orderClause, "cl.rank") || !strings.Contains(orderClause, "cl.code") {
		t.Errorf("the bench coverage ORDER BY must end with the level rank then the level code tiebreaker, got %q", orderClause)
	}
}

// TestBenchCoverageFiltersErasedCandidates pins that the bench coverage count excludes a soft deleted or an
// anonymized candidate, mirroring count_candidates_by_clearance, so an erased candidate is never counted
// into a clearance headcount.
func TestBenchCoverageFiltersErasedCandidates(t *testing.T) {
	lower := strings.ToLower(benchClearanceCoverageSQL)
	if !strings.Contains(lower, "deleted_at is null") {
		t.Error("the bench coverage count must exclude soft deleted candidates (deleted_at IS NULL)")
	}
	if !strings.Contains(lower, "anonymized_at is null") {
		t.Error("the bench coverage count must exclude anonymized candidates (anonymized_at IS NULL)")
	}
}

// TestNoFloatTouchesAClearanceNumber pins the decimal mandate across the three clearance intents: no float
// cast may touch any surfaced number. The reachability ladder surfaces ranks and a satisfies boolean, the
// closure surfaces text codes, and the coverage intent surfaces an int headcount, so no float cast belongs
// anywhere on this plane.
func TestNoFloatTouchesAClearanceNumber(t *testing.T) {
	for name, sql := range map[string]string{
		"clearance_reachability":          clearanceReachabilitySQL,
		"compartment_requirement_closure": compartmentRequirementClosureSQL,
		"bench_clearance_coverage":        benchClearanceCoverageSQL,
	} {
		lower := strings.ToLower(sql)
		for _, floatCast := range []string{"::float8", "::float", "::double precision", "::real"} {
			if strings.Contains(lower, floatCast) {
				t.Errorf("%s: a float cast %q must never touch a clearance number (decimal mandate)", name, floatCast)
			}
		}
	}
}

// TestClearanceIntentsAreGraphIntents proves the three G5 intents are classified as graph intents, so the
// Answer dispatcher routes them to AnswerGraph (the graph evidence rendering and the graph route audit)
// rather than AnswerTAG. A regression that dropped one from graphIntents would surface here.
func TestClearanceIntentsAreGraphIntents(t *testing.T) {
	for _, name := range []string{IntentClearanceReachability, IntentCompartmentRequirement, IntentBenchClearanceCoverage} {
		if !IsGraphIntent(name) {
			t.Errorf("the clearance intent %q must be a graph intent", name)
		}
	}
}

// TestHeldClearanceCodeExtraction proves the conservative classifier binds the held clearance code only from
// an unambiguous named clearance, with the longer phrase winning over a shorter substring (ts sci over
// secret, top secret over secret), and binds one of the six ParamEnum allowed codes so ExecuteIntent's enum
// guard accepts it. A question naming no clearance binds nothing and falls back to RAG.
func TestHeldClearanceCodeExtraction(t *testing.T) {
	cases := map[string]string{
		"which clearances does a ts/sci hold satisfy": "ts_sci",
		"what does a top secret clearance satisfy":    "top_secret",
		"does a secret clearance satisfy the role":    "secret",
		"is a confidential clearance enough":          "confidential",
	}
	for q, want := range cases {
		got, ok := heldClearanceCode(strings.ToLower(q))
		if !ok {
			t.Errorf("%q must bind a held clearance code", q)
			continue
		}
		if got != want {
			t.Errorf("%q bound held code %q, want %q", q, got, want)
		}
	}
	if _, ok := heldClearanceCode("which requirements can this person fill"); ok {
		t.Error("a question naming no clearance must bind nothing and fall back to RAG")
	}
}