package aioe

import (
	"os"
	"path/filepath"
	"strings"
	"testing"
)

// TestUpdaterSQLTouchesOnlyAioeTables is the compile side of the isolation guarantee: every SQL
// string in this package may reference ONLY the three aioe tables and the run ledger. The
// connection side (the missionmatch_aioe role being DENIED on eeo and every other table) is proven
// by the integration suite. Together they make the updater physically unable to read protected
// data: no query names another table, and the role could not read one even if a query did.
func TestUpdaterSQLTouchesOnlyAioeTables(t *testing.T) {
	forbidden := []string{
		"eeo.", "candidate_demographics", "candidates", "candidate_evaluations",
		"users", "sessions", "requirements", "slates", "slate_members", "resumes",
		"audit_logs", "organizations",
	}
	files, err := filepath.Glob("*.go")
	if err != nil {
		t.Fatal(err)
	}
	for _, f := range files {
		if strings.HasSuffix(f, "_test.go") {
			continue
		}
		// backfill.go is the ONE file in this package that runs as the APP role under RLS (the
		// alert-sweep pattern), not as the restricted missionmatch_aioe updater role. It legitimately
		// reads the org's own slate_members, candidate_evaluations, vendor_submissions, and
		// bid_outcomes to convert real decision history into outcome_events, all RLS scoped. The
		// updater role guarantee this test enforces is about updater.go, profile.go, and compute.go,
		// the code that runs on the aioe pool. See internal/integration for backfill's RLS proof.
		if f == "backfill.go" {
			continue
		}
		src, err := os.ReadFile(f)
		if err != nil {
			t.Fatal(err)
		}
		text := strings.ToLower(string(src))
		for _, bad := range forbidden {
			// Scan only quoted SQL-ish content lines to avoid false hits in comments.
			for _, line := range strings.Split(text, "\n") {
				trimmed := strings.TrimSpace(line)
				if strings.HasPrefix(trimmed, "//") {
					continue
				}
				if !strings.Contains(trimmed, "select") && !strings.Contains(trimmed, "insert") &&
					!strings.Contains(trimmed, "update") && !strings.Contains(trimmed, "delete") &&
					!strings.Contains(trimmed, "from") && !strings.Contains(trimmed, "join") {
					continue
				}
				if strings.Contains(trimmed, bad) {
					t.Fatalf("%s: forbidden table reference %q in line: %s", f, bad, trimmed)
				}
			}
		}
	}
}