package engine

// Stress and property tests for the frozen scoring engine. These do not pin exact sub score formulas (the
// golden and frozen tests do that); they assert the INVARIANTS that must hold for EVERY input, including
// adversarial and extreme ones: the engine is a pure deterministic function, it never panics, every total is a
// bounded two decimal number whose weighted components sum back to it, the band is never higher than the total
// implies, a higher clearance never scores worse, holding more required skills never scores worse, and an
// inactive clearance always scores zero. A property that fails here is a real robustness defect.

import (
	"context"
	"fmt"
	"math"
	"math/rand"
	"sync"
	"testing"

	"github.com/shopspring/decimal"
)

// TestStressConcurrentDeterminism runs the engine from many goroutines at once on a shared input and asserts
// every concurrent call returns the identical result. Run under the race detector (go test -race) it proves the
// hot scoring path has no data race, that the package level code maps are safe for concurrent reads, and that
// concurrency never perturbs the deterministic score, the property the whole platform leans on.
func TestStressConcurrentDeterminism(t *testing.T) {
	ctx := context.Background()
	c := Candidate{
		Clearance:       Clearance{Level: ClearanceTSSCI, Status: StatusActive},
		Skills:          []CandidateSkill{{SkillID: "sk-a", Name: "skill"}},
		YearsExperience: 10,
	}
	r := Requirement{
		RequiredLevel:  ClearanceSecret,
		RequiredSkills: []RequiredSkill{{SkillID: "sk-a", Name: "skill", Mandatory: true}},
		RequiredYears:  5,
	}
	want := ScoreCandidate(ctx, c, r, nil)

	const goroutines, iterations = 64, 300
	var wg sync.WaitGroup
	bad := make(chan string, goroutines)
	for g := 0; g < goroutines; g++ {
		wg.Add(1)
		go func() {
			defer wg.Done()
			for i := 0; i < iterations; i++ {
				got := ScoreCandidate(ctx, c, r, nil)
				if !got.Total.Equal(want.Total) || got.Band != want.Band {
					bad <- fmt.Sprintf("concurrent divergence: %s/%d vs %s/%d", got.Total, got.Band, want.Total, want.Band)
					return
				}
			}
		}()
	}
	wg.Wait()
	close(bad)
	for e := range bad {
		t.Fatal(e)
	}
}

// adversarialStrings are hostile values fuzzed into every string field (skill ids and names, location, customer,
// certifications) to prove the engine treats them as opaque data and never panics or misbehaves on them.
var adversarialStrings = []string{
	"",
	"'; DROP TABLE candidates; --",
	"' OR '1'='1",
	"\x00null byte",
	"line\nbreak\ttab",
	"‮RTL override",
	"homoglyph Сар", // cyrillic that looks latin
	"emoji 🛰️🔐",
	"{{ template injection }}",
	"../../etc/passwd",
	"a very long string " + string(make([]byte, 4096)),
	"UNION SELECT * FROM eeo.candidate_demographics",
	"race", // a protected attribute word as opaque skill data must not change behavior
	"gender",
}

func pick(rng *rand.Rand, xs []string) string { return xs[rng.Intn(len(xs))] }

// randomCandidate builds a candidate spanning the full input space, including the extremes: unknown and inactive
// clearances, negative and huge years, empty and duplicated skills, and adversarial strings.
func randomCandidate(rng *rand.Rand) Candidate {
	years := []int{-100, -1, 0, 1, 5, 40, 100, math.MaxInt32}[rng.Intn(8)]
	nSkills := rng.Intn(6)
	skills := make([]CandidateSkill, nSkills)
	for i := range skills {
		id := []string{"sk-1", "sk-2", "sk-3", "sk-1", pick(rng, adversarialStrings)}[rng.Intn(5)] // note the dup sk-1
		skills[i] = CandidateSkill{SkillID: id, Name: pick(rng, adversarialStrings)}
	}
	nComp := rng.Intn(3)
	comps := make([]string, nComp)
	for i := range comps {
		comps[i] = pick(rng, adversarialStrings)
	}
	return Candidate{
		ID: pick(rng, adversarialStrings),
		Clearance: Clearance{
			Level:        ClearanceLevel(rng.Intn(6)),
			Poly:         Polygraph(rng.Intn(3)),
			Status:       ClearanceStatus(rng.Intn(4)),
			Compartments: comps,
		},
		Skills:             skills,
		Certifications:     []string{pick(rng, adversarialStrings), pick(rng, adversarialStrings)}[:rng.Intn(3)],
		CustomerExperience: []string{pick(rng, adversarialStrings)}[:rng.Intn(2)],
		YearsExperience:    years,
		Location:           pick(rng, adversarialStrings),
		Remote:             rng.Intn(2) == 0,
		Relocatable:        rng.Intn(2) == 0,
		Available:          rng.Intn(2) == 0,
	}
}

func randomRequirement(rng *rand.Rand) Requirement {
	nReq := rng.Intn(5)
	req := make([]RequiredSkill, nReq)
	for i := range req {
		req[i] = RequiredSkill{
			SkillID:   []string{"sk-1", "sk-2", "sk-3", pick(rng, adversarialStrings)}[rng.Intn(4)],
			Name:      pick(rng, adversarialStrings),
			Mandatory: rng.Intn(2) == 0,
		}
	}
	nComp := rng.Intn(3)
	comps := make([]string, nComp)
	for i := range comps {
		comps[i] = pick(rng, adversarialStrings)
	}
	return Requirement{
		ID:                   pick(rng, adversarialStrings),
		RequiredLevel:        ClearanceLevel(rng.Intn(6)),
		RequiredPoly:         Polygraph(rng.Intn(3)),
		RequiredSkills:       req,
		RequiredCerts:        []string{pick(rng, adversarialStrings)}[:rng.Intn(2)],
		CustomerAgency:       pick(rng, adversarialStrings),
		RequiredYears:        []int{-1, 0, 3, 8, 100, math.MaxInt32}[rng.Intn(6)],
		WorkLocation:         pick(rng, adversarialStrings),
		RemoteAllowed:        rng.Intn(2) == 0,
		KeyPersonnel:         rng.Intn(2) == 0,
		RequiredCompartments: comps,
	}
}

// TestStressEngineInvariants fuzzes the engine over the full and adversarial input space and asserts the
// universal invariants on every result: no panic, a bounded two decimal total, the weighted components sum to
// the total, the trace weights sum to one, and the band is never higher than the total implies.
func TestStressEngineInvariants(t *testing.T) {
	rng := rand.New(rand.NewSource(1)) // fixed seed: the fuzz corpus is reproducible
	ctx := context.Background()
	for i := 0; i < 5000; i++ {
		c, r := randomCandidate(rng), randomRequirement(rng)
		res := ScoreCandidate(ctx, c, r, nil) // nil matcher: exact match only, fully deterministic

		if res.Total.LessThan(decimal.Zero) || res.Total.GreaterThan(hundred) {
			t.Fatalf("total out of range [0,100]: %s (candidate %+v)", res.Total, c.Clearance)
		}
		if !res.Total.Equal(res.Total.Round(2)) {
			t.Fatalf("total is not rounded to two decimals: %s", res.Total)
		}
		if res.Band != BandRed && res.Band != BandYellow && res.Band != BandGreen {
			t.Fatalf("band is not one of the three valid bands: %d", res.Band)
		}
		// The weighted components must sum to the total (the decision trace is complete and consistent).
		sum := decimal.Zero
		weightSum := decimal.Zero
		for _, cs := range res.Trace {
			sum = sum.Add(cs.Weighted)
			weightSum = weightSum.Add(cs.Weight)
		}
		if !sum.Round(2).Equal(res.Total) {
			t.Fatalf("component weighted sum %s != total %s (trace inconsistent)", sum.Round(2), res.Total)
		}
		if !weightSum.Equal(decimal.NewFromInt(1)) {
			t.Fatalf("trace weights sum to %s, not 1.0", weightSum)
		}
		// The band cap direction: the band may be LOWER than the total implies (a clearance gap caps at Red, a
		// mandatory skill gap caps at Yellow), but it may NEVER be higher. So a Green band demands a total of at
		// least 90, and a total below 75 must be Red.
		if res.Band == BandGreen && res.Total.LessThan(BandGreenMin) {
			t.Fatalf("Green band with total %s below 90", res.Total)
		}
		if res.Total.LessThan(BandYellowMin) && res.Band != BandRed {
			t.Fatalf("total %s below 75 must be Red, got band %d", res.Total, res.Band)
		}
	}
}

// TestStressDeterminism proves the engine is a pure deterministic function: the same input scored twice yields a
// byte identical result. This is the load bearing property for the AEDT audit trail (a score must reproduce).
func TestStressDeterminism(t *testing.T) {
	rng := rand.New(rand.NewSource(2))
	ctx := context.Background()
	for i := 0; i < 3000; i++ {
		c, r := randomCandidate(rng), randomRequirement(rng)
		a := ScoreCandidate(ctx, c, r, nil)
		b := ScoreCandidate(ctx, c, r, nil)
		if !a.Total.Equal(b.Total) || a.Band != b.Band || len(a.Trace) != len(b.Trace) {
			t.Fatalf("non deterministic: total %s/%s band %d/%d", a.Total, b.Total, a.Band, b.Band)
		}
		for j := range a.Trace {
			if !a.Trace[j].Weighted.Equal(b.Trace[j].Weighted) {
				t.Fatalf("non deterministic component %s: %s vs %s", a.Trace[j].Component, a.Trace[j].Weighted, b.Trace[j].Weighted)
			}
		}
	}
}

// TestStressClearanceInactiveScoresZeroWhenRequired proves the security relevant guarantee: WHEN a clearance is
// actually required (the requirement is Confidential or higher), a clearance that is not Active (expired,
// inactive, or unknown status) scores exactly zero on the clearance dimension, for every held level. An expired
// or unknown clearance can never contribute to the score of a role that needs a clearance.
func TestStressClearanceInactiveScoresZeroWhenRequired(t *testing.T) {
	ctx := context.Background()
	for _, status := range []ClearanceStatus{StatusUnknown, StatusExpired, StatusInactive} {
		for level := ClearanceUnknown; level <= ClearanceTSSCI; level++ {
			for reqLevel := ClearanceConfidential; reqLevel <= ClearanceTSSCI; reqLevel++ {
				c := Candidate{Clearance: Clearance{Level: level, Status: status}}
				r := Requirement{RequiredLevel: reqLevel}
				res := ScoreCandidate(ctx, c, r, nil)
				if !res.Clearance.Equal(decimal.Zero) {
					t.Fatalf("inactive clearance scored nonzero on a clearance required role: level=%v status=%v req=%v clearance=%s",
						level, status, reqLevel, res.Clearance)
				}
			}
		}
	}
}

// TestStressNoClearanceRequiredIsVacuous pins the deliberate boundary the fuzzer surfaced: a role that requires
// no clearance (RequiredLevel below Confidential, so Unknown or None) gives every candidate full clearance
// credit regardless of their held level or status, because clearance is not a discriminator for that role. This
// is documented behavior, and clearance is neutral rather than penalizing on a no clearance role.
func TestStressNoClearanceRequiredIsVacuous(t *testing.T) {
	ctx := context.Background()
	for _, reqLevel := range []ClearanceLevel{ClearanceUnknown, ClearanceNone} {
		for level := ClearanceUnknown; level <= ClearanceTSSCI; level++ {
			for status := StatusUnknown; status <= StatusInactive; status++ {
				res := ScoreCandidate(ctx,
					Candidate{Clearance: Clearance{Level: level, Status: status}},
					Requirement{RequiredLevel: reqLevel}, nil)
				if !res.Clearance.Equal(hundred) {
					t.Fatalf("no clearance required (req=%v) must give full clearance credit, level=%v status=%v scored %s",
						reqLevel, level, status, res.Clearance)
				}
			}
		}
	}
}

// TestStressClearanceMonotonicity proves a higher held clearance never scores worse on the clearance dimension
// than a lower one, holding the requirement and everything else fixed (active status, no poly or compartment
// requirement). A monotonicity break would mean a more cleared candidate is penalized, an obvious defect.
func TestStressClearanceMonotonicity(t *testing.T) {
	ctx := context.Background()
	for reqLevel := ClearanceNone; reqLevel <= ClearanceTSSCI; reqLevel++ {
		r := Requirement{RequiredLevel: reqLevel, RequiredPoly: PolyNone}
		prev := decimal.NewFromInt(-1)
		for level := ClearanceNone; level <= ClearanceTSSCI; level++ {
			c := Candidate{Clearance: Clearance{Level: level, Poly: PolyFullScope, Status: StatusActive}}
			res := ScoreCandidate(ctx, c, r, nil)
			if res.Clearance.LessThan(prev) {
				t.Fatalf("clearance not monotonic at req=%v: level %v scored %s below previous %s",
					reqLevel, level, res.Clearance, prev)
			}
			prev = res.Clearance
		}
	}
}

// TestStressClearanceMeetsOrExceeds proves the documented rule directly: an active clearance at or above the
// required level (no poly or compartment gate) scores full clearance, and an active clearance below the required
// level scores zero. Exact or higher meets, lower does not.
func TestStressClearanceMeetsOrExceeds(t *testing.T) {
	ctx := context.Background()
	for reqLevel := ClearanceNone; reqLevel <= ClearanceTSSCI; reqLevel++ {
		r := Requirement{RequiredLevel: reqLevel, RequiredPoly: PolyNone}
		for level := ClearanceNone; level <= ClearanceTSSCI; level++ {
			c := Candidate{Clearance: Clearance{Level: level, Poly: PolyNone, Status: StatusActive}}
			res := ScoreCandidate(ctx, c, r, nil)
			if level >= reqLevel {
				if !res.Clearance.Equal(hundred) {
					t.Fatalf("active clearance level %v meets req %v but scored %s, want 100", level, reqLevel, res.Clearance)
				}
			} else {
				if !res.Clearance.Equal(decimal.Zero) {
					t.Fatalf("active clearance level %v below req %v scored %s, want 0", level, reqLevel, res.Clearance)
				}
			}
		}
	}
}

// TestStressSkillsMonotonicity proves holding MORE of the required skills (exact matches) never lowers the
// skills sub score. It builds a requirement of K mandatory skills and a candidate that holds the first j of
// them, for j from 0 to K, and asserts the skills score is non decreasing.
func TestStressSkillsMonotonicity(t *testing.T) {
	ctx := context.Background()
	const K = 5
	req := make([]RequiredSkill, K)
	for i := range req {
		req[i] = RequiredSkill{SkillID: "sk-" + string(rune('a'+i)), Name: "skill", Mandatory: true}
	}
	r := Requirement{RequiredSkills: req}
	prev := decimal.NewFromInt(-1)
	for j := 0; j <= K; j++ {
		cand := make([]CandidateSkill, j)
		for i := 0; i < j; i++ {
			cand[i] = CandidateSkill{SkillID: "sk-" + string(rune('a'+i)), Name: "skill"}
		}
		res := ScoreCandidate(ctx, Candidate{Skills: cand}, r, nil)
		if res.Skills.LessThan(prev) {
			t.Fatalf("skills not monotonic: holding %d of %d required scored %s below previous %s", j, K, res.Skills, prev)
		}
		prev = res.Skills
	}
}

// TestStressTotalSkillsMonotonicity proves the whole match TOTAL never drops when a candidate gains a matched
// required skill. The band may cap (an unmet mandatory skill caps the band at Yellow), but by contract the
// TOTAL is monotone: adding a qualification must never lower a candidate's overall score. It builds a
// requirement of K mandatory skills and grows the candidate from holding none to holding all, asserting the
// total is non decreasing. A break would mean adding a qualification penalizes a candidate, an AEDT defect.
func TestStressTotalSkillsMonotonicity(t *testing.T) {
	ctx := context.Background()
	const K = 5
	req := make([]RequiredSkill, K)
	for i := range req {
		req[i] = RequiredSkill{SkillID: "sk-" + string(rune('a'+i)), Name: "skill", Mandatory: true}
	}
	// A fixed requirement with a clearance and years bar too, so the total has several nonzero components and a
	// skills change is not the only mover.
	r := Requirement{RequiredLevel: ClearanceSecret, RequiredYears: 5, RequiredSkills: req}
	base := Candidate{
		Clearance:       Clearance{Level: ClearanceTopSecret, Status: StatusActive},
		YearsExperience: 8,
	}
	prev := decimal.NewFromInt(-1)
	for j := 0; j <= K; j++ {
		c := base
		c.Skills = make([]CandidateSkill, j)
		for i := 0; i < j; i++ {
			c.Skills[i] = CandidateSkill{SkillID: "sk-" + string(rune('a'+i)), Name: "skill"}
		}
		res := ScoreCandidate(ctx, c, r, nil)
		if res.Total.LessThan(prev) {
			t.Fatalf("total not monotonic in matched skills: holding %d of %d scored total %s below previous %s", j, K, res.Total, prev)
		}
		prev = res.Total
	}
}

// TestStressEmptyRequirementIsVacuous proves an empty requirement (nothing required) does not crash and yields a
// well formed, bounded result, so a sparse or brand new requirement is safe to score.
func TestStressEmptyRequirementIsVacuous(t *testing.T) {
	ctx := context.Background()
	res := ScoreCandidate(ctx, Candidate{}, Requirement{}, nil)
	if res.Total.LessThan(decimal.Zero) || res.Total.GreaterThan(hundred) {
		t.Fatalf("empty inputs produced an out of range total: %s", res.Total)
	}
	if res.Band != BandRed && res.Band != BandYellow && res.Band != BandGreen {
		t.Fatalf("empty inputs produced an invalid band: %d", res.Band)
	}
}