package ai

import (
	"strings"
	"testing"
)

// TestVendorIntentsAreRegistered proves both Phase 2 vendor intents are in the closed Registry, so
// ValidateRegistry asserts them at boot. Neither binds a SQL param (the scorecard reports every vendor, the
// distribution reports every vendor; the suppression threshold is a Go argument, never a bound SQL param).
func TestVendorIntentsAreRegistered(t *testing.T) {
	for _, name := range []string{IntentVendorPerformanceScorecard, IntentVendorQualityDistribution} {
		it, ok := IntentByName(name)
		if !ok {
			t.Fatalf("intent %q must be registered in the closed Registry", name)
		}
		if len(it.Params) != 0 {
			t.Errorf("intent %q must bind no params, got %d", name, len(it.Params))
		}
		if it.Executor == ExecutorModel {
			t.Errorf("intent %q must be a SQL intent, not a MAG model intent", name)
		}
	}
}

// TestVendorIntentsPassTheReadOnlyGuard is the load bearing security assertion: both vendor SQL consts pass
// GuardReadOnlyQuery against the real ReadAllowlist. A query that referenced a non allowlisted table, hid a
// mutation, or named an eeo marker would fail here, the same gate ValidateRegistry runs at boot and
// ExecuteIntent re runs at execution time.
func TestVendorIntentsPassTheReadOnlyGuard(t *testing.T) {
	for _, tc := range []struct {
		name string
		sql  string
	}{
		{"vendor_performance_scorecard", vendorPerformanceScorecardSQL},
		{"vendor_quality_distribution", vendorQualityDistributionSQL},
	} {
		if err := GuardReadOnlyQuery(tc.sql, ReadAllowlist); err != nil {
			t.Errorf("the registered vendor intent %q must pass the read only guard: %v", tc.name, err)
		}
	}
}

// TestValidateRegistryWithVendorIntents proves the whole closed Registry, now carrying the two Phase 2 vendor
// intents, validates at boot. This is the assertion the api boot runs.
func TestValidateRegistryWithVendorIntents(t *testing.T) {
	if err := ValidateRegistry(); err != nil {
		t.Fatalf("ValidateRegistry must pass with the two vendor intents registered: %v", err)
	}
}

// TestVendorQualityDistributionIsAnAuthGatedBenchIntent proves the quality distribution is classified as BOTH
// a graph intent (so Answer routes it to AnswerGraph) AND a bench intent (so the AnswerGraph bench fork routes
// it to the suppressing executor and the route gate requires an authenticated tenant). A regression that
// dropped either would let a person derived per band headcount run through the raw, UNSUPPRESSED path.
func TestVendorQualityDistributionIsAnAuthGatedBenchIntent(t *testing.T) {
	if !IsGraphIntent(IntentVendorQualityDistribution) {
		t.Error("the vendor quality distribution must be a graph intent so Answer routes it to AnswerGraph")
	}
	if !IsBenchIntent(IntentVendorQualityDistribution) {
		t.Error("the vendor quality distribution partitions people per band and must be a bench intent (suppressed, auth gated)")
	}
}

// TestVendorPerformanceScorecardIsAPlainTAGIntent proves the scorecard is NOT a graph intent and NOT a bench
// intent: it is an outcome aggregate that runs the standard AnswerTAG path. It reports no per band headcount
// partition, so it deliberately does not run through the suppressing bench executor. A regression that made it
// a bench intent would route it away from ExecuteIntent; a regression that made it a graph intent would change
// its rendering and audit surface.
func TestVendorPerformanceScorecardIsAPlainTAGIntent(t *testing.T) {
	if IsGraphIntent(IntentVendorPerformanceScorecard) {
		t.Error("the vendor performance scorecard is a plain TAG aggregate and must NOT be a graph intent")
	}
	if IsBenchIntent(IntentVendorPerformanceScorecard) {
		t.Error("the vendor performance scorecard is an outcome aggregate and must NOT be a bench intent")
	}
	if IsModelIntent(IntentVendorPerformanceScorecard) {
		t.Error("the vendor performance scorecard is a SQL intent and must NOT be a MAG model intent")
	}
}

// TestVendorQualityDistributionReadsTheFrozenBand pins that the distribution reads the ALREADY audited
// candidate_evaluations band, never recomputing a score. The band is the frozen engine's decision at
// evaluation time; the intent reports its per vendor distribution, it does not score anyone.
func TestVendorQualityDistributionReadsTheFrozenBand(t *testing.T) {
	lower := strings.ToLower(vendorQualityDistributionSQL)
	if !strings.Contains(lower, "candidate_evaluations") {
		t.Error("the vendor quality distribution must read the already audited candidate_evaluations table")
	}
	if !strings.Contains(lower, "ce.band") {
		t.Error("the vendor quality distribution must partition by the stored band, never a recomputed score")
	}
}

// TestVendorQualityDistributionOrdersDeterministically pins the byte stable mandate: the distribution ends its
// outer ORDER BY with a total order over (vendor name, vendor id, band), and its per_candidate dedup carries an
// evaluated_at then requirement_id total order, so the same inputs yield byte identical rows and the per vendor
// partition the executor seeds is deterministic.
func TestVendorQualityDistributionOrdersDeterministically(t *testing.T) {
	lower := strings.ToLower(vendorQualityDistributionSQL)
	idx := strings.LastIndex(lower, "order by")
	if idx < 0 {
		t.Fatal("the vendor quality distribution must be ordered for byte stability")
	}
	tail := lower[idx:]
	for _, col := range []string{"vendor_name", "vendor_id", "band"} {
		if !strings.Contains(tail, col) {
			t.Errorf("the vendor quality distribution outer ORDER BY must include %q for a total order, got %q", col, tail)
		}
	}
	// The dedup that makes it a true partition must break ties deterministically (most recent evaluation).
	if !strings.Contains(lower, "evaluated_at") {
		t.Error("the per candidate dedup must order by evaluated_at so the representative band is deterministic")
	}
}

// TestVendorReadsDedupePerCandidate pins the partition fix: BOTH vendor reads reduce each (vendor, candidate)
// to ONE representative band via DISTINCT ON, so a candidate the vendor submitted for several requirements with
// different bands counts once (never in multiple band cells, never double weighted in the quality average).
// This is the invariant the k suppression relies on; a regression that removed the dedup would break the
// partition and let a published cell plus a suppressed cell leak an overlap.
func TestVendorReadsDedupePerCandidate(t *testing.T) {
	for name, sql := range map[string]string{
		"vendor_performance_scorecard": vendorPerformanceScorecardSQL,
		"vendor_quality_distribution":  vendorQualityDistributionSQL,
	} {
		lower := strings.ToLower(sql)
		if !strings.Contains(lower, "distinct on (v.id, ce.candidate_id)") {
			t.Errorf("%s: each (vendor, candidate) must be reduced to one representative band via DISTINCT ON so a repeat submission counts the person once", name)
		}
	}
}

// TestVendorScorecardQualityIsKFloored pins the small cell floor on the scorecard's quality signal: the mean
// frozen band is computed ONLY when the vendor has at least ten evaluated DISTINCT candidates
// (evaluated_candidates >= 10), else NULL. The floor counts PEOPLE, not submissions, so a handful of people
// submitted many times can never clear it and a thin vendor's band average can never re identify an individual.
func TestVendorScorecardQualityIsKFloored(t *testing.T) {
	lower := strings.ToLower(vendorPerformanceScorecardSQL)
	if !strings.Contains(lower, "evaluated_candidates, 0) >= 10") {
		t.Error("the scorecard quality must be gated at ten evaluated DISTINCT candidates (evaluated_candidates >= 10) so a thin vendor's band average is withheld")
	}
	if !strings.Contains(lower, "candidate_evaluations") {
		t.Error("the scorecard quality must read the frozen candidate_evaluations band, never recomputing a score")
	}
}

// TestVendorScorecardWeightsSumToOne pins the deterministic PerformanceScore weighting: fill 0.35, quality
// 0.30, submit speed 0.20, interview 0.15, which sum to one, so the surfaced score is a convex combination in
// [0, 1]. The weights live in the SQL as literal decimal factors; a drift would change the surfaced score.
func TestVendorScorecardWeightsSumToOne(t *testing.T) {
	lower := strings.ToLower(vendorPerformanceScorecardSQL)
	for _, w := range []string{"* 0.35", "* 0.30", "* 0.20", "* 0.15"} {
		if !strings.Contains(lower, w) {
			t.Errorf("the scorecard PerformanceScore must carry the weight %q (fill 0.35, quality 0.30, speed 0.20, interview 0.15 sum to one)", w)
		}
	}
}

// TestVendorIntentsNameNoEEO pins the absolute EEO isolation: neither vendor SQL const names the eeo schema,
// a demographic column, or a protected attribute. ForbidEEO is the same guard the boot and execution paths
// run; this asserts it at the source so a demographic column can never enter a vendor read.
func TestVendorIntentsNameNoEEO(t *testing.T) {
	for name, sql := range map[string]string{
		"vendor_performance_scorecard": vendorPerformanceScorecardSQL,
		"vendor_quality_distribution":  vendorQualityDistributionSQL,
	} {
		if err := ForbidEEO(sql); err != nil {
			t.Errorf("%s: a vendor read must never name an eeo marker: %v", name, err)
		}
	}
}

// TestBandIsKnown proves the guard that keeps an unexpected band value out of the seeded partition: only the
// three frozen readiness bands are known, so a stray value scanned from the database is ignored rather than
// added as a fourth cell that suppression could not reason about.
func TestBandIsKnown(t *testing.T) {
	for _, b := range []string{"green", "yellow", "red"} {
		if !bandIsKnown(b) {
			t.Errorf("%q is a frozen readiness band and must be known", b)
		}
	}
	for _, b := range []string{"", "blue", "GREEN", "unknown"} {
		if bandIsKnown(b) {
			t.Errorf("%q is not a frozen readiness band and must be ignored", b)
		}
	}
}