package protocol

import (
	"strings"
	"testing"
)

func TestValidateRunJobAssignmentScopedFilePayloads(t *testing.T) {
	assignment := RunJobAssignment{
		JobID:            "job-config-write",
		ServerInstanceID: "server-1",
		RunEndpointID:    "run-local",
		Capability:       RunCapabilityConfigWrite,
		TargetKey:        "server.properties",
		InputRef:         "input://server-config/server-1/server.properties/v1",
		IdempotencyKey:   "idem-config",
	}
	if err := ValidateRunJobAssignment(assignment); err != nil {
		t.Fatalf("expected valid config write assignment: %v", err)
	}

	assignment.TargetKey = "/Users/tasia/server.properties"
	if err := ValidateRunJobAssignment(assignment); err == nil || !strings.Contains(err.Error(), "targetKey") {
		t.Fatalf("expected raw host path rejection, got %v", err)
	}

	assignment.TargetKey = "server.properties"
	assignment.InputRef = "sk-raw-secret"
	if err := ValidateRunJobAssignment(assignment); err == nil || !strings.Contains(err.Error(), "inputRef") {
		t.Fatalf("expected raw credential ref rejection, got %v", err)
	}
}

func TestValidateRunJobAssignmentScopedReadDoesNotRequireInputRef(t *testing.T) {
	assignment := RunJobAssignment{
		JobID:            "job-files-read",
		ServerInstanceID: "server-1",
		RunEndpointID:    "run-local",
		Capability:       RunCapabilityFilesRead,
		TargetKey:        "logs/latest.log",
		IdempotencyKey:   "idem-read",
	}
	if err := ValidateRunJobAssignment(assignment); err != nil {
		t.Fatalf("expected valid file read assignment: %v", err)
	}
}

func TestValidateRunJobAssignmentRemoteCapabilitiesAreBounded(t *testing.T) {
	assignment := RunJobAssignment{
		JobID:            "job-remote-rcon",
		ServerInstanceID: "server-1",
		RunEndpointID:    "run-local",
		Capability:       RunCapabilityRemoteRunRCONCommand,
		TargetKey:        "rcon/command",
		InputRef:         "input://server-1/rcon/command/1",
		IdempotencyKey:   "idem-rcon",
	}
	if err := ValidateRunJobAssignment(assignment); err != nil {
		t.Fatalf("expected valid remote rcon assignment: %v", err)
	}

	assignment.InputRef = "password=raw"
	if err := ValidateRunJobAssignment(assignment); err == nil || !strings.Contains(err.Error(), "inputRef") {
		t.Fatalf("expected unsafe inputRef rejection, got %v", err)
	}

	assignment.InputRef = "input://server-1/rcon/command/1"
	assignment.TargetKey = "/Users/tasia/server.db"
	if err := ValidateRunJobAssignment(assignment); err == nil || !strings.Contains(err.Error(), "targetKey") {
		t.Fatalf("expected unsafe targetKey rejection, got %v", err)
	}
}

func TestValidateRunJobAssignmentDistributionCapabilitiesAreBounded(t *testing.T) {
	selfUpdate := RunJobAssignment{
		JobID:            "job-update",
		ServerInstanceID: "server-1",
		RunEndpointID:    "run-local",
		Capability:       RunCapabilityRunSelfUpdate,
		TargetKey:        "run/update",
		InputRef:         "artifact://artifact-run-latest",
		IdempotencyKey:   "idem-update",
	}
	if err := ValidateRunJobAssignment(selfUpdate); err != nil {
		t.Fatalf("expected valid self-update assignment: %v", err)
	}
	selfUpdate.InputRef = "input://not-an-artifact"
	if err := ValidateRunJobAssignment(selfUpdate); err == nil || !strings.Contains(err.Error(), "artifact") {
		t.Fatalf("expected non-artifact self-update ref rejection, got %v", err)
	}

	check := RunJobAssignment{
		JobID:            "job-dependency-check",
		ServerInstanceID: "server-1",
		RunEndpointID:    "run-local",
		Capability:       RunCapabilityDependenciesCheck,
		TargetKey:        "dependencies/java-21",
		IdempotencyKey:   "idem-dep-check",
	}
	if err := ValidateRunJobAssignment(check); err != nil {
		t.Fatalf("expected valid dependency check assignment: %v", err)
	}
	check.TargetKey = "dependencies/install/java;rm"
	if err := ValidateRunJobAssignment(check); err == nil || !strings.Contains(err.Error(), "targetKey") {
		t.Fatalf("expected shell-like dependency target rejection, got %v", err)
	}

	backfill := RunJobAssignment{
		JobID:            "job-log-backfill",
		ServerInstanceID: "server-1",
		RunEndpointID:    "run-local",
		Capability:       RunCapabilityLogsBackfill,
		TargetKey:        "logs/latest-log",
		InputRef:         "artifact://logs/checkpoint/1",
		IdempotencyKey:   "idem-log-backfill",
	}
	if err := ValidateRunJobAssignment(backfill); err != nil {
		t.Fatalf("expected valid log backfill assignment: %v", err)
	}
	backfill.InputRef = "password=raw"
	if err := ValidateRunJobAssignment(backfill); err == nil || !strings.Contains(err.Error(), "inputRef") {
		t.Fatalf("expected unsafe log checkpoint rejection, got %v", err)
	}
}