package validator

import (
	"strings"
	"testing"
	"time"

	"browser.local/platform/domain"
)

const scumProbeHash = "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"

func TestValidateSCUMSchemaProbeRequestAllowsBoundedGenericProbe(t *testing.T) {
	request := domain.SCUMSchemaProbeRequest{RequestID: "probe-1", JobID: "job-1", Binding: validatorSCUMBinding(), Bounds: domain.DefaultSCUMSchemaProbeBounds(), RequestedAt: time.Now()}

	if err := ValidateSCUMSchemaProbeRequest(request); err != nil {
		t.Fatalf("expected valid probe request, got %v", err)
	}
}

func TestValidateSCUMSchemaProbeRequestRejectsHostPathsAndLooseBounds(t *testing.T) {
	request := domain.SCUMSchemaProbeRequest{RequestID: "probe-1", JobID: "job-1", Binding: validatorSCUMBinding(), Bounds: domain.DefaultSCUMSchemaProbeBounds()}
	request.Binding.DatabaseIdentity = `C:\SCUM\Saved\SaveFiles\SCUM.db`
	request.Bounds.MaxSampleRows = 25

	err := ValidateSCUMSchemaProbeRequest(request)
	if err == nil || !strings.Contains(err.Error(), "protected connection material") || !strings.Contains(err.Error(), "maxSampleRows") {
		t.Fatalf("expected protected material and bound violations, got %v", err)
	}
}

func TestValidateSCUMSchemaProbeResultRejectsRawSQLAndRows(t *testing.T) {
	result := domain.SCUMSchemaProbeResult{
		RequestID:         "probe-1",
		JobID:             "job-1",
		Binding:           validatorSCUMBinding(),
		Status:            domain.SCUMCapabilityEvidenceCompatible,
		SchemaFingerprint: scumProbeHash,
		ObservedAt:        time.Now(),
		ResultDigest:      scumProbeHash,
		Limits:            domain.DefaultSCUMSchemaProbeBounds(),
		Objects: []domain.SCUMSchemaObjectEvidence{{
			ObjectHash:         scumProbeHash,
			Kind:               "table",
			NameFingerprint:    "select * from players",
			DeclaredColumns:    []domain.SCUMSchemaColumnEvidence{{NameFingerprint: scumProbeHash, DeclaredType: "TEXT", Ordinal: 1}},
			SampleFingerprints: []string{"{\"raw\":\"row\"}"},
		}},
	}

	err := ValidateSCUMSchemaProbeResult(result)
	if err == nil || !strings.Contains(err.Error(), "nameFingerprint must be redacted") || !strings.Contains(err.Error(), "sampleFingerprints") {
		t.Fatalf("expected redaction violations, got %v", err)
	}
}

func TestValidateSCUMCapabilityEvidenceRequiresSafeCurrentServiceIdentity(t *testing.T) {
	evidence := domain.SCUMCapabilityEvidence{Capability: domain.SCUMDataCapabilityPlayerRead, Status: domain.SCUMCapabilityEvidenceCompatible, Binding: validatorSCUMBinding(), AdapterVersion: "adapter-1", SchemaFingerprint: scumProbeHash, ProbeResultDigest: scumProbeHash, AssetDigests: []string{scumProbeHash}, SafeError: domain.SCUMSafeError{Code: domain.SCUMSafeErrorNone}}
	if err := ValidateSCUMCapabilityEvidence(evidence); err != nil {
		t.Fatalf("expected valid evidence, got %v", err)
	}

	evidence.SafeError = domain.SCUMSafeError{Code: domain.SCUMSafeErrorProbeFailed, Message: "sqlite:///private/tmp/SCUM.db locked"}
	if err := ValidateSCUMCapabilityEvidence(evidence); err == nil || !strings.Contains(err.Error(), "protected material") {
		t.Fatalf("expected safe error redaction violation, got %v", err)
	}
}

func validatorSCUMBinding() domain.SCUMBindingIdentity {
	return domain.SCUMBindingIdentity{ServerInstanceID: "server-1", RunBindingID: "binding-1", RunEndpointID: "run-1", PluginID: "game.scum", PluginVersion: "0.1.6", AdapterVersion: "adapter-1", GameVersion: "scum-1", DatabaseIdentity: "db-fingerprint-1"}
}