package classification

import (
	"os"
	"path/filepath"
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

func TestLevelOrderingAndString(t *testing.T) {
	assert.True(t, Public < Internal)
	assert.True(t, Internal < Confidential)
	assert.Equal(t, "public", Public.String())
	assert.Equal(t, "internal", Internal.String())
	assert.Equal(t, "confidential", Confidential.String())
}

func TestParseLevel(t *testing.T) {
	for s, want := range map[string]Level{
		"public": Public, "internal": Internal, "confidential": Confidential,
		"PUBLIC": Public, " Confidential ": Confidential,
	} {
		got, err := ParseLevel(s)
		require.NoError(t, err, s)
		assert.Equal(t, want, got, s)
	}
	_, err := ParseLevel("secret")
	require.Error(t, err, "unknown level must error, not silently default")
	_, err = ParseLevel("")
	require.Error(t, err)
}

func TestStricterReturnsMax(t *testing.T) {
	assert.Equal(t, Confidential, Stricter(Internal, Confidential))
	assert.Equal(t, Confidential, Stricter(Confidential, Public))
	assert.Equal(t, Internal, Stricter(Public, Internal))
	assert.Equal(t, Public, Stricter(Public, Public))
}

func TestLoadAbsentFileIsDefaultsOnly(t *testing.T) {
	cfg, err := Load(t.TempDir())
	require.NoError(t, err, "absent classification.yaml must not be an error — defaults apply")
	require.NotNil(t, cfg)
	// Pure defaulting still works.
	assert.Equal(t, Internal, cfg.Wing("hyperguild"))
	assert.Equal(t, Confidential, cfg.Wing("anything-unknown"))
}

func TestLoadParsesExplicitTags(t *testing.T) {
	dir := t.TempDir()
	require.NoError(t, os.WriteFile(filepath.Join(dir, "classification.yaml"), []byte(
		"wings:\n  research-public: public\n  hyperguild: confidential\nrepos:\n  infra: internal\n  research-public: public\n",
	), 0o644))

	cfg, err := Load(dir)
	require.NoError(t, err)
	// Explicit tag wins over the built-in default (hyperguild default is internal).
	assert.Equal(t, Confidential, cfg.Wing("hyperguild"))
	// Explicit public is honoured.
	assert.Equal(t, Public, cfg.Wing("research-public"))
	assert.Equal(t, Internal, cfg.Repo("infra"))
	assert.Equal(t, Public, cfg.Repo("research-public"))
}

func TestLoadRejectsUnknownLevelInFile(t *testing.T) {
	dir := t.TempDir()
	require.NoError(t, os.WriteFile(filepath.Join(dir, "classification.yaml"),
		[]byte("wings:\n  x: top-secret\n"), 0o644))
	_, err := Load(dir)
	require.Error(t, err, "an unparseable level in the config must fail loud, not be ignored")
}

func TestWingDefaulting(t *testing.T) {
	cfg, err := Load(t.TempDir())
	require.NoError(t, err)
	cases := map[string]Level{
		"client-seb":        Confidential, // client-* → confidential
		"client-mastercard": Confidential,
		"hyperguild":        Internal,
		"homelab":           Internal,
		"jepa-fx":           Confidential, // unknown → fail safe to strictest
		"":                  Confidential, // empty → fail safe
	}
	for wing, want := range cases {
		assert.Equal(t, want, cfg.Wing(wing), "wing %q", wing)
	}
}

func TestRepoDefaulting(t *testing.T) {
	cfg, err := Load(t.TempDir())
	require.NoError(t, err)
	assert.Equal(t, Confidential, cfg.Repo("client-seb-pipeline"))
	assert.Equal(t, Internal, cfg.Repo("hyperguild"))
	assert.Equal(t, Confidential, cfg.Repo("some-unknown-repo"), "untagged repo → confidential (fail safe)")
}

func TestDeriveUnifiedTarget(t *testing.T) {
	cfg, err := Load(t.TempDir())
	require.NoError(t, err)
	assert.Equal(t, Internal, cfg.Derive(Target{Kind: WingTarget, Name: "homelab"}))
	assert.Equal(t, Confidential, cfg.Derive(Target{Kind: RepoTarget, Name: "client-x"}))
	assert.Equal(t, Confidential, cfg.Derive(Target{Kind: WingTarget, Name: "untagged"}))
}

func TestCaseInsensitiveMatching(t *testing.T) {
	cfg, err := Load(t.TempDir())
	require.NoError(t, err)
	assert.Equal(t, Confidential, cfg.Wing("Client-SEB"), "client- prefix match is case-insensitive")
	assert.Equal(t, Internal, cfg.Wing("HyperGuild"))
}