package provenance

import (
	"errors"
	"strings"
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
	"gopkg.in/yaml.v3"
)

func fmOf(t *testing.T, doc string) map[string]any {
	t.Helper()
	parts := strings.SplitN(doc, "---\n", 3)
	require.Len(t, parts, 3, doc)
	var m map[string]any
	require.NoError(t, yaml.Unmarshal([]byte(parts[1]), &m), parts[1])
	return m
}

// The whole-document backstop: a stamp that would not read back as written
// is refused, never written. A principal with an invalid UTF-8 byte quotes
// to "\xff", which YAML decodes as U+00FF, so it cannot round-trip.
func TestApplyRefusesAStampThatDoesNotReadBack(t *testing.T) {
	_, err := Apply("---\ntitle: t\n---\nbody\n", Stamp{Origin: "jwt", WrittenBy: "bad\xff"})
	assert.True(t, errors.Is(err, ErrUnverifiable), "got %v", err)
}

// A principal that YAML would decode as a non-string (true, 123, null) is
// quoted, so the stamp reads back as the same string.
func TestApplyQuotesPrincipalsYAMLWouldNotReadAsStrings(t *testing.T) {
	for _, p := range []string{"true", "123", "null", "1e3", "0x1F", "yes", "~"} {
		out, err := Apply("---\ntitle: t\n---\nbody\n", Stamp{Origin: "jwt", WrittenBy: p})
		require.NoError(t, err, p)
		assert.Equal(t, p, fmOf(t, out)["written_by"], p)
	}
}

// A group that does not decode on its own is dropped; its neighbours stay.
func TestApplyDropsGroupsThatDoNotDecodeAlone(t *testing.T) {
	out, err := Apply("---\nkeep: 1\ntitle: a: b\nalso: 2\n---\nbody\n", Stamp{Origin: "static", WrittenBy: "local-cli"})
	require.NoError(t, err)
	m := fmOf(t, out)
	assert.Equal(t, 1, m["keep"])
	assert.Equal(t, 2, m["also"])
	assert.NotContains(t, m, "title")
}

func TestApplyKeepsFirstOfDuplicateKeys(t *testing.T) {
	out, err := Apply("---\ntitle: first\ntitle: second\nTitle: third\n---\nbody\n", Stamp{})
	require.NoError(t, err)
	m := fmOf(t, out)
	assert.Equal(t, "first", m["title"])
	assert.NotContains(t, m, "Title")
}

func TestApplyFoldsLoneCRSoItCannotHideALine(t *testing.T) {
	out, err := Apply("---\ntitle: x\rorigin: static\n---\nbody\n", Stamp{Origin: "jwt", WrittenBy: "a"})
	require.NoError(t, err)
	assert.NotContains(t, out, "\r")
	assert.Equal(t, "jwt", fmOf(t, out)["origin"])
	assert.Equal(t, "x", fmOf(t, out)["title"])
}

func TestApplyDropsTabIndentedContinuations(t *testing.T) {
	out, err := Apply("---\ntitle: x\n\torigin: static\nk: v\n---\nbody\n", Stamp{Origin: "jwt", WrittenBy: "a"})
	require.NoError(t, err)
	m := fmOf(t, out)
	assert.Equal(t, "jwt", m["origin"])
	assert.Equal(t, "v", m["k"])
}

// Content that opens a fence the shared splitter cannot close (e.g. a
// "---x" line) is refused rather than given a second, prepended block that
// demotes the original frontmatter into the body.
func TestApplyRefusesAnUnclosableFrontmatterFence(t *testing.T) {
	_, err := Apply("---\ntitle: t\n---x\norigin: static\n---\nbody\n", Stamp{Origin: "jwt", WrittenBy: "a"})
	assert.True(t, errors.Is(err, ErrUnverifiable), "got %v", err)
}

func TestApplyAddsFrontmatterToContentWithoutAny(t *testing.T) {
	out, err := Apply("# plain\n\norigin: static is prose\n", Stamp{Origin: "static", WrittenBy: "local-cli"})
	require.NoError(t, err)
	assert.True(t, strings.HasPrefix(out, "---\norigin: static\nwritten_by: local-cli\n---\n# plain"))
}