"""Bounty report lifecycle: intake → assign → owner verdict → triage →
severity → reward → payment → close.

These tests pin the invariants that make the domain safe to operate:

* the three axes cannot be driven into an inconsistent combination,
* money cannot be promised without a severity, nor stranded by a close,
* the business owner cannot set a triage status or a risk decision,
* the report code is unique and sequential.
"""
from __future__ import annotations

from datetime import UTC, datetime, timedelta
from decimal import Decimal

import pytest

from app.core.exceptions import AppException, ValidationError
from app.domains.bounty import config_service as cfg
from app.domains.bounty import constants as const
from app.domains.bounty import service as svc


async def _person(db_session, *, email: str, name: str):
    import uuid as _uuid

    from app.identity.person_models import IdentityPerson

    person = IdentityPerson(
        id=_uuid.uuid4(), work_email=email, display_name=name,
        employment_status="active", source_system="successfactors",
        hris_person_id=f"sf-{email.split('@')[0]}",
    )
    db_session.add(person)
    await db_session.flush()
    return person


async def _report(db_session, actor=None, **kwargs):
    payload = {
        "title": "反射型 XSS on docs site",
        "researcher_email": "whitehat@example.com",
        "affected_system": "docs.pingcap.com",
        "raw_report": "There is an XSS at /search?q=<script>",
    }
    payload.update(kwargs)
    return await svc.create_report(db_session, actor=actor, **payload)


@pytest.mark.asyncio
async def test_create_report_assigns_sequential_codes(db_session):
    first = await _report(db_session)
    second = await _report(db_session, title="第二个报告")
    year = datetime.now(UTC).year
    assert first.code == f"BB-{year}-001"
    assert second.code == f"BB-{year}-002"
    # Both reports share one researcher row, keyed on the lowercased email.
    assert first.researcher_id == second.researcher_id


@pytest.mark.asyncio
async def test_researcher_email_is_normalized_and_validated(db_session):
    report = await _report(db_session, researcher_email="  MiXeD@Example.COM ")
    researcher = await svc.get_researcher(db_session, report.researcher_id)
    assert researcher.email == "mixed@example.com"

    with pytest.raises(ValidationError):
        await _report(db_session, researcher_email="not-an-email")

    with pytest.raises(ValidationError, match="too long"):
        svc.normalize_email(f"{'a' * 321}@example.com")

    for invalid in ("a@@example.com", "a@.example.com", "a@example.com."):
        with pytest.raises(ValidationError):
            svc.normalize_email(invalid)


@pytest.mark.asyncio
async def test_create_report_records_a_creation_event(db_session):
    report = await _report(db_session)
    events = await svc.list_events(db_session, report.id, internal=True)
    assert [e.event_type for e in events] == [const.EVENT_CREATED]
    # Creation is internal — the assignee has no business seeing intake
    # bookkeeping before they are even assigned.
    shared = await svc.list_events(db_session, report.id, internal=False)
    assert shared == []


@pytest.mark.asyncio
async def test_assign_snapshots_owner_and_moves_to_awaiting_owner(db_session):
    report = await _report(db_session)
    owner = await _person(db_session, email="owner@test.com", name="Owner One")
    loaded = await svc.load_assignable_person(db_session, owner.id)
    await svc.assign_report(
        db_session, report, person=loaded, note="你的服务", actor=None,
    )
    assert report.status == const.STATUS_AWAITING_OWNER
    assert report.assignee_person_id == owner.id
    assert report.assignee_name == "Owner One"
    # The assignment event is shared so the owner sees why it landed
    # on their desk.
    shared = await svc.list_events(db_session, report.id, internal=False)
    assert [e.event_type for e in shared] == [const.EVENT_ASSIGNED]


@pytest.mark.asyncio
async def test_reassignment_clears_the_previous_owner_verdict(db_session):
    report = await _report(db_session)
    first = await svc.load_assignable_person(
        db_session, (await _person(db_session, email="a@test.com", name="A")).id,
    )
    await svc.assign_report(db_session, report, person=first, note=None, actor=None)
    await svc.record_owner_response(
        db_session, report, decision=const.OWNER_DECISION_VALID, note="是真的",
        suggested_severity=None, fix_eta=None, remediation_status=None, actor=None,
    )
    assert report.owner_decision == const.OWNER_DECISION_VALID

    second = await svc.load_assignable_person(
        db_session, (await _person(db_session, email="b@test.com", name="B")).id,
    )
    await svc.assign_report(db_session, report, person=second, note=None, actor=None)
    # A verdict attributed to someone who no longer owns the report is a
    # lie on the console — it must be cleared, not carried over.
    assert report.owner_decision is None
    assert report.owner_responded_at is None


@pytest.mark.asyncio
async def test_inactive_person_cannot_be_assigned(db_session):
    await _report(db_session)
    person = await _person(db_session, email="future@test.com", name="Pre Hire")
    # ``pre_hire`` rather than ``left``: flipping a person TO ``left``
    # trips the LeaverBlocked before-flush listener, which is unrelated
    # to what this test is about (and deadlocks on a shared test DB).
    # A not-yet-started hire is an equally real "cannot own this" case.
    person.employment_status = "pre_hire"
    await db_session.flush()
    with pytest.raises(AppException) as exc:
        await svc.load_assignable_person(db_session, person.id)
    assert exc.value.code == "BOUNTY_ASSIGNEE_INACTIVE"


@pytest.mark.asyncio
async def test_owner_response_parks_in_discussion_not_a_verdict(db_session):
    report = await _report(db_session)
    owner = await svc.load_assignable_person(
        db_session, (await _person(db_session, email="o@test.com", name="O")).id,
    )
    await svc.assign_report(db_session, report, person=owner, note=None, actor=None)
    await svc.record_owner_response(
        db_session, report, decision=const.OWNER_DECISION_FALSE_POSITIVE,
        note="这是设计如此", suggested_severity=None, fix_eta=None,
        remediation_status=None, actor=None,
    )
    # The owner said "false positive" — the report is NOT closed as one.
    # Scope and payout are the security team's call.
    assert report.status == const.STATUS_IN_DISCUSSION
    assert report.owner_decision == const.OWNER_DECISION_FALSE_POSITIVE


@pytest.mark.asyncio
async def test_owner_valid_verdict_starts_the_remediation_clock(db_session):
    report = await _report(db_session)
    owner = await svc.load_assignable_person(
        db_session, (await _person(db_session, email="o2@test.com", name="O2")).id,
    )
    await svc.assign_report(db_session, report, person=owner, note=None, actor=None)
    eta = (datetime.now(UTC) + timedelta(days=10)).date()
    await svc.record_owner_response(
        db_session, report, decision=const.OWNER_DECISION_VALID, note=None,
        suggested_severity="medium", fix_eta=eta, remediation_status=None,
        actor=None,
    )
    assert report.remediation_status == const.REMEDIATION_PENDING
    assert report.fix_eta == eta
    assert report.suggested_severity == "medium"


@pytest.mark.asyncio
async def test_owner_cannot_set_a_risk_decision(db_session):
    report = await _report(db_session)
    with pytest.raises(ValidationError):
        await svc.record_owner_response(
            db_session, report, decision=const.OWNER_DECISION_VALID, note=None,
            suggested_severity=None, fix_eta=None,
            remediation_status=const.REMEDIATION_RISK_ACCEPTED, actor=None,
        )


@pytest.mark.asyncio
async def test_confirm_requires_a_severity(db_session):
    report = await _report(db_session)
    with pytest.raises(AppException) as exc:
        await svc.set_status(
            db_session, report, target=const.STATUS_CONFIRMED, note=None,
            actor=None,
        )
    assert exc.value.code == "BOUNTY_SEVERITY_REQUIRED"


@pytest.mark.asyncio
async def test_severity_stamps_sla_from_report_date_and_pulls_default_reward(
    db_session,
):
    reported = datetime.now(UTC) - timedelta(days=5)
    report = await _report(db_session, reported_at=reported)
    await svc.set_severity(
        db_session, report, severity="low", note=None,
        apply_default_reward=True, actor=None,
    )
    tier = await cfg.get_tier(db_session, "low")
    # SLA is anchored on arrival, not on triage day: a slow triage must
    # not silently buy the fix more time.
    assert report.fix_due_date == (reported.replace(tzinfo=None)
                                   + timedelta(days=tier.fix_sla_days)).date()
    assert Decimal(str(report.reward_amount_usd)) == Decimal("100.00")
    assert report.reward_is_override is False
    assert report.payment_status == const.PAYMENT_PENDING
    assert report.fiscal_year is not None


@pytest.mark.asyncio
async def test_informational_severity_owes_no_money(db_session):
    report = await _report(db_session)
    await svc.set_severity(
        db_session, report, severity="informational", note=None,
        apply_default_reward=True, actor=None,
    )
    assert Decimal(str(report.reward_amount_usd)) == Decimal("0.00")
    # A zero reward is "nothing owed", not "payment pending".
    assert report.payment_status == const.PAYMENT_NOT_APPLICABLE
    assert report.fix_due_date is None


@pytest.mark.asyncio
async def test_reward_override_is_flagged_and_capped_by_tier(db_session):
    report = await _report(db_session)
    await svc.set_severity(
        db_session, report, severity="low", note=None,
        apply_default_reward=True, actor=None,
    )
    await svc.set_reward(
        db_session, report, amount=Decimal("250"), note="影响面更大", actor=None,
    )
    assert report.reward_is_override is True

    with pytest.raises(AppException) as exc:
        await svc.set_reward(
            db_session, report, amount=Decimal("400"), note=None, actor=None,
        )
    assert exc.value.code == "BOUNTY_REWARD_ABOVE_TIER_CAP"


@pytest.mark.asyncio
async def test_reward_requires_severity_first(db_session):
    report = await _report(db_session)
    with pytest.raises(AppException) as exc:
        await svc.set_reward(
            db_session, report, amount=Decimal("100"), note=None, actor=None,
        )
    assert exc.value.code == "BOUNTY_SEVERITY_REQUIRED"


@pytest.mark.asyncio
async def test_payment_requires_confirmed_status_and_a_positive_reward(db_session):
    report = await _report(db_session)
    await svc.set_severity(
        db_session, report, severity="low", note=None,
        apply_default_reward=True, actor=None,
    )
    # Severity is set but the report is not confirmed yet.
    with pytest.raises(AppException) as exc:
        await svc.set_payment_status(
            db_session, report, target=const.PAYMENT_REQUESTED, reference=None,
            note=None, paid_at=None, actor=None,
        )
    assert exc.value.code == "BOUNTY_NOT_CONFIRMED"

    await svc.set_status(
        db_session, report, target=const.STATUS_CONFIRMED, note=None, actor=None,
    )
    await svc.set_payment_status(
        db_session, report, target=const.PAYMENT_REQUESTED, reference="PO-1",
        note=None, paid_at=None, actor=None,
    )
    assert report.payment_requested_at is not None
    await svc.set_payment_status(
        db_session, report, target=const.PAYMENT_PAID, reference="PO-1",
        note="已打款", paid_at=None, actor=None,
    )
    assert report.paid_at is not None


@pytest.mark.asyncio
async def test_paid_report_cannot_change_amount_or_be_deleted(db_session):
    report = await _report(db_session)
    await svc.set_severity(
        db_session, report, severity="low", note=None,
        apply_default_reward=True, actor=None,
    )
    await svc.set_status(
        db_session, report, target=const.STATUS_CONFIRMED, note=None, actor=None,
    )
    await svc.set_payment_status(
        db_session, report, target=const.PAYMENT_PAID, reference=None, note=None,
        paid_at=None, actor=None,
    )
    with pytest.raises(AppException) as exc:
        await svc.set_reward(
            db_session, report, amount=Decimal("200"), note=None, actor=None,
        )
    assert exc.value.code == "BOUNTY_ALREADY_PAID"

    with pytest.raises(AppException) as exc:
        await svc.soft_delete_report(db_session, report, actor=None, reason=None)
    assert exc.value.code == "BOUNTY_REPORT_PAID"


@pytest.mark.asyncio
async def test_close_refuses_to_strand_an_open_payment(db_session):
    report = await _report(db_session)
    await svc.set_severity(
        db_session, report, severity="low", note=None,
        apply_default_reward=True, actor=None,
    )
    await svc.set_status(
        db_session, report, target=const.STATUS_CONFIRMED, note=None, actor=None,
    )
    assert report.payment_status == const.PAYMENT_PENDING

    with pytest.raises(AppException) as exc:
        await svc.set_status(
            db_session, report, target=const.STATUS_CLOSED, note=None, actor=None,
        )
    assert exc.value.code == "BOUNTY_PAYMENT_OPEN"

    # Waiving the bounty is the explicit way out.
    await svc.set_payment_status(
        db_session, report, target=const.PAYMENT_WAIVED, reference=None,
        note="研究者放弃", paid_at=None, actor=None,
    )
    await svc.set_status(
        db_session, report, target=const.STATUS_CLOSED, note=None, actor=None,
    )
    assert report.status == const.STATUS_CLOSED
    assert report.closed_at is not None


@pytest.mark.asyncio
async def test_rejecting_a_report_releases_committed_money(db_session):
    report = await _report(db_session)
    await svc.set_severity(
        db_session, report, severity="medium", note=None,
        apply_default_reward=True, actor=None,
    )
    assert report.payment_status == const.PAYMENT_PENDING
    await svc.set_status(
        db_session, report, target=const.STATUS_DUPLICATE, note="我们已在处理",
        # A duplicate now has to say what it duplicates — this test is
        # about the money being released, so give it the referent the
        # real flow would carry rather than weakening the guard.
        duplicate_note="内部 issue,早于本次提交",
        actor=None,
    )
    # A duplicate owes nothing: the pending commitment must leave the
    # budget, or the burn chart keeps reserving money for a rejection.
    assert report.payment_status == const.PAYMENT_NOT_APPLICABLE
    assert report.remediation_status == const.REMEDIATION_NOT_APPLICABLE


@pytest.mark.asyncio
async def test_invalid_status_transition_is_refused(db_session):
    report = await _report(db_session)
    await svc.set_severity(
        db_session, report, severity="low", note=None,
        apply_default_reward=False, actor=None,
    )
    await svc.set_status(
        db_session, report, target=const.STATUS_CONFIRMED, note=None, actor=None,
    )
    # confirmed → out_of_scope is not a legal edge: a finding we already
    # accepted cannot be re-labelled "not in scope" without reopening.
    with pytest.raises(AppException) as exc:
        await svc.set_status(
            db_session, report, target=const.STATUS_OUT_OF_SCOPE, note=None,
            actor=None,
        )
    assert exc.value.code == "BOUNTY_INVALID_TRANSITION"


@pytest.mark.asyncio
async def test_invalid_payment_transition_is_refused(db_session):
    report = await _report(db_session)
    with pytest.raises(AppException) as exc:
        await svc.set_payment_status(
            db_session, report, target=const.PAYMENT_PAID, reference=None,
            note=None, paid_at=None, actor=None,
        )
    assert exc.value.code == "BOUNTY_INVALID_PAYMENT_TRANSITION"


@pytest.mark.asyncio
async def test_remediation_reopen_clears_the_fixed_stamp(db_session):
    report = await _report(db_session)
    await svc.set_remediation(
        db_session, report, target=const.REMEDIATION_FIXED, note=None,
        fix_eta=None, actor=None,
    )
    assert report.fixed_at is not None
    await svc.set_remediation(
        db_session, report, target=const.REMEDIATION_IN_PROGRESS, note="回归了",
        fix_eta=None, actor=None,
    )
    # Otherwise "average time to fix" keeps crediting the first attempt.
    assert report.fixed_at is None


@pytest.mark.asyncio
async def test_nudge_is_throttled(db_session):
    report = await _report(db_session)
    owner = await svc.load_assignable_person(
        db_session, (await _person(db_session, email="n@test.com", name="N")).id,
    )
    await svc.assign_report(db_session, report, person=owner, note=None, actor=None)
    await svc.record_nudge(db_session, report, actor=None)
    with pytest.raises(AppException) as exc:
        await svc.record_nudge(db_session, report, actor=None)
    assert exc.value.code == "BOUNTY_NUDGE_THROTTLED"


@pytest.mark.asyncio
async def test_assignment_blocked_on_a_terminal_report(db_session):
    report = await _report(db_session)
    await svc.set_status(
        db_session, report, target=const.STATUS_OUT_OF_SCOPE, note=None,
        actor=None,
    )
    owner = await svc.load_assignable_person(
        db_session, (await _person(db_session, email="t@test.com", name="T")).id,
    )
    with pytest.raises(AppException) as exc:
        await svc.assign_report(
            db_session, report, person=owner, note=None, actor=None,
        )
    assert exc.value.code == "BOUNTY_REPORT_TERMINAL"


@pytest.mark.asyncio
async def test_update_report_cannot_touch_state_columns(db_session):
    report = await _report(db_session)
    await svc.update_report(
        db_session, report,
        patch={"status": const.STATUS_CONFIRMED, "reward_amount_usd": 999},
        actor=None,
    )
    # The state machines are the only way in; an unknown key in the patch
    # is ignored rather than applied.
    assert report.status == const.STATUS_NEW
    assert report.reward_amount_usd is None

@pytest.mark.asyncio
async def test_confirming_starts_the_fix_clock(db_session):
    """Accepting a finding must make it visible to the fix worklist.

    ``not_applicable`` is in ``REMEDIATION_SETTLED``, so a confirmed report
    left in that state has a stamped SLA deadline that nothing watches —
    it drops out of the overdue counter, the owner's "fix outstanding"
    count and the remediation report. Regression for a real gap found
    while writing the SLA report (2026-08-24).
    """
    report = await _report(db_session)
    await svc.set_severity(
        db_session, report, severity="medium", note=None,
        apply_default_reward=True, actor=None,
    )
    assert report.remediation_status == const.REMEDIATION_NOT_APPLICABLE
    await svc.set_status(
        db_session, report, target=const.STATUS_CONFIRMED, note=None,
        actor=None,
    )
    assert report.remediation_status == const.REMEDIATION_PENDING
    assert report.fix_due_date is not None

    # An owner who already reported progress is not reset back to pending.
    await svc.set_remediation(
        db_session, report, target=const.REMEDIATION_IN_PROGRESS, note=None,
        fix_eta=None, actor=None,
    )
    await svc.set_status(
        db_session, report, target=const.STATUS_IN_DISCUSSION, note=None,
        actor=None,
    )
    await svc.set_status(
        db_session, report, target=const.STATUS_CONFIRMED, note=None,
        actor=None,
    )
    assert report.remediation_status == const.REMEDIATION_IN_PROGRESS


# ── Duplicate: WHICH report does it duplicate? ──────────────────────


@pytest.mark.asyncio
async def test_duplicate_requires_a_referent(db_session):
    """"Duplicate" with nothing to point at is the dead end this
    replaces — and it is exactly what a researcher disputed in
    production ("please confirm when the duplicate was received")."""
    report = await svc.create_report(
        db_session, title="dup-a", researcher_email="w1@example.com",
        actor=None,
    )
    with pytest.raises(AppException) as exc:
        await svc.set_status(
            db_session, report, target="duplicate", note=None, actor=None,
        )
    assert exc.value.code == "BOUNTY_DUPLICATE_REFERENCE_REQUIRED"


@pytest.mark.asyncio
async def test_duplicate_of_another_report(db_session):
    original = await svc.create_report(
        db_session, title="original", researcher_email="w2@example.com",
        actor=None,
    )
    later = await svc.create_report(
        db_session, title="later", researcher_email="w3@example.com",
        actor=None,
    )
    await svc.set_status(
        db_session, later, target="duplicate", note=None, actor=None,
        duplicate_of_id=original.id,
    )
    assert later.duplicate_of_id == original.id

    # The referent is on the timeline too — "why was mine rejected" is
    # asked months later, and the answer belongs at the decision.
    events = await svc.list_events(db_session, later.id, internal=True)
    changed = next(
        e for e in events if e.meta and e.meta.get("to") == "duplicate"
    )
    assert changed.meta["duplicate_of_code"] == original.code


@pytest.mark.asyncio
async def test_duplicate_of_something_outside_helix(db_session):
    """The common case: the original is an internal issue or an email
    that predates this domain. Free text has to be enough, or operators
    leave the field empty and we are back where we started."""
    report = await svc.create_report(
        db_session, title="dup-ext", researcher_email="w4@example.com",
        actor=None,
    )
    await svc.set_status(
        db_session, report, target="duplicate", note=None, actor=None,
        duplicate_note="内部 Issue #1681,commit b126294b,早 7 小时 47 分",
    )
    assert report.duplicate_of_id is None
    assert "#1681" in report.duplicate_note


@pytest.mark.asyncio
async def test_a_report_cannot_duplicate_itself_or_form_a_cycle(db_session):
    a = await svc.create_report(
        db_session, title="cyc-a", researcher_email="w5@example.com",
        actor=None,
    )
    b = await svc.create_report(
        db_session, title="cyc-b", researcher_email="w6@example.com",
        actor=None,
    )
    with pytest.raises(ValidationError):
        await svc.set_status(
            db_session, a, target="duplicate", note=None, actor=None,
            duplicate_of_id=a.id,
        )
    await svc.set_status(
        db_session, b, target="duplicate", note=None, actor=None,
        duplicate_of_id=a.id,
    )
    # A → B while B → A makes "which is the original" unanswerable in
    # both directions, which is the entire point of the field.
    with pytest.raises(AppException) as exc:
        await svc.set_status(
            db_session, a, target="duplicate", note=None, actor=None,
            duplicate_of_id=b.id,
        )
    assert exc.value.code == "BOUNTY_DUPLICATE_CYCLE"


@pytest.mark.asyncio
async def test_leaving_the_duplicate_verdict_drops_the_pointer(db_session):
    original = await svc.create_report(
        db_session, title="orig-2", researcher_email="w7@example.com",
        actor=None,
    )
    later = await svc.create_report(
        db_session, title="later-2", researcher_email="w8@example.com",
        actor=None,
    )
    await svc.set_status(
        db_session, later, target="duplicate", note=None, actor=None,
        duplicate_of_id=original.id,
    )
    # Re-opened and then accepted: a stale "duplicate of BB-x" on a
    # report we ended up paying for is a contradiction a researcher
    # would quote back at us.
    await svc.set_status(
        db_session, later, target="in_discussion", note=None, actor=None,
    )
    assert later.duplicate_of_id is None
    assert later.duplicate_note is None


@pytest.mark.asyncio
async def test_the_duplicate_letter_names_the_referent_not_a_cve(db_session):
    """The shipped template used to say "related to {cve_id}" — most
    duplicates have no CVE, so the letter read "related to ,"."""
    report = await svc.create_report(
        db_session, title="letter", researcher_email="w9@example.com",
        actor=None,
    )
    await svc.set_status(
        db_session, report, target="duplicate", note=None, actor=None,
        duplicate_note="an internal issue opened 2026-05-20",
    )
    rendered, _template = await svc.preview_reply(
        db_session, report, template_key="duplicate_known",
    )
    assert "an internal issue opened 2026-05-20" in rendered.body
    assert "{cve_id}" not in rendered.body
    assert " ()" not in rendered.body


async def test_the_letter_to_preselect_is_decided_server_side(db_session):
    """The console must not re-derive which letter to offer.

    It used to, from two maps in ``meta``, and those maps have no entry for
    ``confirmed`` — so a confirmed-but-ungraded report fell through to "the
    letter for a NEW report". That is the same letter as "under evaluation"
    today, and a silently wrong one the moment acknowledging receipt and
    "we are evaluating" become two letters, which is an entirely ordinary
    edit to make. The decision now ships on the report.
    """
    from app.domains.bounty import catalog
    from app.domains.bounty.serializers import serialize_report

    report = await svc.create_report(
        db_session, title="preselect", researcher_email="p@example.com",
        actor=None,
    )
    await db_session.flush()

    def _key() -> str | None:
        return serialize_report(
            report, tiers={}, include_sensitive=False,
        )["suggested_template_key"]

    assert _key() == catalog.suggested_template("new", None)

    report.status = const.STATUS_CONFIRMED
    confirmed_ungraded = _key()
    assert confirmed_ungraded == "under_evaluation", (
        "a confirmed report with no grade has no honest reward letter yet"
    )

    report.severity = "critical"
    # Direct write, so mirror what ``set_severity`` does: a level a person
    # chose is not the arrival default.
    report.severity_is_default = False
    graded = _key()
    assert graded == catalog.SUGGESTED_TEMPLATE_BY_SEVERITY["critical"]
    assert graded != confirmed_ungraded, (
        "the tier must decide which letter is offered — one shared "
        "'confirmed' letter is how a critical finding got told it was "
        "low-impact"
    )


async def test_a_new_report_arrives_graded_at_the_lowest_tier(db_session):
    """「级别默认初级 不要让人再选了」. Grading gated everything downstream —
    reward tier, fix deadline, reply letter — so 130 reports could not move
    until somebody picked a level, which is why the queue never drained.
    """
    report = await svc.create_report(
        db_session, title="arrives graded",
        researcher_email="d1@example.com", actor=None,
    )
    await db_session.flush()

    assert report.severity == "informational", (
        "the lowest tier: $0 and no fix deadline, so arriving there "
        "commits nothing"
    )
    assert report.severity_is_default is True
    assert report.reward_amount_usd is None, (
        "arriving at a tier must not attach that tier's money"
    )
    assert report.fix_due_date is None


async def test_a_defaulted_level_never_picks_the_reward_letter(db_session):
    """The reason the flag exists. A critical finding nobody has graded
    would otherwise be offered the $0 informational reward letter, and a
    reward stated to a researcher cannot be taken back."""
    from app.domains.bounty.serializers import serialize_report

    report = await svc.create_report(
        db_session, title="not really informational",
        researcher_email="d2@example.com", actor=None,
    )
    report.status = const.STATUS_CONFIRMED
    await db_session.flush()

    # The desk sees the placeholder, because the desk is who replaces it.
    desk = serialize_report(report, tiers={}, include_sensitive=True)
    assert desk["severity"] == "informational"
    assert desk["severity_is_default"] is True
    assert desk["suggested_template_key"] == "under_evaluation", (
        "still 'under evaluation' — nobody has decided what this is worth"
    )

    # Everyone else sees that no judgement exists. Rendering the bottom of
    # the ladder to an owner states a fact nobody established — in
    # production that put 「告知」 on a 7,735-record PII leak in front of
    # the person being asked to fix it.
    owner = serialize_report(report, tiers={}, include_sensitive=False)
    assert owner["severity"] is None
    assert owner["severity_label"] is None
    assert owner["severity_is_default"] is True
    assert owner["suggested_template_key"] == "under_evaluation"


async def test_grading_it_clears_the_default_and_unlocks_the_letter(
    db_session,
):
    from app.domains.bounty.serializers import serialize_report

    report = await svc.create_report(
        db_session, title="graded for real",
        researcher_email="d3@example.com", actor=None,
    )
    await svc.set_severity(
        db_session, report, severity="high", note=None,
        apply_default_reward=True, actor=None,
    )
    await db_session.flush()

    assert report.severity_is_default is False
    payload = serialize_report(report, tiers={}, include_sensitive=False)
    report.status = const.STATUS_CONFIRMED
    payload = serialize_report(report, tiers={}, include_sensitive=False)
    assert payload["suggested_template_key"] == "reward_high"


async def test_confirming_the_default_level_still_counts_as_deciding(
    db_session,
):
    """Picking the same level the report arrived with is a person deciding,
    not the default standing — otherwise the report would be stuck in
    「待定级」 forever no matter what anyone did."""
    report = await svc.create_report(
        db_session, title="confirmed as informational",
        researcher_email="d4@example.com", actor=None,
    )
    assert report.severity_is_default is True

    await svc.set_severity(
        db_session, report, severity="informational", note=None,
        apply_default_reward=True, actor=None,
    )
    await db_session.flush()
    assert report.severity_is_default is False