"""The privacy scan must read a flattened key as an address, not a hostname.

#3012 started scanning dict KEYS with the value regexes — the right idea
(the citation layer addresses a list item by its own ``key`` field, which
promotes fact content into key position), applied one pass too far. The
second scan in ``build_model_fact_package`` runs AFTER flattening, where a
key is no longer a name but an address our own flattener joined, and
``metrics.cloud`` reads as ``<label>.<TLD>``. Every one of the 19
cloud-subscription metric keys starts with ``cloud.``, so that subject's
package was rejected outright — a total outage of the analysis, not a leak.
"""
from __future__ import annotations

from datetime import UTC, datetime
from decimal import Decimal

import pytest

from app.intelligence import contracts, privacy
from app.intelligence.cloud_scope_scoring import CLOUD_SCOPE_METRICS
from app.intelligence.generation import build_model_fact_package
from app.intelligence.models import IntelligenceSnapshot
from app.intelligence.privacy import UnsafeFactPackage, assert_llm_safe


def _snapshot(*, metric_key: str) -> IntelligenceSnapshot:
    """The production shape: a metric addressed by its own dotted name."""
    return IntelligenceSnapshot(
        subject_type="cloud_scope",
        subject_id="scope-uuid",
        audience_key="shared",
        score_version="health-v1",
        facts_hash="c" * 64,
        overall_score=Decimal("70.00"),
        confidence_score=Decimal("90.00"),
        grade="healthy",
        dimensions=[{
            "key": "access_governance",
            "score": 80,
            "metrics": [{"key": metric_key, "value": 42}],
        }],
        aggregate_facts={"costs": {"top_resources": [{"amount": 5}]}},
        reference_map={},
        data_as_of=datetime(2026, 8, 17, tzinfo=UTC),
    )


def test_the_separator_matches_the_one_the_flattener_joins_with():
    """Two copies of an address format must not drift apart."""
    assert privacy._FLAT_PATH_SEPARATOR == contracts.FLAT_KEY_SEPARATOR


@pytest.mark.parametrize("metric_key", sorted(CLOUD_SCOPE_METRICS))
def test_every_real_cloud_metric_address_survives_the_flat_scan(metric_key):
    """Derived from the shipped vocabulary, not a hand-picked example.

    A hand-listed fixture would have kept passing the day someone added the
    twentieth metric under a new dotted prefix.
    """
    flat_key = f"dimensions.access_governance.metrics.{metric_key}.value"
    assert_llm_safe({flat_key: 42}, keys_are_flat_paths=True)


def test_the_joined_address_is_what_used_to_be_rejected():
    """Pins the defect itself: without the flag, the same key still fails.

    Keeping this assertion means the fix cannot be quietly reduced to
    loosening ``_DOMAIN`` — the strict reading is still the default, and
    only the post-flatten caller opts out of it.
    """
    flat_key = "dimensions.access_governance.metrics.cloud.access.governed_coverage.value"
    with pytest.raises(UnsafeFactPackage, match="domain-like value in field name"):
        assert_llm_safe({flat_key: 42})


@pytest.mark.parametrize(
    "key",
    [
        "facts.k.AKIAABCDEFGHIJKLMNOP.count",
        "facts.keys.sk-abcdefghijkl0123.count",
    ],
)
def test_a_credential_inside_one_flat_segment_is_still_rejected(key):
    """Second net: shapes that fit inside a single segment still fail here."""
    with pytest.raises(UnsafeFactPackage, match="credential-like value in field name"):
        assert_llm_safe({key: 1}, keys_are_flat_paths=True)


def test_the_flat_pass_is_not_where_an_addressed_email_is_caught():
    """States the limitation honestly instead of implying coverage.

    Splitting on the dot means ``alice@acme`` and ``com`` are scanned apart,
    so the email regex cannot fire on a flat key. That is survivable only
    because the nested pass already rejected the same string — the test
    below proves it end to end. Written down so nobody later reads the
    segment scan as the boundary it is not.
    """
    assert_llm_safe(
        {"facts.owners.alice@acme.com.count": 1}, keys_are_flat_paths=True,
    )


def test_an_email_in_a_metric_name_is_rejected_before_it_can_be_flattened():
    """The boundary that actually holds, exercised through the real builder."""
    snapshot = _snapshot(metric_key="alice@acme.com")
    with pytest.raises(UnsafeFactPackage, match="email-like value"):
        build_model_fact_package(snapshot)


def test_the_real_cloud_metric_names_reach_the_model_intact():
    """The regression itself, end to end: a real metric key must survive."""
    package = build_model_fact_package(
        _snapshot(metric_key="cloud.access.governed_coverage"),
    )
    assert any(
        ref.endswith("cloud.access.governed_coverage.value")
        for ref in package["citable_fact_refs"]
    ), package["citable_fact_refs"]


def test_the_deny_list_still_applies_to_flat_keys():
    """Opting into address semantics must not disarm the prohibited names."""
    with pytest.raises(UnsafeFactPackage, match="prohibited field"):
        assert_llm_safe({"facts.access_key": "x"}, keys_are_flat_paths=True)