package catalogsystem

import (
	"os"
	"path/filepath"
	"runtime"
	"strings"
	"testing"
)

func TestSystemAuthorityKeepsDurableAndVerifierBoundariesClosed(t *testing.T) {
	_, file, _, ok := runtime.Caller(0)
	if !ok {
		t.Fatal("resolve test file")
	}
	packageDir := filepath.Dir(file)
	packageForbidden := []string{
		"nexuscrm-controlplane/catalogapp",
		"nexuscrm-controlplane/catalogtenant",
		"pingcap-inc/NexusCRM/backend",
		"ProofAdapter",
		"VerificationCallback",
		"DELETE FROM _System_CatalogSystem",
	}
	durableForbidden := []string{
		"nexuscrm-controlplane/catalogpublication",
		"AuthorityEvidence",
		"VerificationReceipt",
		"OrgID",
	}
	err := filepath.WalkDir(packageDir, func(path string, entry os.DirEntry, walkErr error) error {
		if walkErr != nil {
			return walkErr
		}
		if entry.IsDir() || filepath.Ext(path) != ".go" ||
			strings.HasSuffix(path, "_test.go") {
			return nil
		}
		raw, err := os.ReadFile(path)
		if err != nil {
			return err
		}
		for _, value := range packageForbidden {
			if strings.Contains(string(raw), value) {
				t.Errorf("system authority contains forbidden boundary %q in %s", value, path)
			}
		}
		if filepath.Base(path) == "layout_bundle_owner_verification.go" {
			return nil
		}
		for _, value := range durableForbidden {
			if strings.Contains(string(raw), value) {
				t.Errorf(
					"durable system authority contains verifier boundary %q in %s",
					value,
					path,
				)
			}
		}
		return nil
	})
	if err != nil {
		t.Fatal(err)
	}
}