package catalogverificationtx

import (
	"os"
	"path/filepath"
	"runtime"
	"strings"
	"testing"
)

func TestValidatedSourceBindingHasOneProductionIssuer(t *testing.T) {
	_, file, _, ok := runtime.Caller(0)
	if !ok {
		t.Fatal("resolve source-binding boundary test")
	}
	repoRoot := filepath.Clean(filepath.Join(filepath.Dir(file), "..", ".."))
	allowed := map[string]struct{}{
		filepath.Join(
			repoRoot,
			"catalogpublication",
			"source_verification.go",
		): {},
		filepath.Join(
			repoRoot,
			"internal",
			"catalogverificationtx",
			"source_binding.go",
		): {},
	}
	seen := make(map[string]struct{}, len(allowed))
	err := filepath.WalkDir(repoRoot, func(
		path string,
		entry os.DirEntry,
		walkErr error,
	) error {
		if walkErr != nil {
			return walkErr
		}
		if entry.IsDir() {
			if path != repoRoot && strings.HasPrefix(entry.Name(), ".") {
				return filepath.SkipDir
			}
			return nil
		}
		if filepath.Ext(path) != ".go" || strings.HasSuffix(path, "_test.go") {
			return nil
		}
		raw, err := os.ReadFile(path)
		if err != nil {
			return err
		}
		if !strings.Contains(string(raw), "BindValidatedSource(") {
			return nil
		}
		if _, found := allowed[path]; !found {
			t.Errorf("unexpected validated source-binding issuer: %s", path)
			return nil
		}
		seen[path] = struct{}{}
		return nil
	})
	if err != nil {
		t.Fatal(err)
	}
	for path := range allowed {
		if _, found := seen[path]; !found {
			t.Errorf("validated source-binding issuer is missing: %s", path)
		}
	}
}

func TestOwnerReceiptSealsHaveOnlyFixedPurposeProductionIssuers(t *testing.T) {
	_, file, _, ok := runtime.Caller(0)
	if !ok {
		t.Fatal("resolve owner-receipt boundary test")
	}
	repoRoot := filepath.Clean(filepath.Join(filepath.Dir(file), "..", ".."))
	allowed := map[string]string{
		"CompleteAppClaim(": filepath.Join(
			repoRoot,
			"catalogapp",
			"layout_bundle_owner_verification.go",
		),
		"CompleteTenantClaim(": filepath.Join(
			repoRoot,
			"catalogtenant",
			"layout_bundle_owner_verification.go",
		),
		"CompleteSystemClaim(": filepath.Join(
			repoRoot,
			"internal",
			"catalogsystem",
			"layout_bundle_owner_verification.go",
		),
	}
	seen := make(map[string]bool, len(allowed))
	err := filepath.WalkDir(repoRoot, func(
		path string,
		entry os.DirEntry,
		walkErr error,
	) error {
		if walkErr != nil {
			return walkErr
		}
		if entry.IsDir() {
			if path != repoRoot && strings.HasPrefix(entry.Name(), ".") {
				return filepath.SkipDir
			}
			return nil
		}
		if filepath.Ext(path) != ".go" ||
			strings.HasSuffix(path, "_test.go") ||
			path == filepath.Join(
				repoRoot,
				"internal",
				"catalogverificationtx",
				"claim.go",
			) {
			return nil
		}
		raw, err := os.ReadFile(path)
		if err != nil {
			return err
		}
		for call, issuer := range allowed {
			if !strings.Contains(string(raw), call) {
				continue
			}
			if path != issuer {
				t.Errorf("unexpected %s issuer: %s", call, path)
				continue
			}
			seen[call] = true
		}
		return nil
	})
	if err != nil {
		t.Fatal(err)
	}
	for call := range allowed {
		if !seen[call] {
			t.Errorf("fixed-purpose owner receipt issuer is missing: %s", call)
		}
	}
}