"""The engine/config boundary scan (``scripts/boundary_scan.py``).

A guardrail that silently passes is worse than none: if the scanner stops
catching planted literals, the engine/config red line
(``docs/principles/engine-config-red-lines.md``) erodes invisibly. These tests
pin the four behaviours that matter — identifiers are derived from the config
tree, a literal in engine code is caught, and both escape hatches (inline pragma
and allowlist file) suppress with a reason — plus a regression guard that the
real repo tree stays clean.

Runnable without a test harness::

    .venv/bin/python tests/test_boundary_scan.py
"""

from __future__ import annotations

import pathlib
import sys

sys.path.insert(0, str(pathlib.Path(__file__).resolve().parents[1]))

import scripts.boundary_scan as bs


def _make_tree(root: pathlib.Path, *, engine_body: str, allow: str = "") -> None:
    """A minimal repo: one source dir + one engine file under ingestion/."""
    src = root / "ingestion" / "extract" / "x" / "sources" / "foo_widget"
    src.mkdir(parents=True)
    eng = root / "ingestion" / "extract" / "x" / "engine"
    eng.mkdir(parents=True)
    (eng / "leak.py").write_text(engine_body)
    (root / "scripts").mkdir(parents=True, exist_ok=True)
    (root / "scripts" / "boundary_scan_allow.txt").write_text(allow)


def _make_orchestration_tree(root: pathlib.Path, *, engine_body: str) -> None:
    src = root / "ingestion" / "load" / "x" / "sources" / "foo_widget"
    src.mkdir(parents=True)
    eng = root / "orchestration" / "airflow" / "engine"
    eng.mkdir(parents=True)
    (eng / "leak.py").write_text(engine_body)
    (root / "scripts").mkdir(parents=True, exist_ok=True)
    (root / "scripts" / "boundary_scan_allow.txt").write_text("")


def _point_at(root: pathlib.Path) -> None:
    bs.REPO = root
    bs.ALLOW_FILE = root / "scripts" / "boundary_scan_allow.txt"


def test_identifiers_derived_from_config_tree(tmp_path) -> None:
    _make_tree(tmp_path, engine_body="x = 1\n")
    _point_at(tmp_path)
    assert bs.derive_identifiers() == {"foo_widget"}


def test_literal_in_engine_code_is_caught(tmp_path) -> None:
    _make_tree(tmp_path, engine_body='TABLE = "foo_widget_snapshots"\nval = "foo_widget"\n')
    _point_at(tmp_path)
    hits = bs.scan()
    assert [h.identifier for h in hits] == ["foo_widget"]
    assert hits[0].line_no == 2  # \b means foo_widget_snapshots is not a match


def test_literal_in_orchestration_engine_code_is_caught(tmp_path) -> None:
    _make_orchestration_tree(tmp_path, engine_body='val = "foo_widget"\n')
    _point_at(tmp_path)
    hits = bs.scan()
    assert [(h.identifier, h.path.name) for h in hits] == [("foo_widget", "leak.py")]


def test_inline_pragma_suppresses(tmp_path) -> None:
    _make_tree(tmp_path, engine_body='val = "foo_widget"  # boundary-scan: allow demo reason\n')
    _point_at(tmp_path)
    assert bs.scan() == []


def test_inline_pragma_without_reason_does_not_suppress(tmp_path) -> None:
    _make_tree(tmp_path, engine_body='val = "foo_widget"  # boundary-scan: allow\n')
    _point_at(tmp_path)
    hits = bs.scan()
    assert [h.identifier for h in hits] == ["foo_widget"]


def test_allowlist_file_suppresses(tmp_path) -> None:
    _make_tree(
        tmp_path,
        engine_body='val = "foo_widget"\n',
        allow="ingestion/extract/x/engine/leak.py:foo_widget  # justified\n",
    )
    _point_at(tmp_path)
    assert bs.scan() == []


def test_allowlist_file_requires_reason(tmp_path) -> None:
    _make_tree(
        tmp_path,
        engine_body='val = "foo_widget"\n',
        allow="ingestion/extract/x/engine/leak.py:foo_widget\n",
    )
    _point_at(tmp_path)
    try:
        bs.scan()
    except bs.AllowlistError as e:
        assert "missing reason" in str(e)
    else:
        raise AssertionError("allowlist entry without a reason should fail")


def test_real_repo_tree_is_clean() -> None:
    """Regression guard: the committed tree passes with its committed allowlist."""
    import importlib

    importlib.reload(bs)  # restore REPO/ALLOW_FILE to the real repo paths
    assert bs.scan() == [], "engine code grew an un-allowlisted source/product literal"


def _run() -> None:
    import tempfile

    for name, fn in sorted(globals().items()):
        if not name.startswith("test_"):
            continue
        if fn.__code__.co_argcount:
            with tempfile.TemporaryDirectory() as d:
                fn(pathlib.Path(d))
        else:
            fn()
        print(f"ok  {name}")
    print("all boundary-scan tests passed")


if __name__ == "__main__":
    _run()