#!/usr/bin/env python3
"""Mutation/unit coverage for no-retired-mail-leak.py.

Proves the scanner still catches renamed retired-Mail artifacts, skips
external trees and real Gmail addresses, honors tracked-file semantics and
allowlist staleness, and enforces the generic package boundary with its
product registry exemption.
"""
import importlib.util
import subprocess
import tempfile
import unittest
from pathlib import Path

SCRIPT = Path(__file__).with_name("no-retired-mail-leak.py")
SPEC = importlib.util.spec_from_file_location("no_retired_mail_leak", SCRIPT)
MODULE = importlib.util.module_from_spec(SPEC)
assert SPEC.loader is not None
SPEC.loader.exec_module(MODULE)


class ScannerUnitTest(unittest.TestCase):
    def test_renamed_go_test_content_is_detected(self) -> None:
        findings = MODULE.content_findings(
            "internal/extension/providers/mail/mailruntime/provider_test.go",
            'package mailruntime; const provider = "gmail"',
        )
        self.assertIn("gmail", findings)

    def test_renamed_sql_content_is_detected(self) -> None:
        findings = MODULE.content_findings(
            "internal/tidb/migrations/00999_cleanup.sql",
            "CREATE TABLE mail_operation_effects (id BIGINT);",
        )
        self.assertIn("legacy mail tables", findings)

    def test_renamed_go_repository_content_is_detected(self) -> None:
        findings = MODULE.content_findings(
            "internal/extension/archive/repository_test.go",
            "package archive; type MailResourceRefsRepository struct{}",
        )
        self.assertIn("legacy mail tables", findings)

    def test_renamed_document_content_is_detected(self) -> None:
        findings = MODULE.content_findings(
            "docs/design/provider-setup.md",
            "The Email App uses OAuth with Microsoft Graph.",
        )
        self.assertIn("microsoft graph", findings)

    def test_renamed_fixture_content_is_detected(self) -> None:
        findings = MODULE.content_findings(
            "internal/extension/testdata/provider.json",
            '{"action":"get_operation_status"}',
        )
        self.assertIn("get-operation-status", findings)

    def test_renamed_artifact_paths_are_detected(self) -> None:
        cases = {
            "internal/extension/archive/renamed_gmailadapter_test.go":
                "gmail",
            "internal/extension/providers/mail/mailstore/renamed_effect_repository_test.go":
                "Mail store",
            "internal/extension/providers/mail/mailruntime/renamed_graphadapter_test.go":
                "graph",
            "testdata/renamed-prepare_send.fixture.json":
                "retired action",
            "internal/extension/providers/mail/renamed-tidb-slow.log":
                "log artifact",
        }
        for path, want in cases.items():
            with self.subTest(path=path):
                self.assertIn(want, MODULE.path_finding(path))

    def test_external_trees_are_excluded(self) -> None:
        self.assertTrue(MODULE.scan_excluded("vendor/example/mail/oauth.go"))
        self.assertTrue(
            MODULE.scan_excluded("x/agent-git-service/internal/oauth/handler.go")
        )

    def test_real_gmail_address_is_not_flagged(self) -> None:
        self.assertEqual(
            [],
            MODULE.content_findings(
                "internal/extension/testdata/user.json",
                '{"email":"real.user@gmail.com"}',
            ),
        )


class TrackedTreeGuardTest(unittest.TestCase):
    def setUp(self) -> None:
        self.fixture = Path(tempfile.mkdtemp())
        subprocess.run(["git", "init", "-q", str(self.fixture)], check=True)
        self.original_allowlist = dict(MODULE.ALLOWLIST)
        MODULE.ALLOWLIST.clear()

    def tearDown(self) -> None:
        MODULE.ALLOWLIST.update(self.original_allowlist)
        subprocess.run(
            ["rm", "-rf", str(self.fixture)], check=True
        )

    def track(self, relative_path: str, payload: str) -> None:
        target = self.fixture / relative_path
        target.parent.mkdir(parents=True, exist_ok=True)
        target.write_text(payload)
        subprocess.run(
            ["git", "-C", str(self.fixture), "add", relative_path],
            check=True,
        )

    def test_clean_tree_has_no_findings(self) -> None:
        self.assertEqual([], MODULE.collect_findings(self.fixture))

    def test_tracked_retired_artifact_is_flagged(self) -> None:
        self.track(
            "internal/extension/providers/mail/mailruntime/provider.go",
            'package mailruntime; const provider = "gmail"',
        )
        findings = MODULE.collect_findings(self.fixture)
        self.assertTrue(
            any("content contains gmail" in finding for finding in findings)
        )

    def test_untracked_retired_artifact_is_ignored(self) -> None:
        target = (
            self.fixture
            / "internal/extension/providers/mail/mailruntime/provider.go"
        )
        target.parent.mkdir(parents=True, exist_ok=True)
        target.write_text('package mailruntime; const provider = "gmail"')
        self.assertEqual([], MODULE.collect_findings(self.fixture))

    def test_stale_allowlist_entry_is_flagged(self) -> None:
        MODULE.ALLOWLIST["internal/does/not/exist_test.go"] = {"gmail"}
        findings = MODULE.collect_findings(self.fixture)
        self.assertTrue(
            any(
                "stale content allowlist entry for gmail" in finding
                for finding in findings
            )
        )

    def test_generic_package_boundary_is_enforced(self) -> None:
        self.track(
            "internal/store/extension/registry.go",
            "package extension\nconst appID = \"app_email\"\n",
        )
        findings = MODULE.collect_findings(self.fixture)
        self.assertTrue(
            any(
                "contains Mail-owned token 'app_email'" in finding
                for finding in findings
            )
        )

    def test_product_registry_is_exempt_from_boundary(self) -> None:
        self.track(
            "internal/store/app/registry/product_apps.go",
            "package registry\nconst EmailAppID = \"app_email\"\n",
        )
        findings = MODULE.collect_findings(self.fixture)
        self.assertEqual([], findings)


if __name__ == "__main__":
    unittest.main()