package releaseprovenance

import (
	"encoding/json"
	"os"
	"path/filepath"
	"strings"
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

func validLock() Lock {
	return Lock{
		SchemaVersion: 1, ReleaseVersion: "1.3.0", ReviewedAt: "2026-08-31T12:00:00Z", Reviewer: "release-approver",
		Sources:   Sources{MPV: "0.41.0", UOSC: "5.12.0", ModernZ: "0.3.3", MPCQT: "26.07", IINA: "1.4.4", WindowsBuildTag: "2026-08-30-deadbee", WindowsTimestamp: "20260830", WindowsMPVCommit: "deadbee", WindowsFFmpegHash: "cafebabe"},
		Artifacts: []Artifact{{ID: "uosc", URL: "https://example.com/uosc.zip", BLAKE3: "blake3:" + strings.Repeat("a", 64), Verification: "reviewed-digest", Evidence: "release approval 42"}},
	}
}

func TestLoadRequiresTagBoundReviewedDigestLock(t *testing.T) {
	lock := validLock()
	data, err := json.Marshal(lock)
	require.NoError(t, err)
	path := filepath.Join(t.TempDir(), "provenance.json")
	require.NoError(t, os.WriteFile(path, data, 0o600))

	loaded, err := Load(path, "v1.3.0")
	require.NoError(t, err)
	artifact, ok := loaded.ArtifactForURL("https://example.com/uosc.zip")
	require.True(t, ok)
	assert.Equal(t, "uosc", artifact.ID)
	assert.Equal(t, "5.12.0", loaded.Versions()["uosc"])
}

func TestLoadRejectsWrongReleaseAndUnreviewedArtifact(t *testing.T) {
	lock := validLock()
	lock.Artifacts[0].Evidence = ""
	data, err := json.Marshal(lock)
	require.NoError(t, err)
	path := filepath.Join(t.TempDir(), "provenance.json")
	require.NoError(t, os.WriteFile(path, data, 0o600))

	_, err = Load(path, "1.3.1")
	require.Error(t, err)
	assert.Contains(t, err.Error(), "does not match")
	assert.Contains(t, err.Error(), "lacks verification/evidence")
}

func TestLoadRejectsUnknownFields(t *testing.T) {
	path := filepath.Join(t.TempDir(), "provenance.json")
	require.NoError(t, os.WriteFile(path, []byte(`{"schema_version":1,"unknown":true}`), 0o600))
	_, err := Load(path, "1.3.0")
	require.Error(t, err)
	assert.Contains(t, err.Error(), "unknown field")
}

func TestDownloadURLRequiresReviewedDigestAddress(t *testing.T) {
	for _, url := range []string{"http://example.com/" + strings.Repeat("a", 64) + "/uosc.zip", "https://example.com/latest/uosc.zip", "https://user@example.com/" + strings.Repeat("a", 64) + "/uosc.zip", "https://example.com/" + strings.Repeat("b", 64) + "/uosc.zip"} {
		lock := validLock()
		lock.Artifacts[0].DownloadURL = url
		require.ErrorContains(t, lock.Validate("1.3.0"), "download_url")
	}
	lock := validLock()
	lock.Artifacts[0].DownloadURL = "https://example.com/" + strings.Repeat("a", 64) + "/uosc.zip"
	require.NoError(t, lock.Validate("1.3.0"))
}