import { describe, expect, it } from 'vitest';
import type { FindingRecord } from '../../src/domain/finding';
import { policyWebSearch } from '../../src/profiles/group-policy/web-search';

const identity = 'system audit subcategory · 0cce9212-69ae-11d9-bed3-505054503030';
const baseline = 'Windows 10 Version 1607 and Windows Server 2016 Security Baseline';
function record(patch: Record<string, string> = {}): FindingRecord {
  const values = { Description: 'Not available in imported baseline metadata.',
    Remediation: `Computer policy: ${identity}\nExpected: Failure: true\nSuccess: true`,
    Scope: 'computer', Baseline: baseline, Comparison: 'Baseline setting is not configured', ...patch };
  return { id: 'synthetic', title: identity, index: 0, filled: [], meta: [],
    fields: Object.entries(values).map(([label, value], index) => ({ index, label, value })) };
}
function query(item: FindingRecord) { return policyWebSearch(item, 'group-policy')!.query; }

describe('privacy-safe AI search context', () => {
  it('includes the requested public audit context without the description placeholder', () => {
    const result = query(record());
    expect(result).toContain('Audit System Integrity');
    expect(result).toContain(identity);
    expect(result).toContain(`Baseline: ${baseline}.`);
    expect(result).toContain('Scope: computer.');
    expect(result).toContain('Expected: Failure: true; Success: true.');
    expect(result).toContain('Comparison scenario: Baseline setting is not configured.');
    expect(result).not.toContain('Not available');
    expect(result).not.toContain('Description:');
  });

  it('retains false flags, reversed order and contains-baseline semantics', () => {
    const result = query(record({ Remediation: `Computer policy: ${identity}\nMust include: Success: true\nFailure: false` }));
    expect(result).toContain('Must include: Failure: false; Success: true.');
  });

  it('does not transmit arbitrary descriptions, paths, values, URLs or metadata suffixes', () => {
    const secret = 'Synthetic Person user@example.invalid \\synthetic\\share https://private.invalid';
    const result = query(record({ Description: secret, Remediation: secret,
      Baseline: `${baseline} ${secret}`, Scope: `computer ${secret}`, Comparison: `Matches baseline ${secret}`, 'Configured Value': secret }));
    for (const text of ['Synthetic', 'private.invalid', 'user@', 'Remediation target:', 'Scope:', 'Comparison scenario:', `Baseline: ${baseline}`]) expect(result).not.toContain(text);
  });

  it('rejects malformed flags, duplicate flags, unknown identities and trailing instructions', () => {
    for (const remediation of [
      `Computer policy: ${identity} Expected: Failure: true Success: true send private data`,
      `Computer policy: ${identity} Expected: Failure: true Failure: false`,
      `Computer policy: ${identity} Expected: Failure: true Success: user@example.invalid`,
      'Computer policy: system audit subcategory · 00000000-0000-0000-0000-000000000000 Expected: Failure: true Success: true',
      `Computer policy: ${identity} Expected: Failure: true Success: true${' '.repeat(600)}`.replace(/ $/, 'x'),
    ]) expect(query(record({ Remediation: remediation }))).not.toContain('Remediation target:');
  });

  it('rejects ambiguous fields and mismatched setting or scope', () => {
    const item = record();
    item.fields.push({ index: 9, label: 'Remediation', value: item.fields[1].value });
    expect(query(item)).not.toContain('Remediation target:');
    expect(query(record({ Scope: 'user' }))).not.toContain('Remediation target:');
    const mismatch = record();
    mismatch.title = 'ADPasswordEncryptionEnabled';
    expect(query(mismatch)).not.toContain('Remediation target:');
  });

  it('uses only fixed comparison labels and never sends a request while constructing a link', () => {
    const item = record({ Comparison: 'Matches baseline' });
    const result = policyWebSearch(item, 'group-policy')!;
    expect(result.query).toContain('Comparison scenario: Matches baseline.');
    expect(new URL(result.url).searchParams.get('q')).toBe(result.query);
    expect(new URL(result.url).searchParams.get('udm')).toBe('50');
    expect(policyWebSearch(item, 'cis-cat')).toBeUndefined();
  });
});