import { describe, expect, it } from 'vitest';
import type { EnvironmentObservation } from '../../src/domain/environment-context';
import {
  discloseSupplementalObservation,
  RESULT_DB_SUPPLEMENTAL_DISCLOSURE_POLICY_VERSION
} from '../../src/domain/result-db-supplemental-disclosure';

function observation(overrides: Partial<EnvironmentObservation> = {}): EnvironmentObservation {
  return {
    version: 1,
    id: 'synthetic-observation',
    scanRunId: 'synthetic-run',
    importFileId: 'synthetic-file',
    tool: { id: 'pingcastle', name: 'PingCastle', version: 'synthetic' },
    subject: { type: 'domain-information', identity: 'private.synthetic.example', label: 'Private Customer' },
    property: 'domain.functional_level',
    label: 'Customer supplied label',
    originalValue: 'Windows Server 2016 for Private Customer',
    normalizedValue: 2016,
    valueType: 'number',
    state: 'observed',
    source: { objectPath: 'html/private/customer/path' },
    mappingVersion: 'synthetic',
    attributes: { customer: 'Private Customer' },
    ...overrides
  };
}

describe('Result DB supplemental disclosure boundary', () => {
  it('rebuilds an approved value from controlled metadata without carrying source identity or raw context', () => {
    const disclosed = discloseSupplementalObservation(observation());

    expect(disclosed).toEqual({
      policyVersion: RESULT_DB_SUPPLEMENTAL_DISCLOSURE_POLICY_VERSION,
      disclosureClass: 'technical-metadata',
      property: 'domain.functional_level',
      title: 'Domain functional level',
      subjectType: 'active-directory-environment',
      value: 2016,
      valueType: 'number',
      state: 'observed'
    });
    expect(JSON.stringify(disclosed)).not.toMatch(/Private Customer|private\.synthetic|customer\/path/i);
  });

  it('fails closed for identifying, unknown, future-tool and malformed supplemental values', () => {
    expect(discloseSupplementalObservation(observation({
      property: 'domain.fqdn', normalizedValue: 'private.synthetic.example', valueType: 'string'
    }))).toBeUndefined();
    expect(discloseSupplementalObservation(observation({
      property: 'future.private.field', normalizedValue: 'Private Customer', valueType: 'string'
    }))).toBeUndefined();
    expect(discloseSupplementalObservation(observation({
      tool: { id: 'future-scanner', name: 'Future Scanner' }
    }))).toBeUndefined();
    expect(discloseSupplementalObservation(observation({
      normalizedValue: '2016.private.synthetic.example', valueType: 'string'
    }))).toBeUndefined();
  });

  it('allows bounded aggregate and boolean configuration values only', () => {
    expect(discloseSupplementalObservation(observation({
      property: 'risk.domain', normalizedValue: 42, originalValue: 'Private score 42'
    }))).toMatchObject({ value: 42, disclosureClass: 'aggregate' });
    expect(discloseSupplementalObservation(observation({
      property: 'domain.recycle_bin_enabled', normalizedValue: true, originalValue: 'Private enabled', valueType: 'boolean'
    }))).toMatchObject({ value: true, disclosureClass: 'configuration-state' });
    expect(discloseSupplementalObservation(observation({
      property: 'risk.domain', normalizedValue: 101
    }))).toBeUndefined();
  });

  it('discloses non-identifying environment aggregates and configuration state', () => {
    expect(discloseSupplementalObservation(observation({
      property: 'user.account_count', normalizedValue: 16, originalValue: 'Private tenant: 16', valueType: 'number'
    }))).toMatchObject({ property: 'user.account_count', value: 16, disclosureClass: 'aggregate', subjectType: 'active-directory-environment' });
    expect(discloseSupplementalObservation(observation({
      property: 'computer.account_count', normalizedValue: 1, valueType: 'number'
    }))).toMatchObject({ value: 1, disclosureClass: 'aggregate' });
    expect(discloseSupplementalObservation(observation({
      property: 'user.password_never_expires_count', normalizedValue: 15, valueType: 'number'
    }))).toMatchObject({ value: 15, disclosureClass: 'aggregate' });
    expect(discloseSupplementalObservation(observation({
      property: 'pki.certificate_template_count', normalizedValue: 12, valueType: 'number'
    }))).toMatchObject({ value: 12, disclosureClass: 'aggregate' });
    expect(discloseSupplementalObservation(observation({
      property: 'password_policy.complexity_enabled', normalizedValue: false, valueType: 'boolean'
    }))).toMatchObject({ value: false, disclosureClass: 'configuration-state' });
    expect(discloseSupplementalObservation(observation({
      property: 'laps.windows.present', normalizedValue: true, valueType: 'boolean'
    }))).toMatchObject({ value: true, disclosureClass: 'configuration-state' });
  });

  it('still fails closed for a non-numeric aggregate value', () => {
    expect(discloseSupplementalObservation(observation({
      property: 'user.account_count', normalizedValue: 'sixteen private users', valueType: 'string'
    }))).toBeUndefined();
  });
});