import { describe, expect, it } from 'vitest';
import { cloudInformationFacts, cloudInformationOverview } from '../../src/domain/cloud-information';
import { selectClientInformation } from '../../src/domain/client-information';
import { cloudInformationFixture } from '../cloud-information-fixture';

describe('source-backed Cloud Information', () => {
  it('projects all four areas with exact source provenance without changing source data', () => {
    const snapshot = cloudInformationFixture(); const before = JSON.stringify(snapshot);
    const facts = cloudInformationFacts(snapshot);
    expect(facts).toHaveLength(5);
    expect(facts.map(fact => fact.value)).toEqual(expect.arrayContaining(['enabled', 1, 2, 'False', '2af84b1e-32c8-42b7-82bc-daa82404023b']));
    expect(cloudInformationOverview(facts, 'cloud-apps')).toEqual(['Admin requests: disabled']);
    expect(cloudInformationOverview(facts, 'cloud-sharing')).toEqual(['Guests: restricted role']);
    expect(facts.find(fact => fact.value === 2)).toMatchObject({ scope: 'reported-subset', observationId: 'CISA.MS.AAD.7.4',
      scanRunId: 'run-1', importFileId: 'file-1', mappingVersion: '1.0.0', source: { rowIndex: 0 } });
    expect(JSON.stringify(snapshot)).toBe(before);
  });

  it('ignores outcomes, recommendations, unknown IDs, other tools and unassessed evidence', () => {
    const snapshot = cloudInformationFixture();
    snapshot.observations = snapshot.observations.slice(0, 1);
    const obs = snapshot.observations[0];
    for (const value of ['Failed', 'The recommended value is **enabled**.',
      '| Setting | Expected Value |\n| --- | --- |\n| FIDO2 | enabled |', 'Your tenant is configured as **enabled** or **disabled**.']) {
      obs.originalValue = value; expect(cloudInformationFacts(snapshot)).toEqual([]);
    }
    obs.originalValue = 'Your tenant is configured as **disabled**.';
    obs.state = 'not-assessed'; expect(cloudInformationFacts(snapshot)).toEqual([]);
    obs.state = 'observed'; obs.tool = { id: 'other', name: 'Other' }; expect(cloudInformationFacts(snapshot)).toEqual([]);
    obs.tool = { id: 'maester', name: 'Maester' }; obs.attributes.sourceRuleId = 'EIDSCA.AF99'; expect(cloudInformationFacts(snapshot)).toEqual([]);
  });

  it('keeps explicit zero and unset without inferring defaults or treating missing tables as zero', () => {
    const snapshot = cloudInformationFixture(); snapshot.observations = snapshot.observations.slice(0, 1);
    const obs = snapshot.observations[0];
    obs.originalValue = 'Your tenant is **not configured explicitly**.\n\nThe recommended value is **enabled**.';
    expect(cloudInformationFacts(snapshot)[0].value).toBe('not configured explicitly');
    obs.attributes.sourceRuleId = 'CISA.MS.AAD.7.4';
    obs.originalValue = 'Well done. Your tenant has no active assignments without expiration to privileged roles.';
    expect(cloudInformationFacts(snapshot)[0].value).toBe(0);
    obs.originalValue = 'Your tenant has active assignments without expiration to privileged roles.';
    expect(cloudInformationFacts(snapshot)).toEqual([]);
    obs.attributes.sourceRuleId = 'MT.1032'; obs.originalValue = 'All privileged role assignments are managed by PIM. Well done!';
    expect(cloudInformationFacts(snapshot)).toEqual([]);
  });

  it('preserves conflicting values and separates runs and tenants instead of adding counts', () => {
    const snapshot = cloudInformationFixture(); snapshot.observations = snapshot.observations.slice(0, 1);
    const obs = snapshot.observations[0];
    snapshot.observations.push({ ...obs, id: 'conflicting', originalValue: 'Your tenant is configured as **disabled**.' });
    expect(cloudInformationOverview(cloudInformationFacts(snapshot), 'cloud-access')).toEqual(['FIDO2: conflicting source values']);
    snapshot.observations[1].scanRunId = 'run-2';
    expect(cloudInformationOverview(cloudInformationFacts(snapshot), 'cloud-access')).toEqual(['Multiple scan scopes — see Results']);
    snapshot.observations[1].scanRunId = obs.scanRunId; snapshot.observations[1].subject = { type: 'entra-tenant', identity: 'tenant-2' };
    expect(cloudInformationOverview(cloudInformationFacts(snapshot), 'cloud-access')).toEqual(['Multiple scan scopes — see Results']);
  });

  it('publishes full filtered facts through the read contract independently of pagination', () => {
    const snapshot = cloudInformationFixture();
    const result = selectClientInformation(snapshot, { projectId: snapshot.projectId, areas: ['cloud-access'], limit: 1 }, 9);
    expect(result.cloudFacts).toHaveLength(2); expect(result.observations).toHaveLength(1);
    expect(result.cloudFacts.every(fact => fact.area === 'cloud-access')).toBe(true);
    expect(selectClientInformation(snapshot, { projectId: snapshot.projectId, properties: ['missing'] }, 9).cloudFacts).toEqual([]);
    result.cloudFacts[0].source.rowIndex = 999;
    expect(snapshot.observations[0].source.rowIndex).toBe(0);
  });
});