// file: crates/ksp-app-backfill-desk/tests/desktop_security.rs
// version: 6

//! Security and dependency-boundary checks for the Backfill Desk scaffold.

#![forbid(unsafe_code)]
#![deny(unreachable_pub)]
#![warn(missing_docs)]

fn app_root() -> std::path::PathBuf {
    return std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"));
}

fn collect_files(directory: &std::path::Path, extension: &str, files: &mut std::vec::Vec<std::path::PathBuf>) {
    let entries = std::fs::read_dir(directory);
    let entries = match entries {
        std::result::Result::Ok(value) => value,
        std::result::Result::Err(_) => return,
    };
    for entry in entries {
        let entry = match entry {
            std::result::Result::Ok(value) => value,
            std::result::Result::Err(_) => continue,
        };
        let path = entry.path();
        if path.is_dir() {
            collect_files(path.as_path(), extension, files);
            continue;
        }
        if path.extension().and_then(std::ffi::OsStr::to_str) == std::option::Option::Some(extension) {
            files.push(path);
        }
    }
}

fn read_text(path: &std::path::Path) -> String {
    let source = std::fs::read_to_string(path);
    assert!(source.is_ok(), "unable to read {}", path.display());
    return match source {
        std::result::Result::Ok(value) => value,
        std::result::Result::Err(_) => String::new(),
    };
}

#[test]
fn capability_surface_remains_core_plus_tracing_while_transport_and_store_are_backend_only() {
    let root = app_root();
    let capability = read_text(root.join("capabilities/default.json").as_path());
    assert!(capability.contains("\"core:default\""));
    assert!(capability.contains("\"tracing:default\""));
    for forbidden in ["dialog:", "fs:", "http:", "shell:"] {
        assert!(!capability.contains(forbidden));
    }
    let manifest = read_text(root.join("Cargo.toml").as_path());
    assert!(manifest.contains("tauri-plugin-tracing.workspace = true"));
    assert!(manifest.contains("ksp-onchain-transport-lib = { path = \"../ksp-onchain-transport-lib\" }"));
    assert!(manifest.contains("ksp-store-lib = { path = \"../ksp-store-lib\" }"));
    for forbidden in ["ksp-job-backfill-lib", "ksp-store-api", "ksp-store-postgres-lib", "reqwest", "tokio-postgres"] {
        assert!(!manifest.contains(forbidden), "current Backfill Desk opens a forbidden dependency: {forbidden}");
    }
}

#[test]
fn pre_002_frontend_has_no_network_persistence_or_native_dialog_surface() {
    let root = app_root();
    let mut typescript = std::vec::Vec::new();
    collect_files(root.join("frontend/ts").as_path(), "ts", &mut typescript);
    assert!(!typescript.is_empty());
    for path in typescript {
        let source = read_text(path.as_path());
        for forbidden in ["fetch(", "XMLHttpRequest", "localStorage", "sessionStorage", "window.alert(", "window.confirm(", "window.prompt("] {
            assert!(!source.contains(forbidden), "{} contains forbidden scaffold surface {forbidden}", path.display());
        }
    }
}

#[test]
fn pre_002_tauri_commands_remain_centralized() {
    let root = app_root();
    let mut rust_files = std::vec::Vec::new();
    collect_files(root.join("src").as_path(), "rs", &mut rust_files);
    let mut command_count = 0usize;
    for path in rust_files {
        let source = read_text(path.as_path());
        let count = source.matches("#[tauri::command]").count();
        if path.file_name().and_then(std::ffi::OsStr::to_str) == std::option::Option::Some("tauri.rs") {
            command_count += count;
        } else {
            assert_eq!(count, 0, "{} declares a Tauri command outside tauri.rs", path.display());
        }
    }
    assert_eq!(command_count, 4);
}

#[test]
fn pre_002_frontend_instrumentation_avoids_business_or_secret_payloads() {
    let root = app_root();
    let main = read_text(root.join("frontend/ts/main.ts").as_path());
    for required in [
        "Backfill Desk frontend control clicked",
        "Backfill Desk navigation tab clicked",
        "Backfill Desk runtime status refresh button clicked",
        "Frontend IPC command requested",
    ] {
        if required == "Frontend IPC command requested" {
            let invoke = read_text(root.join("frontend/ts/invoke.ts").as_path());
            assert!(invoke.contains(required));
        } else {
            assert!(main.contains(required));
        }
    }
    for forbidden in ["JSON.stringify(status)", "signature", "address", "apiKey", "authorization", "database_url"] {
        assert!(!main.contains(forbidden));
    }
}

#[test]
fn pre_005_opens_store_facade_without_backend_or_job_dependencies() {
    let root = app_root();
    let manifest = read_text(root.join("Cargo.toml").as_path());
    assert!(manifest.contains("ksp-config-lib = { path = \"../ksp-config-lib\" }"));
    assert!(manifest.contains("ksp-onchain-transport-lib = { path = \"../ksp-onchain-transport-lib\" }"));
    assert!(manifest.contains("ksp-store-lib = { path = \"../ksp-store-lib\" }"));
    for forbidden in ["ksp-job-backfill-lib", "ksp-store-api", "ksp-store-postgres-lib", "reqwest", "tokio-postgres"] {
        assert!(!manifest.contains(forbidden), "pre.005 opens a forbidden direct dependency: {forbidden}");
    }
    let bootstrap = read_text(root.join("src/bootstrap.rs").as_path());
    assert!(bootstrap.contains("LogFilterLevel::Trace"));
    assert!(!bootstrap.contains("HttpTransportPool"));
    assert!(!bootstrap.contains("Store::open"));
    let store = read_text(root.join("src/store_runtime.rs").as_path());
    assert!(store.contains("ksp_store_lib::Store::open"));
    assert!(store.contains("store.health().await"));
    assert!(store.contains("store.close().await"));
    for forbidden in ["connection_uri", "postgres", "database_url", "provider()", "endpoint_url"] {
        assert!(!store.contains(forbidden), "Store runtime leaks or depends on forbidden physical metadata marker {forbidden}");
    }
    let dto = read_text(root.join("src/dto_common.rs").as_path());
    assert!(dto.contains("BackfillDeskOptionsDto"));
    for forbidden in ["endpoint_url", "pub(crate) url", "pub(crate) credential", "pub(crate) token", "connection_uri"] {
        assert!(!dto.contains(forbidden), "readiness options DTO source contains forbidden field marker {forbidden}");
    }
}

#[test]
fn pre_006_frontend_receives_only_safe_http_route_metadata_and_no_endpoint_material() {
    let root = app_root();
    let dto = read_text(root.join("src/dto_common.rs").as_path());
    assert!(dto.contains("BackfillHttpRouteOptionDto"));
    assert!(dto.contains("pub(crate) providers"));
    assert!(dto.contains("pub(crate) role"));
    for forbidden in ["endpoint_url", "pub(crate) url", "pub(crate) credential", "pub(crate) api_key", "pub(crate) authorization"] {
        assert!(!dto.contains(forbidden), "route DTO leaks forbidden endpoint material marker {forbidden}");
    }
    let frontend = read_text(root.join("frontend/ts/main.ts").as_path());
    for forbidden in ["http://", "https://", "apiKey", "authorization", "token"] {
        assert!(!frontend.contains(forbidden), "frontend embeds forbidden provider material marker {forbidden}");
    }
}