// file: crates/ksp-app-raw-transaction-ingest-desk/tests/desktop_security.rs
// version: 5

//! Desktop security canaries for the Raw Transaction Ingest Desk scaffold.

#![forbid(unsafe_code)]
#![deny(unreachable_pub)]
#![warn(missing_docs)]

fn app_root() -> std::path::PathBuf {
    return std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"));
}

fn read_text(path: &std::path::Path) -> String {
    let source = std::fs::read_to_string(path);
    assert!(source.is_ok(), "unable to read {}", path.display());
    return match source {
        std::result::Result::Ok(value) => value,
        std::result::Result::Err(_) => String::new(),
    };
}

fn collect_typescript(root: &std::path::Path, files: &mut std::vec::Vec<std::path::PathBuf>) {
    let entries = std::fs::read_dir(root);
    if let std::result::Result::Ok(entries) = entries {
        for entry in entries.flatten() {
            let path = entry.path();
            if path.is_dir() {
                collect_typescript(path.as_path(), files);
            } else if path.extension().and_then(std::ffi::OsStr::to_str) == std::option::Option::Some("ts") {
                files.push(path);
            }
        }
    }
}

#[test]
fn pre_005_capability_surface_is_core_plus_tracing_only() {
    let capability = read_text(app_root().join("capabilities/default.json").as_path());
    assert!(capability.contains("\"core:default\""));
    assert!(capability.contains("\"tracing:default\""));
    for forbidden in ["dialog:", "fs:", "http:", "shell:"] {
        assert!(!capability.contains(forbidden));
    }
}

#[test]
fn pre_005_frontend_has_no_network_persistence_or_native_dialog_surface() {
    let mut files = std::vec::Vec::new();
    collect_typescript(app_root().join("frontend/ts").as_path(), &mut files);
    assert!(!files.is_empty());
    for path in files {
        let source = read_text(path.as_path());
        for forbidden in ["fetch(", "XMLHttpRequest", "localStorage", "sessionStorage", "window.alert(", "window.confirm(", "window.prompt("] {
            assert!(!source.contains(forbidden), "{} contains forbidden frontend surface {forbidden}", path.display());
        }
    }
}

#[test]
fn pre_006_frontend_tracing_is_control_inventory_and_command_oriented_only() {
    let main = read_text(app_root().join("frontend/ts/main.ts").as_path());
    assert!(main.contains("frontend control clicked"));
    assert!(main.contains("navigation tab clicked"));
    assert!(main.contains("runtime status refresh requested"));
    assert!(main.contains("Config route inventory refresh requested"));
    assert!(main.contains("logical network selected"));
    let invoke = read_text(app_root().join("frontend/ts/invoke.ts").as_path());
    assert!(invoke.contains("Frontend IPC command requested"));
    for forbidden in ["apiKey", "authorization", "connectionUri", "endpointUrl", "sourceKey", "rawTransaction", "transactionPayload", "x-token"] {
        assert!(!main.contains(forbidden), "frontend contains forbidden sensitive marker {forbidden}");
    }
}

#[test]
fn pre_006_route_inventory_dto_surface_excludes_endpoint_secret_and_physical_store_fields() {
    let dto = read_text(app_root().join("src/dto_route.rs").as_path());
    for required in ["RawIngestRouteInventoryDto", "RawIngestProfileInventoryDto", "RawIngestRouteUnavailableReason"] {
        assert!(dto.contains(required));
    }
    for forbidden in ["endpoint_name", "endpoint_url", "api_key", "connection_uri", "source_key", "secret_metadata", "worker_handle"] {
        assert!(!dto.contains(forbidden), "route DTO contains forbidden field marker {forbidden}");
    }
}

#[test]
fn pre_007_start_request_and_acknowledgement_are_logical_only_and_resource_free() {
    let dto = read_text(app_root().join("src/dto_route.rs").as_path());
    for required in ["profile_id", "route_id", "inventory_generation", "commitment", "network"] {
        assert!(dto.contains(required), "missing safe Start field marker {required}");
    }
    for forbidden in [
        "endpoint_name",
        "endpoint_url",
        "api_key",
        "connection_uri",
        "source_key",
        "secret_metadata",
        "worker_handle",
        "http_pool",
        "ws_endpoint",
        "yellowstone_channel",
    ] {
        assert!(!dto.contains(forbidden), "Start DTO exposes forbidden physical marker {forbidden}");
    }
    let route_start = read_text(app_root().join("src/route_start.rs").as_path());
    assert!(route_start.contains("ERROR_CODE_ROUTE_START_STALE_INVENTORY"));
    assert!(route_start.contains("build_route_inventory_with_environment"));
    assert!(route_start.contains("resolve_store_config_profile"));
    assert!(!route_start.contains("with_context(\"endpoint\""));
    assert!(!route_start.contains("with_context(\"provider\""));
}

#[test]
fn pre_008_runtime_acknowledgement_and_frontend_tracing_remain_secret_and_handle_free() {
    let dto = read_text(app_root().join("src/dto_route.rs").as_path());
    assert!(dto.contains("RawIngestRouteRuntimeDto"));
    for forbidden in ["worker_id", "worker_handle", "endpoint_url", "connection_uri", "api_key", "source_key"] {
        assert!(!dto.contains(forbidden), "runtime DTO exposes forbidden marker {forbidden}");
    }
    let main = read_text(app_root().join("frontend/ts/main.ts").as_path());
    for required in ["profileId", "routeId", "commitment", "state"] {
        assert!(main.contains(required), "missing safe runtime trace marker {required}");
    }
    for forbidden in ["endpointUrl", "connectionUri", "workerId", "sourceKey", "x-token", "rawTransaction"] {
        assert!(!main.contains(forbidden), "frontend runtime trace exposes forbidden marker {forbidden}");
    }
}