// file: crates/ksp-app-raw-transaction-ingest-desk/tests/desktop_security.rs
// version: 9

//! Desktop security canaries for the Raw Transaction Ingest Desk scaffold.

#![forbid(unsafe_code)]
#![deny(unreachable_pub)]
#![warn(missing_docs)]

fn app_root() -> std::path::PathBuf {
    return std::path::PathBuf::from(env!("CARGO_MANIFEST_DIR"));
}

fn read_text(path: &std::path::Path) -> String {
    let source = std::fs::read_to_string(path);
    assert!(source.is_ok(), "unable to read {}", path.display());
    return match source {
        std::result::Result::Ok(value) => value,
        std::result::Result::Err(_) => String::new(),
    };
}

fn collect_typescript(root: &std::path::Path, files: &mut std::vec::Vec<std::path::PathBuf>) {
    let entries = std::fs::read_dir(root);
    if let std::result::Result::Ok(entries) = entries {
        for entry in entries.flatten() {
            let path = entry.path();
            if path.is_dir() {
                collect_typescript(path.as_path(), files);
            } else if path.extension().and_then(std::ffi::OsStr::to_str) == std::option::Option::Some("ts") {
                files.push(path);
            }
        }
    }
}

#[test]
fn pre_005_capability_surface_is_core_plus_tracing_only() {
    let capability = read_text(app_root().join("capabilities/default.json").as_path());
    assert!(capability.contains("\"core:default\""));
    assert!(capability.contains("\"tracing:default\""));
    for forbidden in ["dialog:", "fs:", "http:", "shell:"] {
        assert!(!capability.contains(forbidden));
    }
}

#[test]
fn pre_005_frontend_has_no_network_persistence_or_native_dialog_surface() {
    let mut files = std::vec::Vec::new();
    collect_typescript(app_root().join("frontend/ts").as_path(), &mut files);
    assert!(!files.is_empty());
    for path in files {
        let source = read_text(path.as_path());
        for forbidden in ["fetch(", "XMLHttpRequest", "localStorage", "sessionStorage", "window.alert(", "window.confirm(", "window.prompt("] {
            assert!(!source.contains(forbidden), "{} contains forbidden frontend surface {forbidden}", path.display());
        }
    }
}

#[test]
fn pre_006_frontend_tracing_is_control_inventory_and_command_oriented_only() {
    let main = read_text(app_root().join("frontend/ts/main.ts").as_path());
    assert!(main.contains("frontend control clicked"));
    assert!(main.contains("navigation tab clicked"));
    assert!(main.contains("runtime status refresh requested"));
    assert!(main.contains("Config route inventory refresh requested"));
    assert!(main.contains("logical network selected"));
    let invoke = read_text(app_root().join("frontend/ts/invoke.ts").as_path());
    assert!(invoke.contains("Frontend IPC command requested"));
    for forbidden in ["apiKey", "authorization", "connectionUri", "endpointUrl", "sourceKey", "rawTransaction", "transactionPayload", "x-token"] {
        assert!(!main.contains(forbidden), "frontend contains forbidden sensitive marker {forbidden}");
    }
}

#[test]
fn pre_006_route_inventory_dto_surface_excludes_endpoint_secret_and_physical_store_fields() {
    let dto = read_text(app_root().join("src/dto_route.rs").as_path());
    for required in ["RawIngestRouteInventoryDto", "RawIngestProfileInventoryDto", "RawIngestRouteUnavailableReason"] {
        assert!(dto.contains(required));
    }
    for forbidden in ["endpoint_name", "endpoint_url", "api_key", "connection_uri", "source_key", "secret_metadata", "worker_handle"] {
        assert!(!dto.contains(forbidden), "route DTO contains forbidden field marker {forbidden}");
    }
}

#[test]
fn pre_007_start_request_and_acknowledgement_are_logical_only_and_resource_free() {
    let dto = read_text(app_root().join("src/dto_route.rs").as_path());
    for required in ["profile_id", "route_id", "inventory_generation", "commitment", "network"] {
        assert!(dto.contains(required), "missing safe Start field marker {required}");
    }
    for forbidden in [
        "endpoint_name",
        "endpoint_url",
        "api_key",
        "connection_uri",
        "source_key",
        "secret_metadata",
        "worker_handle",
        "http_pool",
        "ws_endpoint",
        "yellowstone_channel",
    ] {
        assert!(!dto.contains(forbidden), "Start DTO exposes forbidden physical marker {forbidden}");
    }
    let route_start = read_text(app_root().join("src/route_start.rs").as_path());
    assert!(route_start.contains("ERROR_CODE_ROUTE_START_STALE_INVENTORY"));
    assert!(route_start.contains("build_route_inventory_with_environment"));
    assert!(route_start.contains("resolve_store_config_profile"));
    assert!(!route_start.contains("with_context(\"endpoint\""));
    assert!(!route_start.contains("with_context(\"provider\""));
}

#[test]
fn pre_008_runtime_acknowledgement_and_frontend_tracing_remain_secret_and_handle_free() {
    let dto = read_text(app_root().join("src/dto_route.rs").as_path());
    assert!(dto.contains("RawIngestRouteRuntimeDto"));
    for forbidden in ["worker_id", "worker_handle", "endpoint_url", "connection_uri", "api_key", "source_key"] {
        assert!(!dto.contains(forbidden), "runtime DTO exposes forbidden marker {forbidden}");
    }
    let main = read_text(app_root().join("frontend/ts/main.ts").as_path());
    for required in ["profileId", "routeId", "commitment", "state"] {
        assert!(main.contains(required), "missing safe runtime trace marker {required}");
    }
    for forbidden in ["endpointUrl", "connectionUri", "workerId", "sourceKey", "x-token", "rawTransaction"] {
        assert!(!main.contains(forbidden), "frontend runtime trace exposes forbidden marker {forbidden}");
    }
}

#[test]
fn pre_010_monitoring_projection_is_source_neutral_payload_free_and_javascript_exact() {
    let monitoring = read_text(app_root().join("src/route_monitoring.rs").as_path());
    for required in [
        "sequence: String",
        "processing_frontier_slot: std::option::Option<String>",
        "continuity_frontier_slot: std::option::Option<String>",
        "fault_domain",
        "fault_code",
        "gaps: std::vec::Vec<crate::RawIngestRouteGapDto>",
    ] {
        assert!(monitoring.contains(required), "missing pre.010 safe monitoring marker {required}");
    }
    for forbidden in ["endpoint_url", "connection_uri", "api_key", "source_key", "worker_id", "x-token"] {
        assert!(!monitoring.contains(forbidden), "monitoring projection exposes forbidden physical marker {forbidden}");
    }
    let dto_start = monitoring.find("pub(crate) struct RawIngestRouteMonitoringDto");
    assert!(dto_start.is_some(), "monitoring DTO declaration is missing");
    let dto_start = match dto_start {
        std::option::Option::Some(value) => value,
        std::option::Option::None => return,
    };
    let dto_end = monitoring[dto_start..].find("/// Projects one complete concrete Worker snapshot");
    assert!(dto_end.is_some(), "monitoring DTO declaration boundary is missing");
    let dto_end = match dto_end {
        std::option::Option::Some(value) => dto_start + value,
        std::option::Option::None => return,
    };
    let dto_surface = &monitoring[dto_start..dto_end];
    for forbidden in ["raw_transaction", "signature", "payload", "canonical_bytes", "wire_bytes", "transaction_bytes"] {
        assert!(!dto_surface.contains(forbidden), "monitoring DTO exposes forbidden RAW marker {forbidden}");
    }
}

#[test]
fn pre_011_frontend_monitoring_tracing_is_source_neutral_and_does_not_log_raw_material() {
    let main = read_text(app_root().join("frontend/ts/main.ts").as_path());
    for required in [
        "route supervision selected",
        "route monitoring latest value applied",
        "route monitoring resynchronization requested",
        "route monitoring refresh button clicked",
        "commitment selection changed",
        "routeId",
        "sequence",
        "statusCount",
    ] {
        assert!(main.contains(required), "missing pre.011 safe tracing marker {required}");
    }
    for forbidden in [
        "endpointUrl",
        "connectionUri",
        "apiKey",
        "sourceKey",
        "workerId",
        "x-token",
        "rawTransaction",
        "transactionPayload",
        "canonicalBytes",
        "wireBytes",
        "transactionBytes",
        "signature",
    ] {
        assert!(!main.contains(forbidden), "pre.011 frontend exposes forbidden marker {forbidden}");
    }
    assert!(!main.contains("frontendTrace(\"main\", \"Raw Transaction Ingest Desk route monitoring latest value applied\", status"));
    assert!(!main.contains("frontendDebug(\"main\", \"Raw Transaction Ingest Desk route monitoring resynchronization completed\", statuses"));
}

#[test]
fn pre_012_hostile_ipc_is_shape_strict_bounded_and_safely_projected() {
    let dto = read_text(app_root().join("src/dto_route.rs").as_path());
    assert!(dto.matches("deny_unknown_fields").count() >= 2);
    assert!(dto.contains("RAW_INGEST_PROFILE_ID_MAX_BYTES: usize = 256"));
    assert!(dto.contains("validate_logical_identity"));
    assert!(dto.contains("ERROR_CODE_ROUTE_REQUEST_INVALID"));
    let frontend_logging = read_text(app_root().join("src/frontend_logging.rs").as_path());
    for required in [
        "deny_unknown_fields",
        "FRONTEND_LOG_MESSAGE_MAX_BYTES: usize = 8192",
        "FRONTEND_LOG_SELECTOR_MAX_BYTES: usize = 16",
        "payload.message.chars().any(char::is_control)",
        "ERROR_CODE_FRONTEND_LOG_PAYLOAD_INVALID",
        "eq_ignore_ascii_case",
    ] {
        assert!(frontend_logging.contains(required), "missing pre.012 frontend IPC guard {required}");
    }
    assert!(!frontend_logging.contains("to_ascii_lowercase()"));
    let frontend = read_text(app_root().join("frontend/ts/frontend_log.ts").as_path());
    assert!(frontend.contains("FRONTEND_LOG_MESSAGE_MAX_CODE_UNITS = 1024"));
    assert!(frontend.contains("boundMessage(message)"));
    let tauri = read_text(app_root().join("src/tauri.rs").as_path());
    assert!(tauri.contains("error_domain = error.code().domain()"));
    assert!(tauri.contains("error_code = error.code().code()"));
    assert!(!tauri.contains("error = ?error"));
}