import { SelectQuery } from '../src/core/ast';
import { UserContext } from '../src/core/context';
import { executeRelationFacets } from '../src/core/facet';
import { PLAINTEXT_LOG_ACK, PLAINTEXT_LOG_ENV } from '../src/core/log-privacy';
import { AbstractSQLTeaQLClient, EntitySchema, SQLExecutionEvidenceStore,
  SQLExecutionMetadata, TextDiagnosticSQLLogSink } from '../src/sql/core';
import { SQLiteDriver } from '../src/sql/sqlite';

const secret = 'FACET-PRIVATE-SCHOOL';
const futureSecret = 'FACET-PRIVATE-PLATFORM';
const column = (name: string, text = false) => ({ columnName: name,
  logicalType: text ? 'text' as const : 'integer' as const,
  decode: 'string' as const, logPolicy: 'plain' as const });
const schemas: Record<string, EntitySchema> = {
  School: { table: 'like_school', auditMaskFields: ['name'], columns: {
    id: column('id'), version: column('version'), platform: column('platform'),
    name: column('name', true), publicName: column('public_name', true),
    password: column('password', true), unknownName: { ...column('unknown_name', true), logPolicy: 'unknown' },
  }, relations: { platform: { targetEntity: 'Platform', localKey: 'platform', foreignKey: 'id', many: false } } },
  Platform: { table: 'like_platform', auditMaskFields: ['name'], columns: {
    id: column('id'), version: column('version'), name: column('name', true),
  } },
};
class Driver extends SQLiteDriver {
  readonly reads: { sql: string; values: unknown[] }[] = [];
  async query(sql: string, values: any[] = []) {
    if (sql.startsWith('SELECT')) this.reads.push({ sql, values: [...values] });
    return super.query(sql, values);
  }
}
class Client extends AbstractSQLTeaQLClient {
  constructor(readonly transport = new Driver(':memory:')) { super(transport, schemas); }
}
const previous = process.env[PLAINTEXT_LOG_ENV];
beforeEach(() => { delete process.env[PLAINTEXT_LOG_ENV]; });
afterEach(() => {
  if (previous === undefined) delete process.env[PLAINTEXT_LOG_ENV];
  else process.env[PLAINTEXT_LOG_ENV] = previous;
});

async function fixture(logging: boolean, value = secret) {
  const client = new Client().setDiagnosticSQLLogSink(undefined);
  await new UserContext().insertResource('dataService', client).ensureSchema();
  await client.executeMutation({ entity: 'Platform', action: 'Create', id: '1',
    payload: { name: `${futureSecret}-tail` }, comment: 'seed LIKE privacy fixture' });
  for (const [id, name] of [['1', `${value}-tail`], ['2', `head-${value}`]]) {
    await client.executeMutation({ entity: 'School', action: 'Create', id,
      payload: { name, publicName: name, password: name, unknownName: name, platform: '1' },
      comment: 'seed LIKE privacy fixture' });
  }
  const evidence = new SQLExecutionEvidenceStore();
  const diagnostics: SQLExecutionMetadata[] = [], text: string[] = [];
  client.setRuntimeTelemetrySink(evidence).setQueryLoggingEnabled(logging)
    .setDiagnosticSQLLogSink({ write(entry) {
      diagnostics.push(entry); new TextDiagnosticSQLLogSink(line => text.push(line)).write(entry);
    } });
  client.transport.reads.length = 0;
  return { client, evidence, diagnostics, text };
}

it.each(['$startsWith', '$notStartsWith', '$endsWith', '$notEndsWith'].flatMap(operator =>
  [false, true].map(logging => [operator, logging] as const)))(
  'masks original LIKE operand at real safe sinks: %s logging=%p', async (operator, logging) => {
    const f = await fixture(logging);
    const query = new SelectQuery('School').filter({ name: { [operator]: secret } }).limit(10)
      .comment(`load ${secret}`).purpose(`inspect ${secret}`);
    const before = JSON.stringify(query);
    try {
      const rows = await f.client.executeQuery<any>(query);
      const expectFirst = operator === '$startsWith' || operator === '$notEndsWith';
      expect(rows.map(row => row.id)).toEqual([expectFirst ? '1' : '2']);
      expect(f.client.transport.reads).toHaveLength(1);
      expect(f.client.transport.reads[0].values).toEqual([
        operator.toLowerCase().includes('startswith') ? `${secret}%` : `%${secret}`, 10,
      ]);
      expect(f.evidence.snapshot()).toHaveLength(1);
      const entry = f.evidence.snapshot()[0];
      expect(entry.comment).toBe('load [REDACTED]');
      expect(entry.purpose).toBe('inspect [REDACTED]');
      expect(entry.executionOutcome).toBe('success');
      expect(entry.resultCount).toBe(1);
      expect(entry.logMode).toBe('masked');
      expect(entry.parameterLogPolicies).toEqual(['masked', 'plain']);
      expect(entry.tracePath.map(node => node.name)).toEqual(['School', 'School', 'sqlite', 'select']);
      expect(JSON.stringify([f.evidence.snapshot(), f.diagnostics, f.text])).not.toContain(secret);
      expect(f.diagnostics).toHaveLength(logging ? 1 : 0);
      expect(JSON.stringify(query)).toBe(before);
      await f.client.executeQuery(new SelectQuery('Platform').limit(1)
        .comment(`independent ${secret}`).purpose('no inherited binding'));
      expect(f.evidence.snapshot()[1].comment).toBe(`independent ${secret}`);
    } finally { await f.client.close(); }
  });

it.each([false, true])('carries LIKE operand provenance through future Facets, logging=%p', async logging => {
  const f = await fixture(logging);
  try {
    const child = new SelectQuery('Platform').filter({ name: { $startsWith: futureSecret } })
      .limit(10).aggregate('Count', 'id', 'schoolCount');
    const query = new SelectQuery('School').filter({ name: { $startsWith: secret } }).limit(10)
      .facetBy('platforms', 'platform', { toQuery: () => child }, false)
      .comment(`load ${secret} via ${futureSecret}`).purpose(`inspect ${secret} ${futureSecret}`);
    const before = JSON.stringify(query);
    expect((await f.client.executeQuery<any>(query)).map(row => row.id)).toEqual(['1']);
    const facets = await executeRelationFacets(f.client, value => value, query, query.facets);
    expect(facets.platforms.map(row => [row.id, row.schoolCount])).toEqual([['1', 1]]);
    const entries = f.evidence.snapshot();
    expect(entries).toHaveLength(3);
    expect(entries.map(entry => entry.tracePath.filter(node => node.kind === 'relation').map(node => node.name)))
      .toEqual([[], [], ['platform']]);
    for (const entry of entries) {
      expect(entry.comment).toBe('load [REDACTED] via [REDACTED]');
      expect(entry.purpose).toBe('inspect [REDACTED] [REDACTED]');
    }
    expect(f.client.transport.reads[0].values).toEqual([`${secret}%`, 10]);
    expect(f.client.transport.reads[2].values).toContain(`${futureSecret}%`);
    expect(f.diagnostics).toHaveLength(logging ? 3 : 0);
    expect(JSON.stringify([entries, f.diagnostics, f.text])).not.toMatch(/FACET-PRIVATE-(SCHOOL|PLATFORM)/);
    expect(JSON.stringify(query)).toBe(before);
  } finally { await f.client.close(); }
});

it.each(['$eq', '$startsWith'])('does not infer sensitive substrings by stripping literal wildcards: %s', async operator => {
  const literal = '%LITERAL_WILDCARD%\\';
  const f = await fixture(true, literal);
  try {
    const operand = operator === '$eq' ? `${literal}-tail` : literal;
    const query = new SelectQuery('School').filter({ name: { [operator]: operand } }).limit(10)
      .comment(`private ${operand}; public LITERAL_WILDCARD`).purpose('preserve exact operand');
    // Preserve the existing SQL LIKE semantics: the caller's leading % is
    // still a wildcard, so the prefix form matches both seeded rows.
    expect(await f.client.executeQuery(query)).toHaveLength(operator === '$eq' ? 1 : 2);
    expect(f.client.transport.reads[0].values).toEqual([operator === '$eq' ? operand : `${operand}%`, 10]);
    expect(f.evidence.snapshot()[0].comment).toBe('private [REDACTED]; public LITERAL_WILDCARD');
    expect(query.commentText).toBe(`private ${operand}; public LITERAL_WILDCARD`);
  } finally { await f.client.close(); }
});

it.each(['name', 'publicName', 'password', 'unknownName'].flatMap(field =>
  [false, true].map(debug => [field, debug] as const)))(
  'retains original field policy for LIKE operand: %s debug=%p', async (field, debug) => {
    const f = await fixture(true);
    if (debug) process.env[PLAINTEXT_LOG_ENV] = PLAINTEXT_LOG_ACK;
    try {
      const query = new SelectQuery('School').filter({ [field]: { $startsWith: secret } }).limit(10)
        .comment(`load ${secret}`).purpose('verify source policy');
      expect(await f.client.executeQuery(query)).toHaveLength(1);
      const visible = field === 'publicName' || (field === 'name' && debug);
      expect(f.evidence.snapshot()[0].comment).toBe(`load ${visible ? secret : '[REDACTED]'}`);
      expect(f.client.transport.reads[0].values).toEqual([`${secret}%`, 10]);
      if (!visible) expect(JSON.stringify([f.evidence.snapshot(), f.diagnostics, f.text])).not.toContain(secret);
      if (debug && field === 'name') {
        delete process.env[PLAINTEXT_LOG_ENV];
        const safeText: string[] = [];
        new TextDiagnosticSQLLogSink(line => safeText.push(line)).write(f.diagnostics[0]);
        expect(safeText.join('\n')).not.toContain(secret);
      }
    } finally { await f.client.close(); }
  });