import assert from 'node:assert/strict';
import { readFile } from 'node:fs/promises';
import { createRequire } from 'node:module';
import path from 'node:path';
import test from 'node:test';

// RI-1-002 / RI-N1 publish-gate NEGATIVE CONTROLS (SDLC-D-034).
//
// scripts/verify-release.test.mjs pins the POSITIVE structure of the publish
// gate: every publish effect declares a direct `depends_on: verify` edge and
// the verify step asserts commit identity + runs the canonical command. This
// suite is the negative-control set: each test feeds a structural gate
// checker a pipeline in which the gate is bypassed by ONE specific shape and
// asserts the checker goes RED. The controls prove from the pipeline FILE —
// never by executing Woodpecker — that a verify step that FAILS (nonzero
// exit) blocks every publish effect.
//
// Woodpecker semantics these controls rely on:
//   - A step that exits nonzero FAILS, and every step that transitively
//     depends on a failed step is SKIPPED — never run. That skip is the only
//     thing standing between a failed mandatory check and a publish effect.
//   - `detach: true` removes the step from the wait graph: the pipeline does
//     not wait for detached steps, so their failure can never block anything.
//   - `failure: ignore` reports a failed step as success to the DAG.
//   - `success: [codes...]` overrides which exit codes count as success;
//     admitting any nonzero code launders a failed verification into green.
//   - `when` on the verify step would skip verification entirely on some
//     event/path classes while publish effects still run.
//
// Bypass shapes covered (one negative-control test each):
//   S1  Missing edge — a publish effect whose dependency closure does not
//       contain `verify` (a refactor drops the depends_on entry).
//   S2  Hidden effect — a step whose NAME does not start with `publish` but
//       whose COMMANDS publish npm packages or push images. Effects are
//       classified by commands, so renaming a step cannot un-gate it.
//   S3  Detached verify — `verify: { detach: true }`: publish steps no longer
//       wait for verify, so the depends_on edge is decorative.
//   S4  Always-pass verify — `failure: ignore`, or a `success` override
//       admitting nonzero exit codes: verify fails, the DAG sees success.
//   S5  Conditional verify — a `when`/path filter on verify itself.
//   S6  Exact-commit drift — a HEAD-moving step (git checkout/switch/reset/
//       clean/pull/clone/fetch) ordered between `verify` and a publish
//       effect: the verified commit would not be the published commit. A
//       LEGITIMATE re-checkout is allowed only when `verify` itself runs
//       after it — positive control included.
//   S7  Gate removal — the verify step deleted or renamed away entirely.

// Reuse the monorepo's existing YAML parser (@mosaicstack/mosaic's direct
// dependency) instead of adding a root dependency or vendoring a parser.
const mosaicRequire = createRequire(
  path.resolve(process.cwd(), 'packages', 'mosaic', 'package.json'),
);
const { parse: parseYaml } = mosaicRequire('yaml');

const publishYmlPath = path.join(process.cwd(), '.woodpecker', 'publish.yml');

async function readPublishPipeline() {
  return parseYaml(await readFile(publishYmlPath, 'utf8'));
}

// A command has a publish EFFECT when it publishes npm packages (`publish`
// anywhere after a package-manager token — `pnpm --filter "@x/*" publish`
// puts flags and quoted filters between the binary and the subcommand) or
// pushes an image (kaniko, docker push, or a registry --destination).
// Deliberately over-broad: a false positive forces justification, a false
// negative is the actual hazard.
function isPublishCommand(command) {
  return (
    /(^|\s)\/kaniko\/executor\b/.test(command) ||
    /(^|\s)docker\s+push\b/.test(command) ||
    /(^|\s)--destination(\s|=)/.test(command) ||
    (/\bpublish\b/.test(command) && /(^|\s)(npm|pnpm|yarn)(\s|$)/.test(command))
  );
}

function hasPublishEffect(step) {
  return (step.commands ?? []).some(isPublishCommand);
}

// A step is a publish effect when its name says so OR (S2) when any of its
// commands does — classification must not depend on the name alone.
function publishEffectSteps(pipeline) {
  return Object.entries(pipeline.steps ?? {})
    .filter(([name, step]) => name.startsWith('publish') || hasPublishEffect(step))
    .map(([name]) => name);
}

// Transitive closure of a step's depends_on graph.
function dependencyClosure(pipeline, stepName, seen = new Set()) {
  const dependencies = pipeline.steps?.[stepName]?.depends_on ?? [];
  for (const dependency of dependencies) {
    if (seen.has(dependency)) continue;
    seen.add(dependency);
    dependencyClosure(pipeline, dependency, seen);
  }
  return seen;
}

// Deliberately over-broad: `git fetch` alone does not move HEAD, but the
// classic re-checkout pair is `git fetch && git reset --hard <remote>`; a
// fetch step sitting between verify and a publish effect deserves scrutiny,
// so the gate fails closed on it.
function movesHead(step) {
  return (step.commands ?? []).some((command) =>
    /(^|\s)git\s+(checkout|switch|reset|clean|pull|clone|fetch)\b/.test(command),
  );
}

// The structural gate checker: green only when a failed (nonzero-exit)
// verify provably blocks every publish effect on the same commit.
function assertPublishGateBlocksOnVerify(pipeline) {
  assert.ok(pipeline.steps, 'publish pipeline must define steps');
  const verify = pipeline.steps.verify;
  assert.ok(verify, 'publish pipeline must define a `verify` step (S7)');

  // S5: a skipped verification authorizes publishes exactly as much as a
  // failed one — verify must be unconditional.
  assert.equal(verify.when, undefined, '`verify` must not carry a when/path filter (S5)');

  // S3/S4: the depends_on edges are only meaningful if verify's own failure
  // is both awaited and terminal for the DAG.
  assert.equal(verify.detach, undefined, '`verify` must not be detached (S3)');
  assert.equal(
    verify.failure,
    undefined,
    '`verify` must not tolerate its own failure (S4: failure: ignore launders a failed gate into success)',
  );
  assert.equal(
    verify.success,
    undefined,
    '`verify` must not override success exit codes (S4: nonzero codes would make failed verification pass)',
  );

  const effects = publishEffectSteps(pipeline);
  assert.ok(effects.length > 0, 'publish pipeline must contain publish effect steps to guard');

  const verifyClosure = dependencyClosure(pipeline, 'verify');
  for (const stepName of effects) {
    // S1: only the failure-skip semantics of the DAG stand between a failed
    // verify and this effect — the verify edge in its closure is the proof.
    const closure = dependencyClosure(pipeline, stepName);
    assert.ok(
      closure.has('verify'),
      `publish effect '${stepName}' must transitively depend on verify (S1) — a failed verify must skip it`,
    );

    // S6: any step ordered after verify (outside its closure) but inside the
    // effect's chain must not be able to move HEAD. If the pipeline
    // legitimately re-checks-out, verify must run after the re-checkout.
    for (const chainStep of closure) {
      if (chainStep === 'verify' || verifyClosure.has(chainStep)) continue;
      assert.ok(
        !movesHead(pipeline.steps[chainStep]),
        `step '${chainStep}' sits between verify and publish effect '${stepName}' and can move HEAD (S6)` +
          ' — verify must re-run after any re-checkout',
      );
    }
  }
  return effects;
}

// A minimal but healthy gate used as the base for every negative-control
// mutation: verify (identity + canonical command) → build → publish-npm,
// with the publish effect blocked by verify both directly and through build.
const HEALTHY_GATE_YAML = `
steps:
  verify:
    image: node:24-alpine
    commands:
      - |
        if [ -z "$CI_COMMIT_SHA" ] || [ "$CI_COMMIT_SHA" != "$(git rev-parse HEAD)" ]; then
          echo "identity mismatch" >&2
          exit 1
        fi
      - pnpm verify:release
  build:
    image: node:24-alpine
    commands:
      - pnpm build
    depends_on:
      - verify
  publish-npm:
    image: node:24-alpine
    commands:
      - npm publish
    depends_on:
      - build
      - verify
`;

// Fresh parse per call so every negative control mutates its own object.
function healthyPipeline() {
  return parseYaml(HEALTHY_GATE_YAML);
}

test('the real publish pipeline: a failed verify provably blocks every publish effect', async () => {
  const pipeline = await readPublishPipeline();
  const effects = assertPublishGateBlocksOnVerify(pipeline);
  assert.deepEqual(effects.sort(), [
    'build-appservice',
    'build-gateway',
    'build-web',
    'publish-next-npm',
    'publish-npm',
  ]);
});

test('fixture sanity: the healthy gate base passes the checker unmutated', () => {
  assertPublishGateBlocksOnVerify(healthyPipeline());
});

test('S1 negative control: a publish effect with no verify edge fails the checker', () => {
  const pipeline = healthyPipeline();
  pipeline.steps['publish-npm'].depends_on = ['build'];
  pipeline.steps.build.depends_on = [];
  assert.throws(
    () => assertPublishGateBlocksOnVerify(pipeline),
    /publish-npm.*must transitively depend on verify/s,
  );
});

test('S2 negative control: an npm publish hidden behind a non-publish step name fails the checker', () => {
  const pipeline = healthyPipeline();
  delete pipeline.steps['publish-npm'];
  pipeline.steps.build.depends_on = [];
  pipeline.steps.deploy = {
    image: 'node:24-alpine',
    commands: ['npm publish'],
    depends_on: ['build'],
  };
  // Detection must be by COMMAND: the name says "deploy", the commands say
  // publish — an un-gated effect under either reading.
  assert.throws(
    () => assertPublishGateBlocksOnVerify(pipeline),
    /deploy.*must transitively depend on verify/s,
  );
});

test('S2 negative control: a kaniko image push under a build-* name fails the checker when ungated', () => {
  const pipeline = healthyPipeline();
  delete pipeline.steps['publish-npm'];
  pipeline.steps.build.depends_on = [];
  pipeline.steps['push-platform-image'] = {
    image: 'gcr.io/kaniko-project/executor:debug',
    commands: ['/kaniko/executor --context . --destination reg.example/img:latest'],
    depends_on: ['build'],
  };
  assert.throws(
    () => assertPublishGateBlocksOnVerify(pipeline),
    /push-platform-image.*must transitively depend on verify/s,
  );
});

test('S3 negative control: a detached verify fails the checker', () => {
  const pipeline = healthyPipeline();
  pipeline.steps.verify.detach = true;
  assert.throws(() => assertPublishGateBlocksOnVerify(pipeline), /detached \(S3\)/);
});

test('S4 negative control: failure: ignore on verify fails the checker', () => {
  const pipeline = healthyPipeline();
  pipeline.steps.verify.failure = 'ignore';
  assert.throws(() => assertPublishGateBlocksOnVerify(pipeline), /tolerate its own failure/);
});

test('S4 negative control: a success override admitting nonzero exit codes fails the checker', () => {
  const pipeline = healthyPipeline();
  pipeline.steps.verify.success = [0, 1];
  assert.throws(() => assertPublishGateBlocksOnVerify(pipeline), /success exit codes/);
});

test('S5 negative control: a when filter on verify fails the checker', () => {
  const pipeline = healthyPipeline();
  pipeline.steps.verify.when = [{ event: 'push' }];
  assert.throws(() => assertPublishGateBlocksOnVerify(pipeline), /when\/path filter \(S5\)/);
});

test('S6 negative control: a HEAD-moving step between verify and publish fails the checker', () => {
  const pipeline = healthyPipeline();
  pipeline.steps.resync = {
    image: 'node:24-alpine',
    commands: ['git fetch origin', 'git reset --hard origin/main'],
    depends_on: [],
  };
  pipeline.steps.build.depends_on = ['verify', 'resync'];
  // resync sits AFTER verify in the publish chain (verify does not depend on
  // it), so the verified commit could be replaced before publishing.
  assert.throws(() => assertPublishGateBlocksOnVerify(pipeline), /resync.*can move HEAD/s);
});

test('S6 positive control: a legitimate re-checkout passes when verify re-runs after it', () => {
  const pipeline = healthyPipeline();
  pipeline.steps.resync = {
    image: 'node:24-alpine',
    commands: ['git fetch origin', 'git reset --hard origin/main'],
    depends_on: [],
  };
  pipeline.steps.verify.depends_on = ['resync'];
  pipeline.steps.build.depends_on = ['verify'];
  // resync precedes verify in the chain, so verification covers the
  // re-checked-out HEAD — the exact-commit contract holds.
  assertPublishGateBlocksOnVerify(pipeline);
});

test('S7 negative control: deleting the verify step entirely fails the checker', () => {
  const pipeline = healthyPipeline();
  delete pipeline.steps.verify;
  pipeline.steps['publish-npm'].depends_on = ['build'];
  assert.throws(() => assertPublishGateBlocksOnVerify(pipeline), /`verify` step/);
});