use super::{
    make_attestation, verify_attestation, ArtifactRecord, Attestation, CaptureEnvelope,
    PublishEnvelope, TransformEnvelope,
};
use crate::checkpoint::CheckpointArtifact;

fn attestation() -> Attestation {
    Attestation {
        signer_id: "signer-1".to_string(),
        key_id: "key-1".to_string(),
        signature: "sig".to_string(),
        signed_at: "2026-01-01T00:00:00Z".to_string(),
    }
}

fn capture() -> CaptureEnvelope {
    CaptureEnvelope {
        schema_version: "1.0.0".to_string(),
        envelope_type: "capture".to_string(),
        issued_at: "2026-01-01T00:00:00Z".to_string(),
        subject_id: "capture-1".to_string(),
        capture_role: "transport".to_string(),
        capture_actor_id: "station-a".to_string(),
        capture_system_id: "rx-1".to_string(),
        capture_window: "2026-01-01T00:00:00Z/2026-01-01T00:05:00Z".to_string(),
        segment_ids: vec!["seg-1".to_string()],
        input_refs: vec![],
        output_refs: vec!["obj://raw/1".to_string()],
        segment_hashes: vec!["hash-1".to_string()],
        rolling_hash_state: Some("rolling-1".to_string()),
        content_root_hash: "root-1".to_string(),
        content_commitment_profile: "blake3_root_v1".to_string(),
        chunk_size: 3,
        leaf_count: 1,
        content_descriptor_ref: None,
        content_descriptor_hash: None,
        attestations: vec![attestation()],
        key_id: "key-1".to_string(),
        policy_profile_id: None,
    }
}

fn transform() -> TransformEnvelope {
    TransformEnvelope {
        schema_version: "1.0.0".to_string(),
        envelope_type: "transform".to_string(),
        issued_at: "2026-01-01T00:00:00Z".to_string(),
        subject_id: "transform-1".to_string(),
        transform_job_id: "job-1".to_string(),
        transform_stage: "nc_to_zarr".to_string(),
        input_refs: vec!["obj://raw/1".to_string()],
        output_refs: vec!["obj://zarr/1".to_string()],
        input_artifact_roots: vec!["root-in".to_string()],
        output_artifact_roots: vec!["root-out".to_string()],
        input_artifacts: vec![ArtifactRecord {
            artifact_id: "input-1".to_string(),
            artifact_ref: "obj://raw/1".to_string(),
            content_root_hash: "root-in".to_string(),
        }],
        output_artifacts: vec![ArtifactRecord {
            artifact_id: "output-1".to_string(),
            artifact_ref: "obj://zarr/1".to_string(),
            content_root_hash: "root-out".to_string(),
        }],
        toolchain: "rust".to_string(),
        parameters_ref: "cfg://1".to_string(),
        parameters_hash: "cfg-hash".to_string(),
        determinism_profile: "det-v1".to_string(),
        runtime_env_ref: Some("oci://img".to_string()),
        runtime_env_hash: Some("img-hash".to_string()),
        provenance_start_mode: "transport_capture".to_string(),
        source_manifest_ref: None,
        source_manifest_hash: None,
        source_root_hash: None,
        transform_spec_ref: Some("spec://1".to_string()),
        transform_spec_hash: Some("spec-hash".to_string()),
        chunking_profile_ref: Some("chunk://1".to_string()),
        chunking_profile_hash: Some("chunk-hash".to_string()),
        execution_manifest_ref: Some("exec://1".to_string()),
        execution_manifest_hash: Some("exec-hash".to_string()),
        runtime_manifest_ref: Some("runtime://1".to_string()),
        runtime_manifest_hash: Some("runtime-hash".to_string()),
        attestations: vec![attestation()],
        key_id: "key-1".to_string(),
    }
}

fn publish() -> PublishEnvelope {
    PublishEnvelope {
        schema_version: "1.0.0".to_string(),
        envelope_type: "publish".to_string(),
        issued_at: "2026-01-01T00:00:00Z".to_string(),
        subject_id: "publish-1".to_string(),
        dataset_id: "sst".to_string(),
        dataset_version: "v1".to_string(),
        input_refs: vec!["obj://zarr/1".to_string()],
        output_refs: vec!["obj://release/1".to_string()],
        published_artifacts: vec![CheckpointArtifact {
            artifact_id: "artifact-1".to_string(),
            content_root_hash: "root-1".to_string(),
            content_descriptor_ref: None,
            content_descriptor_hash: None,
            media_type: "application/vnd+zarr".to_string(),
        }],
        primary_artifact_id: "artifact-1".to_string(),
        checkpoint_manifest_ref: "checkpoint://1".to_string(),
        checkpoint_manifest_hash: "checkpoint-hash".to_string(),
        checkpoint_id: "checkpoint-1".to_string(),
        checkpoint_log_root_hash: "checkpoint-log-root".to_string(),
        lineage_refs: vec!["capture://1".to_string(), "transform://1".to_string()],
        verification_policy_id: "verify-default".to_string(),
        attestations: vec![attestation()],
        key_id: "key-1".to_string(),
        stac_refs: vec![],
        reward_context_ref: None,
        reward_context_hash: None,
        provenance_start_mode: "transport_capture".to_string(),
        bootstrap_origin_label: None,
        reward_eligible: false,
    }
}

#[test]
fn capture_envelope_validates() {
    assert!(capture().validate().is_ok());
}

#[test]
fn capture_envelope_rejects_unknown_capture_role() {
    let mut envelope = capture();
    envelope.capture_role = "unknown".to_string();
    let errors = envelope
        .validate()
        .expect_err("unknown capture role must fail validation");
    assert!(errors.iter().any(|e| e.contains("capture_role")));
}

#[test]
fn transform_envelope_validates() {
    assert!(transform().validate().is_ok());
}

#[test]
fn dataset_bootstrap_transform_requires_spec_and_source_manifest_fields() {
    let mut env = transform();
    env.provenance_start_mode = "dataset_bootstrap".to_string();
    env.source_manifest_ref = None;
    env.source_manifest_hash = None;
    env.source_root_hash = None;
    env.transform_spec_ref = None;
    env.transform_spec_hash = None;

    let errors = env
        .validate()
        .expect_err("bootstrap transform must require spec and source");
    assert!(errors.iter().any(|e| e.contains("source_manifest_ref")));
    assert!(errors.iter().any(|e| e.contains("source_manifest_hash")));
    assert!(errors.iter().any(|e| e.contains("source_root_hash")));
    assert!(errors.iter().any(|e| e.contains("transform_spec_ref")));
    assert!(errors.iter().any(|e| e.contains("transform_spec_hash")));
}

#[test]
fn dataset_incremental_transform_requires_spec_and_source_manifest_fields() {
    let mut env = transform();
    env.provenance_start_mode = "dataset_incremental".to_string();
    env.source_manifest_ref = None;
    env.source_manifest_hash = None;
    env.source_root_hash = None;
    env.transform_spec_ref = None;
    env.transform_spec_hash = None;

    let errors = env
        .validate()
        .expect_err("incremental transform must require spec and source");
    assert!(errors.iter().any(|e| e.contains("source_manifest_ref")));
    assert!(errors.iter().any(|e| e.contains("source_manifest_hash")));
    assert!(errors.iter().any(|e| e.contains("source_root_hash")));
    assert!(errors.iter().any(|e| e.contains("transform_spec_ref")));
    assert!(errors.iter().any(|e| e.contains("transform_spec_hash")));
}

#[test]
fn publish_envelope_validates() {
    assert!(publish().validate().is_ok());
}

#[test]
fn dataset_bootstrap_publish_requires_origin_label() {
    let mut env = publish();
    env.provenance_start_mode = "dataset_bootstrap".to_string();
    env.bootstrap_origin_label = None;

    let errors = env
        .validate()
        .expect_err("bootstrap publish must require origin label");
    assert!(errors.iter().any(|e| e.contains("bootstrap_origin_label")));
}

#[test]
fn make_attestation_uses_ed25519_signatures() {
    const TEST_SIGNING_KEY_HEX: &str =
        "4f3edf983ac636a65a842ce7c78d9aa706d3b113bce036f9a4f5762b76f70f18";
    let payload = publish().canonical_attestation_payload_bytes();
    let att = make_attestation(
        "signer-1",
        TEST_SIGNING_KEY_HEX,
        "2026-01-01T00:00:00Z",
        &payload,
    )
    .expect("build attestation");
    assert!(verify_attestation(&att, &payload));
}
