package domains_test

import (
	"strings"
	"testing"

	"github.com/carlosframework/platform/internal/domains"
	"github.com/carlosframework/platform/internal/release"
)

func TestSqidGolden(t *testing.T) {
	// FROZEN 2026-08-02 (first green run of the id+23² base-23 scheme). If
	// this test fails you are re-homing every platform domain ever minted —
	// ops's sqid is baked into every <app>.bab.<apps-domain> URL in the
	// wild. Do not "fix" the expectations; fix your code.
	golden := map[int64]string{
		1:    "bab", // ops — the built-in account, on every deployment
		2:    "bac",
		23:   "bba",
		24:   "bbb",
		529:  "caa",
		1000: "cxn",
	}
	goldenSeen := map[string]int64{}
	for id, want := range golden {
		s := domains.Sqid(id)
		if s != want {
			t.Errorf("Sqid(%d) = %q, want frozen %q", id, s, want)
		}
		if len(s) < 3 {
			t.Errorf("Sqid(%d)=%q shorter than 3", id, s)
		}
		for _, c := range s {
			if !strings.ContainsRune("abcdefghjkmnpqrstuvwxyz", c) {
				t.Errorf("Sqid(%d)=%q uses %q outside the frozen alphabet", id, s, c)
			}
		}
		if prev, dup := goldenSeen[s]; dup {
			t.Errorf("collision: %d and %d both %q", prev, id, s)
		}
		goldenSeen[s] = id
	}
}

// TestValidSqid pins the predicate the CLI's -account-id gate rests on. The
// case that matters is the i/l/o rows: release.ValidAccount (^[a-z]{3,16}$)
// accepts every one of them, because it gates bucket path segments and every
// account NAME is a legal segment. ValidSqid must not — "ops" passing here
// is `carlos ship -account-id ops` writing to apps/ops/..., exiting 0, and
// serving nothing, when the real ops account is Sqid(1) = "bab".
func TestValidSqid(t *testing.T) {
	for _, tc := range []struct {
		s    string
		want bool
	}{
		{"bab", true},              // ops, the built-in account
		{"zzz", true},              // never minted here, but shaped like something Sqid emits
		{"baf", true},              //
		{"abc", true},              // the 3-char floor sqidOffset guarantees
		{"abcdefghjkmnpqrs", true}, // 16, Sqid's buffer ceiling

		// The lookalikes the alphabet drops. Each of these passes
		// release.ValidAccount and is therefore exactly the bug.
		{"ops", false}, // o
		{"oil", false}, // o, i, l
		{"ill", false}, // i, l
		{"kass", true}, // a real account NAME that IS sqid-shaped: see below
		{"amadan", true},

		{"ab", false},                // under the 3 floor
		{"abcdefghjkmnpqrst", false}, // over the 16 ceiling
		{"", false},                  //
		{"BAB", false},               // uppercase is not the alphabet
		{"ba1", false},               // digits are not the alphabet
		{"ba-b", false},              // nor is a hyphen
		{"ba b", false},              // nor a space (callers must trim first)
	} {
		if got := domains.ValidSqid(tc.s); got != tc.want {
			t.Errorf("ValidSqid(%q) = %v, want %v", tc.s, got, tc.want)
		}
	}

	// The honest limit of a shape check, stated so nobody mistakes it for
	// more: a NAME made only of alphabet letters ("kass", "amadan") is
	// indistinguishable from a sqid by shape alone, and passes. -account-id
	// is matched exactly against the account space, so such a value simply
	// resolves to nothing rather than to the wrong account — the failure is
	// a 404, not a silent write under a phantom account. It is the i/l/o
	// names, and only those, that a shape check can catch for free.

	// Every sqid the encoder can actually emit must satisfy the predicate:
	// the two are frozen together, and this is the direction that would
	// break first if the alphabet or the buffer ever changed.
	for id := int64(1); id < 20000; id++ {
		if s := domains.Sqid(id); !domains.ValidSqid(s) {
			t.Fatalf("Sqid(%d) = %q, which ValidSqid rejects", id, s)
		}
	}
}

// The frozen alphabet omits i, l and o, so no id encodes to "legacy" — which is
// what lets release.LegacySource use that word as a sentinel for the
// account-less key space in `carlos accounts migrate -from legacy`. If the
// alphabet ever gains an "l", the sentinel silently becomes a real account's
// sqid and the verb starts reading one as the other. Fail here first.
//
// The emitted character set is derived from Sqid itself rather than read off
// the constant: this test lives outside the package, and asserting on what the
// encoder actually produces is the stronger check anyway.
func TestLegacySourceIsNotASqid(t *testing.T) {
	emitted := map[rune]bool{}
	for id := int64(1); id < 20000; id++ {
		for _, r := range domains.Sqid(id) {
			emitted[r] = true
		}
	}
	if len(emitted) != 23 {
		t.Fatalf("saw %d distinct characters over 20k ids, want the full 23 — widen the range", len(emitted))
	}
	for _, r := range release.LegacySource {
		if !emitted[r] {
			return // a character the encoder can never emit: no id can collide
		}
	}
	t.Fatalf("every character of %q is one the sqid encoder emits — the sentinel can collide with a real account sqid",
		release.LegacySource)
}