//! C5 example 2 — exploratory (not a committed regression test). Four topically
//! distinct findings, to see whether tuned semantic retrieval maps each to the
//! right master-control family. Run:
//!   export ... (LITELLM_* + BREAKPILOT_BASE_URL)
//!   cargo test -p compliance-agent --test c5_example2 -- --ignored --nocapture

mod common;

use std::sync::Arc;

use compliance_agent::llm::LlmClient;
use compliance_core::config::BreakpilotConfig;
use compliance_core::models::finding::{Finding, Severity};
use compliance_core::models::scan::ScanType;
use secrecy::SecretString;

fn env(k: &str) -> String {
    std::env::var(k).unwrap_or_else(|_| panic!("env {k} must be set"))
}

fn mk(file: &str, line: u32, title: &str, desc: &str) -> Finding {
    let mut f = Finding::new(
        "repo-c5b".into(),
        format!("{file}:{line}"),
        "semgrep".into(),
        ScanType::Sast,
        title.into(),
        desc.into(),
        Severity::High,
    );
    f.file_path = Some(file.into());
    f.line_number = Some(line);
    f
}

fn write(repo: &std::path::Path, rel: &str, body: &str) {
    let p = repo.join(rel);
    if let Some(parent) = p.parent() {
        std::fs::create_dir_all(parent).unwrap();
    }
    std::fs::write(p, body).unwrap();
}

#[tokio::test]
#[ignore = "live: api-dev + LiteLLM"]
async fn c5b_varied_findings() {
    let llm = Arc::new(LlmClient::new(
        env("LITELLM_URL"),
        SecretString::from(env("LITELLM_API_KEY")),
        env("LITELLM_MODEL"),
        env("LITELLM_EMBED_MODEL"),
    ));
    let mut config = common::dev_config("mongodb://unused".into(), "c5b".into());
    config.breakpilot = BreakpilotConfig {
        base_url: Some(env("BREAKPILOT_BASE_URL")),
        token: None,
        snapshot_dir: std::env::temp_dir()
            .join("c5-oscal-snap")
            .to_string_lossy()
            .into_owned(),
        semantic_mapping: true,
        grounded_control_checks: false,
    };

    let repo = std::env::temp_dir().join("c5b-fixture-repo");
    let _ = std::fs::remove_dir_all(&repo);
    write(
        &repo,
        "app/db.py",
        "import sqlite3\n\ndef get_user(username):\n    q = \"SELECT * FROM users WHERE name = '\" + username + \"'\"\n    return conn.execute(q)\n",
    );
    write(
        &repo,
        "app/config.py",
        "# service config\nAPI_KEY = \"sk_live_51H8xYz3kQ9v2bNmR7wT4uSpQ\"\nDB_HOST = \"db.internal\"\n",
    );
    write(
        &repo,
        "app/net.py",
        "import requests\n\ndef fetch(url):\n    return requests.get(url, verify=False, timeout=5)\n",
    );
    write(
        &repo,
        "app/ser.py",
        "import pickle\n\ndef load_state(blob):\n    return pickle.loads(blob)\n",
    );

    let mut findings = vec![
        mk(
            "app/db.py",
            4,
            "SQL injection via string-concatenated query",
            "User input is concatenated directly into a SQL statement, allowing SQL injection.",
        ),
        mk(
            "app/config.py",
            2,
            "Hardcoded API credential in source",
            "A live API key is hardcoded in source code instead of a secret store.",
        ),
        mk(
            "app/net.py",
            4,
            "TLS certificate verification disabled",
            "requests is called with verify=False, disabling TLS certificate validation.",
        ),
        mk(
            "app/ser.py",
            3,
            "Insecure deserialization with pickle.loads",
            "Untrusted data is deserialized with pickle.loads, allowing remote code execution.",
        ),
    ];

    let tagged =
        compliance_agent::controls::semantic_stamp_findings(&config, llm, &repo, &mut findings)
            .await;
    println!("\n=== C5 example 2: varied findings ===");
    for f in &findings {
        println!("  {:52} -> {:?}", f.title, f.control_refs);
    }
    println!("tagged: {tagged}/4");
    let _ = std::fs::remove_dir_all(&repo);
    assert!(tagged >= 1);
}