"""Static contract and security checks for the invoice WordPress App Pack."""

from __future__ import annotations

import json
import sys
import unittest
from pathlib import Path


PROJECT_ROOT = Path(__file__).resolve().parents[3]
sys.path.insert(0, str(PROJECT_ROOT))
loaded_platform = sys.modules.get("platform")
if loaded_platform is not None and not hasattr(loaded_platform, "__path__"):
    del sys.modules["platform"]

import apps.wp_invoices as app


PACK = Path(__file__).resolve().parents[1] / "wordpress-pack" / "wp-invoices-wp"


class WordPressPackChecks(unittest.TestCase):
    @classmethod
    def setUpClass(cls):
        cls.manifest = json.loads((PACK / "wordpress-app-pack.json").read_text(encoding="utf-8"))
        cls.php = (PACK / "wp-invoices-wp.php").read_text(encoding="utf-8")

    def test_source_manifest_matches_app_contract(self):
        package = app.APP_MANIFEST.wordpress_package
        self.assertIsNotNone(package)
        self.assertEqual(package.package_id, self.manifest["package_id"])
        self.assertEqual(package.version, self.manifest["version"])
        self.assertEqual(package.plugin_file, self.manifest["plugin_file"])
        self.assertEqual(list(package.capabilities), self.manifest["capabilities"])
        self.assertFalse(self.manifest["contains_secrets"])

    def test_shortcode_and_public_helper_are_registered(self):
        self.assertIn("add_shortcode('ams_invoice_processor'", self.php)
        self.assertIn("function ams_invoice_submit_uploaded_file", self.php)
        self.assertIn("wp_flask_bridge_invoke(", self.php)
        self.assertIn("'submit_trusted_v1'", self.php)
        self.assertIn("'result_v1'", self.php)
        self.assertIn("'confirm_supplier_profile_v1'", self.php)
        self.assertIn("function ams_invoice_confirm_supplier_profile", self.php)

    def test_upload_has_authenticity_type_and_size_guards(self):
        self.assertIn("is_user_logged_in()", self.php)
        self.assertIn("wp_verify_nonce", self.php)
        self.assertIn("is_uploaded_file", self.php)
        self.assertIn("wp_check_filetype_and_ext", self.php)
        self.assertIn("AMS_INVOICE_MAX_BYTES", self.php)

    def test_pack_does_not_access_bridge_internals_or_embed_secrets(self):
        forbidden = (
            "AMS_WP_Flask_Bridge::",
            "create_jwt",
            "private_key",
            "OPENAI_API_KEY",
            "Authorization: Bearer",
            "wp_remote_post",
        )
        for value in forbidden:
            self.assertNotIn(value, self.php)

    def test_result_output_uses_wordpress_escaping(self):
        self.assertIn("esc_html", self.php)
        self.assertNotIn("print_r(", self.php)
        self.assertNotIn("var_dump(", self.php)

    def test_processing_indicator_is_hidden_before_submit(self):
        state_css = (PACK / "assets" / "invoice-processor-state.css").read_text(encoding="utf-8")
        self.assertIn("[hidden]", state_css)
        self.assertIn("display: none !important", state_css)

    def test_v2_ui_distinguishes_extraction_from_acceptance(self):
        self.assertIn("Invoice extracted — review required", self.php)
        self.assertIn("review_status", self.php)
        self.assertIn("invoice_type", self.php)
        self.assertIn("can assist future invoices", self.php)


if __name__ == "__main__":
    unittest.main(verbosity=2)