alias OpenAgents.Changelog.Entry

  alias OpenAgents.Forge.{BuildReceipt, DeployReceipt, PushReceipt, Visibility}

  alias OpenAgents.Repo

  alias OpenAgents.Transparency

  @schema_version "openagents.changelog.v1"

  @cache_key {__MODULE__, :cache}

    |> Repo.insert(on_conflict: :nothing, conflict_target: [:repo, :sha, :source])

  end

  @doc """

  Returns `entry` with `trace_ref`, `trace_digest`, and `detail` redacted

  according to the effective transparency tier for `viewer`.

  `viewer` is a tier atom/string, a map with a `:tier` field, or `nil`.

  """

  def redact_for_viewer(%Entry{} = entry, viewer) do

    tier = entry.transparency_tier

    %{

      entry

      | trace_ref: if(Transparency.allows?(tier, :metadata, viewer), do: entry.trace_ref, else: nil),

        trace_digest: if(Transparency.allows?(tier, :metadata, viewer), do: entry.trace_digest, else: nil),

        detail: if(Transparency.allows?(tier, :content, viewer), do: entry.detail, else: %{})

    }

  end

  # ── assembly ─────────────────────────────────────────────────────────────

  defp cached(repo) do

  defp tier_atom(_), do: :dark

  defp viewer_tier(%{tier: tier}), do: tier_atom(tier)

  defp viewer_tier(tier) when is_atom(tier) or is_binary(tier), do: tier_atom(tier)

  defp viewer_tier(tier) when is_binary(tier), do: tier_atom(tier)

  defp viewer_tier(tier) when is_atom(tier) and not is_nil(tier), do: tier_atom(tier)

  defp viewer_tier(_), do: nil

  defp clamp(tier, viewer) do

  def change do

    create table(:artifact_links, primary_key: false) do

      add :id, :binary_id, primary_key: true

      add :account_id, references(:accounts, type: :binary_id, on_delete: :nothing), null: false

      add :account_id, references(:users, type: :binary_id, on_delete: :nothing), null: false

      add :repository_id, references(:repositories, type: :binary_id, on_delete: :nothing),

        null: false

defmodule OpenAgents.Transparency.ArtifactLinkTest do

  @moduledoc """

  Tests for `OpenAgents.Transparency.ArtifactLink` changeset validation.

  """

  use OpenAgents.DataCase, async: true

  alias OpenAgents.Transparency.ArtifactLink

  defp link_attrs(overrides) do

    Map.merge(

      %{

        account_id: Ecto.UUID.generate(),

        repository_id: Ecto.UUID.generate(),

        artifact_type: "changelog",

        artifact_ref: "sha",

        tier: "dark"

      },

      overrides

    )

  end

  describe "changeset/2" do

    test "accepts a valid transparency tier" do

      changeset = ArtifactLink.changeset(%ArtifactLink{}, link_attrs(%{tier: "glass"}))

      assert changeset.valid?

    end

    test "rejects an unrecognized transparency tier" do

      changeset = ArtifactLink.changeset(%ArtifactLink{}, link_attrs(%{tier: "invisible"}))

      assert "is invalid" in errors_on(changeset).tier

    end

  end

end

defmodule OpenAgents.TransparencyTest do

  @moduledoc """

  Tests for `OpenAgents.Transparency` tier logic and revocation.

  """

  use OpenAgents.DataCase, async: true

  alias OpenAgents.Transparency.ArtifactLink

  import OpenAgents.Transparency,

    only: [allows?: 3, effective_tier: 2, tier_atoms: 0, revoke: 3]

  describe "tier_atoms/0" do

    test "returns the tiers from least to most transparent" do

      assert tier_atoms() == [:dark, :pulse, :ledger, :glass]

    end

  end

  describe "effective_tier/2" do

    test "resolves tier atoms and strings" do

      assert effective_tier(:dark, nil) == :dark

      assert effective_tier("pulse", nil) == :pulse

      assert effective_tier(:ledger, nil) == :ledger

      assert effective_tier("glass", nil) == :glass

    end

    test "clamps to the lower of the artifact tier and the viewer tier" do

      assert effective_tier(:glass, "pulse") == :pulse

      assert effective_tier(:ledger, :glass) == :ledger

      assert effective_tier(:ledger, %{tier: "dark"}) == :dark

      assert effective_tier(:glass, %{tier: :pulse}) == :pulse

    end

    test "a revoked artifact link is always dark" do

      revoked = %ArtifactLink{tier: "glass", revoked_at: DateTime.utc_now()}

      assert effective_tier(revoked, :glass) == :dark

      assert effective_tier(revoked, nil) == :dark

    end

    test "an unrevoked artifact link is clamped by the viewer" do

      link = %ArtifactLink{tier: "glass", revoked_at: nil}

      assert effective_tier(link, :ledger) == :ledger

      assert effective_tier(link, "pulse") == :pulse

      assert effective_tier(link, nil) == :glass

    end

  end

  describe "allows?/3" do

    test "metadata requires at least pulse" do

      refute allows?(:dark, :metadata, nil)

      assert allows?(:pulse, :metadata, nil)

      assert allows?(:ledger, :metadata, nil)

      assert allows?(:glass, :metadata, nil)

    end

    test "content requires at least ledger" do

      refute allows?(:pulse, :content, nil)

      assert allows?(:ledger, :content, nil)

      assert allows?(:glass, :content, nil)

    end

    test "full requires glass" do

      refute allows?(:ledger, :full, nil)

      assert allows?(:glass, :full, nil)

    end

    test "a lower viewer tier restricts the result" do

      refute allows?(:glass, :full, :ledger)

      refute allows?(:ledger, :content, :pulse)

      refute allows?(:glass, :metadata, :dark)

    end

  end

  describe "revoke/3" do

    test "sets revoked_at and a revocation tombstone" do

      link = %ArtifactLink{tier: "ledger"}

      revoker_id = Ecto.UUID.generate()

      changeset = revoke(link, "expired", revoker_id)

      assert %DateTime{} = get_field(changeset, :revoked_at)

      assert %{

               reason: "expired",

               revoked_by_id: ^revoker_id,

               revoked_at: _iso

             } = get_field(changeset, :revocation_tombstone)

    end

  end

end