"""
Provenance tests — verify the Nexus browser surface comes from
a clean Timmy_Foundation/the-nexus checkout, not stale sources.

Refs: #686
"""
import json
import hashlib
from pathlib import Path

REPO_ROOT = Path(__file__).resolve().parent.parent


def test_provenance_manifest_exists() -> None:
    """provenance.json must exist and be valid JSON."""
    p = REPO_ROOT / "provenance.json"
    assert p.exists(), "provenance.json missing — run bin/generate_provenance.py"
    data = json.loads(p.read_text())
    assert "files" in data
    assert "repo" in data


def test_provenance_repo_identity() -> None:
    """Manifest must claim Timmy_Foundation/the-nexus."""
    data = json.loads((REPO_ROOT / "provenance.json").read_text())
    assert data["repo"] == "Timmy_Foundation/the-nexus"


def test_provenance_all_contract_files_present() -> None:
    """Every file listed in the provenance manifest must exist on disk."""
    data = json.loads((REPO_ROOT / "provenance.json").read_text())
    missing = []
    for rel in data["files"]:
        if not (REPO_ROOT / rel).exists():
            missing.append(rel)
    assert not missing, f"Contract files missing: {missing}"


def test_provenance_hashes_match() -> None:
    """File hashes must match the stored manifest (no stale/modified files)."""
    data = json.loads((REPO_ROOT / "provenance.json").read_text())
    mismatches = []
    for rel, meta in data["files"].items():
        p = REPO_ROOT / rel
        if not p.exists():
            mismatches.append(f"MISSING: {rel}")
            continue
        actual = hashlib.sha256(p.read_bytes()).hexdigest()
        if actual != meta["sha256"]:
            mismatches.append(f"CHANGED: {rel}")
    assert not mismatches, f"Provenance mismatch:\n" + "\n".join(mismatches)


def test_no_legacy_matrix_references_in_frontend() -> None:
    """Frontend files must not reference /Users/apayne/the-matrix as a source."""
    forbidden_paths = ["/Users/apayne/the-matrix"]
    offenders = []
    for rel in ["index.html", "app.js", "style.css"]:
        p = REPO_ROOT / rel
        if p.exists():
            content = p.read_text()
            for bad in forbidden_paths:
                if bad in content:
                    offenders.append(f"{rel} references {bad}")
    assert not offenders, f"Legacy matrix references found: {offenders}"


def test_no_stale_perplexity_computer_references_in_critical_files() -> None:
    """Verify the provenance generator script itself is canonical."""
    script = REPO_ROOT / "bin" / "generate_provenance.py"
    assert script.exists(), "bin/generate_provenance.py must exist"
    content = script.read_text()
    assert "Timmy_Foundation/the-nexus" in content