package com.peachpasswords.autofill

import android.content.Intent
import android.view.WindowManager
import androidx.test.core.app.ActivityScenario
import androidx.test.core.app.ApplicationProvider
import androidx.test.ext.junit.runners.AndroidJUnit4
import androidx.test.platform.app.InstrumentationRegistry
import org.junit.Assert.assertTrue
import org.junit.Test
import org.junit.runner.RunWith

/**
 * Real-device coverage for audit H-05. The autofill entry picker shows vault
 * metadata (usernames, sites, last-used) and must set FLAG_SECURE so
 * screenshots, screen recording, and the recents thumbnail cannot leak those
 * entries. Debug builds are secure by default too; only an explicit
 * `qa_disable_secure_flag` intent extra bypasses the policy.
 *
 * Launching with NO extras must not crash — the picker renders with UNKNOWN
 * trust and zero preselected entries, which is the correct fail-closed state.
 */
@RunWith(AndroidJUnit4::class)
class AutofillFlagSecureTest {
    @Test
    fun pickerWindowActuallyEnablesFlagSecure() {
        val context = InstrumentationRegistry.getInstrumentation().targetContext
        assertTrue(
            "target must be release or its correctly suffixed debug id",
            context.packageName == "com.peachpasswords" ||
                context.packageName == "com.peachpasswords.debug",
        )
        // Launch with an empty intent — no origin, no trust extras. The picker
        // must tolerate this and still set FLAG_SECURE before rendering.
        val intent = Intent(context, AutofillEntryPickerActivity::class.java)
        val scenario = ActivityScenario.launch<AutofillEntryPickerActivity>(intent)
        try {
            scenario.onActivity { activity ->
                assertTrue(
                    "autofill picker window must set FLAG_SECURE",
                    activity.window.attributes.flags and WindowManager.LayoutParams.FLAG_SECURE != 0,
                )
            }
        } finally {
            scenario.close()
        }
    }
}