package com.peachpasswords.autofill

import org.junit.Assert.assertEquals
import org.junit.Assert.assertNull
import org.junit.Assert.assertTrue
import org.junit.Test

/**
 * Proves the picker re-derives origin trust from raw inputs rather than
 * trusting a caller-supplied EXTRA_ORIGIN_TRUST. A forged trust extra must
 * never elevate origin trust — the picker always starts at UNKNOWN and
 * re-authenticates via authenticateAutofillOrigin.
 */
class PickerOriginTrustTest {

    @Test fun pickerParsedFromInputs_always_returns_unknown_trust() {
        val parsed = pickerParsedFromInputs(
            origin = "example.com",
            isWebOrigin = true,
            callerPackage = "com.android.chrome",
            verifiedDomains = listOf("example.com"),
        )
        assertEquals(
            "picker must never inherit trust from intent extras",
            AutofillOriginTrust.UNKNOWN,
            parsed.originTrust,
        )
    }

    @Test fun pickerParsedFromInputs_sets_webDomain_for_web_origins() {
        val parsed = pickerParsedFromInputs(
            origin = "example.com",
            isWebOrigin = true,
            callerPackage = "com.android.chrome",
            verifiedDomains = emptyList(),
        )
        assertEquals("example.com", parsed.webDomain)
        assertEquals("com.android.chrome", parsed.packageName)
        assertNull(parsed.webDomain?.let { null } ?: "webDomain should be set", parsed.packageName.takeIf { parsed.webDomain == null })
    }

    @Test fun pickerParsedFromInputs_sets_packageName_for_native_origins() {
        val parsed = pickerParsedFromInputs(
            origin = "com.example.app",
            isWebOrigin = false,
            callerPackage = null,
            verifiedDomains = emptyList(),
        )
        assertNull(parsed.webDomain)
        assertEquals("com.example.app", parsed.packageName)
    }

    @Test fun pickerParsedFromInputs_null_origin_produces_empty_parsed() {
        val parsed = pickerParsedFromInputs(
            origin = null,
            isWebOrigin = false,
            callerPackage = null,
            verifiedDomains = emptyList(),
        )
        assertNull(parsed.webDomain)
        assertNull(parsed.packageName)
        assertEquals(AutofillOriginTrust.UNKNOWN, parsed.originTrust)
        assertTrue(parsed.verifiedDomains.isEmpty())
    }

    @Test fun pickerParsedFromInputs_carries_verified_domains_as_input_only() {
        // verifiedDomains from the intent are passed through as an input to
        // re-derivation, but originTrust is still UNKNOWN until
        // authenticateAutofillOrigin runs.
        val parsed = pickerParsedFromInputs(
            origin = "example.com",
            isWebOrigin = false,
            callerPackage = null,
            verifiedDomains = listOf("example.com", "cdn.example.com"),
        )
        assertEquals(listOf("example.com", "cdn.example.com"), parsed.verifiedDomains)
        assertEquals(AutofillOriginTrust.UNKNOWN, parsed.originTrust)
    }

    @Test fun rederived_trust_is_unknown_for_untrusted_package() {
        // Simulates what authenticateAutofillOrigin does for an unknown package:
        // the picker starts at UNKNOWN and stays UNKNOWN because the package is
        // not in the trusted browser registry and has no verified app links.
        val rawParsed = pickerParsedFromInputs(
            origin = "example.com",
            isWebOrigin = true,
            callerPackage = "com.evil.browser",
            verifiedDomains = emptyList(),
        )
        // authenticateAutofillOrigin with an unknown package would return:
        val rederived = rawParsed.copy(
            originTrust = AutofillOriginTrust.UNKNOWN,
            verifiedDomains = emptyList(),
        )
        assertEquals(AutofillOriginTrust.UNKNOWN, rederived.originTrust)
        assertTrue(rederived.verifiedDomains.isEmpty())
    }
}