cfgd_core/compliance/

mod.rs

// Compliance snapshot — types, collection logic, summary computation, export

use std::path::{Path, PathBuf};

use serde::{Deserialize, Serialize};

use crate::config::{ComplianceExport, ComplianceFormat, ComplianceScope, MergedProfile};
use crate::errors::Result;
use crate::platform::Platform;
use crate::providers::ProviderRegistry;

// ---------------------------------------------------------------------------
// Types
// ---------------------------------------------------------------------------

#[derive(Debug, Clone, Serialize, Deserialize)]
#[serde(rename_all = "camelCase")]
pub struct ComplianceSnapshot {
    pub timestamp: String,
    pub machine: MachineInfo,
    pub profile: String,
    pub sources: Vec<String>,
    pub checks: Vec<ComplianceCheck>,
    pub summary: ComplianceSummary,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct MachineInfo {
    pub hostname: String,
    pub os: String,
    pub arch: String,
}

#[derive(Debug, Clone, Default, Serialize, Deserialize)]
pub struct ComplianceCheck {
    pub category: String,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub target: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub path: Option<String>,
    pub status: ComplianceStatus,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub detail: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub version: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub manager: Option<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub value: Option<String>,
}

#[derive(Debug, Clone, Default, Serialize, Deserialize, PartialEq)]
pub enum ComplianceStatus {
    #[default]
    Compliant,
    Warning,
    Violation,
}

#[derive(Debug, Clone, Serialize, Deserialize)]
pub struct ComplianceSummary {
    pub compliant: usize,
    pub warning: usize,
    pub violation: usize,
}

// ---------------------------------------------------------------------------
// Collection
// ---------------------------------------------------------------------------

/// Collect a full compliance snapshot for the current machine state.
pub fn collect_snapshot(
    profile_name: &str,
    profile: &MergedProfile,
    registry: &ProviderRegistry,
    scope: &ComplianceScope,
    sources: &[String],
) -> Result<ComplianceSnapshot> {
    let platform = Platform::detect();
    let hostname = crate::hostname_string();

    let machine = MachineInfo {
        hostname,
        os: platform.os.as_str().to_owned(),
        arch: platform.arch.as_str().to_owned(),
    };

    let mut checks = Vec::new();

    if scope.files {
        checks.extend(collect_file_checks(profile));
    }
    if scope.packages {
        checks.extend(collect_package_checks(profile, registry)?);
    }
    if scope.system {
        checks.extend(collect_system_checks(profile, registry)?);
    }
    if scope.secrets {
        checks.extend(collect_secret_checks(profile));
    }
    for watch_path in &scope.watch_paths {
        checks.extend(collect_watch_path_checks(watch_path));
    }
    for manager_name in &scope.watch_package_managers {
        checks.extend(collect_watched_package_manager_checks(
            manager_name,
            registry,
        )?);
    }

    let summary = compute_summary(&checks);

    Ok(ComplianceSnapshot {
        timestamp: crate::utc_now_iso8601(),
        machine,
        profile: profile_name.to_owned(),
        sources: sources.to_vec(),
        checks,
        summary,
    })
}

/// Compute summary counts from a list of checks.
pub fn compute_summary(checks: &[ComplianceCheck]) -> ComplianceSummary {
    let mut compliant = 0usize;
    let mut warning = 0usize;
    let mut violation = 0usize;

    for check in checks {
        match check.status {
            ComplianceStatus::Compliant => compliant += 1,
            ComplianceStatus::Warning => warning += 1,
            ComplianceStatus::Violation => violation += 1,
        }
    }

    ComplianceSummary {
        compliant,
        warning,
        violation,
    }
}

// ---------------------------------------------------------------------------
// Export
// ---------------------------------------------------------------------------

/// Export a compliance snapshot to a file based on the export configuration.
///
/// Steps: expand tilde in path, create directory, build timestamped filename,
/// serialize to JSON or YAML, and atomically write.
///
/// Returns the path of the written file.
pub fn export_snapshot_to_file(
    snapshot: &ComplianceSnapshot,
    export: &ComplianceExport,
) -> Result<PathBuf> {
    let export_dir = crate::expand_tilde(Path::new(&export.path));
    std::fs::create_dir_all(&export_dir)?;

    let timestamp_safe = snapshot.timestamp.replace(':', "-");
    let ext = match export.format {
        ComplianceFormat::Json => "json",
        ComplianceFormat::Yaml => "yaml",
    };
    let filename = format!("compliance-{}.{}", timestamp_safe, ext);
    let file_path = export_dir.join(&filename);

    let content = match export.format {
        ComplianceFormat::Json => serde_json::to_string_pretty(snapshot)
            .map_err(|e| std::io::Error::other(format!("JSON serialization failed: {}", e)))?,
        ComplianceFormat::Yaml => serde_yaml::to_string(snapshot)
            .map_err(|e| std::io::Error::other(format!("YAML serialization failed: {}", e)))?,
    };

    crate::atomic_write_str(&file_path, &content)?;
    Ok(file_path)
}

// ---------------------------------------------------------------------------
// File checks
// ---------------------------------------------------------------------------

/// Check managed files: existence, permissions, encryption declaration.
pub fn collect_file_checks(profile: &MergedProfile) -> Vec<ComplianceCheck> {
    let mut checks = Vec::new();

    for file in &profile.files.managed {
        let target = crate::expand_tilde(&file.target);
        let exists = target.exists();

        if !exists {
            checks.push(ComplianceCheck {
                category: "file".into(),
                target: Some(target.display().to_string()),
                status: ComplianceStatus::Violation,
                detail: Some("managed file missing".into()),
                ..Default::default()
            });
            continue;
        }

        // Check permissions if declared
        if let Some(ref perm_str) = file.permissions {
            if let Ok(desired_mode) = u32::from_str_radix(perm_str, 8)
                && desired_mode <= 0o7777
            {
                let actual_mode = target
                    .metadata()
                    .ok()
                    .and_then(|m| crate::file_permissions_mode(&m));
                match actual_mode {
                    Some(mode) if mode == desired_mode => {
                        checks.push(ComplianceCheck {
                            category: "file".into(),
                            target: Some(target.display().to_string()),
                            status: ComplianceStatus::Compliant,
                            detail: Some(format!("permissions {:#o}", mode)),
                            ..Default::default()
                        });
                    }
                    Some(mode) => {
                        checks.push(ComplianceCheck {
                            category: "file".into(),
                            target: Some(target.display().to_string()),
                            status: ComplianceStatus::Warning,
                            detail: Some(format!(
                                "permissions {:#o}, expected {:#o}",
                                mode, desired_mode
                            )),
                            ..Default::default()
                        });
                    }
                    None => {
                        // Windows or metadata unavailable — compliant by default
                        checks.push(ComplianceCheck {
                            category: "file".into(),
                            target: Some(target.display().to_string()),
                            status: ComplianceStatus::Compliant,
                            detail: Some("permissions not applicable on this platform".into()),
                            ..Default::default()
                        });
                    }
                }
            } else {
                // Malformed permission string
                checks.push(ComplianceCheck {
                    category: "file".into(),
                    target: Some(target.display().to_string()),
                    status: ComplianceStatus::Warning,
                    detail: Some(format!("invalid permission string: {}", perm_str)),
                    ..Default::default()
                });
            }
        } else {
            // No permissions declared — file exists, compliant
            checks.push(ComplianceCheck {
                category: "file".into(),
                target: Some(target.display().to_string()),
                status: ComplianceStatus::Compliant,
                detail: Some("present".into()),
                ..Default::default()
            });
        }

        // Check encryption declaration (if encryption is specified, just verify it is declared)
        if let Some(ref enc) = file.encryption {
            checks.push(ComplianceCheck {
                category: "file-encryption".into(),
                target: Some(target.display().to_string()),
                status: ComplianceStatus::Compliant,
                detail: Some(format!("encryption: backend={}", enc.backend)),
                ..Default::default()
            });
        }
    }

    checks
}

// ---------------------------------------------------------------------------
// Package checks
// ---------------------------------------------------------------------------

/// Check that declared packages are installed via their respective managers.
pub fn collect_package_checks(
    profile: &MergedProfile,
    registry: &ProviderRegistry,
) -> Result<Vec<ComplianceCheck>> {
    let mut checks = Vec::new();

    for pm in registry.available_package_managers() {
        let desired = crate::config::desired_packages_for_spec(pm.name(), &profile.packages);
        if desired.is_empty() {
            continue;
        }

        let installed = match pm.installed_packages() {
            Ok(set) => set,
            Err(e) => {
                // Cannot query this manager — report as warning
                checks.push(ComplianceCheck {
                    category: "package".into(),
                    manager: Some(pm.name().to_owned()),
                    status: ComplianceStatus::Warning,
                    detail: Some(format!("cannot query {}: {}", pm.name(), e)),
                    ..Default::default()
                });
                continue;
            }
        };

        for pkg in &desired {
            if installed.contains(pkg) {
                checks.push(ComplianceCheck {
                    category: "package".into(),
                    name: Some(pkg.clone()),
                    manager: Some(pm.name().to_owned()),
                    status: ComplianceStatus::Compliant,
                    detail: Some("installed".into()),
                    ..Default::default()
                });
            } else {
                checks.push(ComplianceCheck {
                    category: "package".into(),
                    name: Some(pkg.clone()),
                    manager: Some(pm.name().to_owned()),
                    status: ComplianceStatus::Violation,
                    detail: Some("not installed".into()),
                    ..Default::default()
                });
            }
        }
    }

    Ok(checks)
}

// ---------------------------------------------------------------------------
// System checks
// ---------------------------------------------------------------------------

/// Check system configurator state for drift.
pub fn collect_system_checks(
    profile: &MergedProfile,
    registry: &ProviderRegistry,
) -> Result<Vec<ComplianceCheck>> {
    let mut checks = Vec::new();
    let available = registry.available_system_configurators();

    for (key, desired) in &profile.system {
        let configurator = available.iter().find(|c| c.name() == key);

        let Some(configurator) = configurator else {
            checks.push(ComplianceCheck {
                category: "system".into(),
                key: Some(key.clone()),
                status: ComplianceStatus::Warning,
                detail: Some(format!("no configurator available for '{}'", key)),
                ..Default::default()
            });
            continue;
        };

        match configurator.diff(desired) {
            Ok(drifts) => {
                if drifts.is_empty() {
                    checks.push(ComplianceCheck {
                        category: "system".into(),
                        key: Some(key.clone()),
                        status: ComplianceStatus::Compliant,
                        detail: Some("no drift".into()),
                        ..Default::default()
                    });
                } else {
                    for drift in &drifts {
                        checks.push(ComplianceCheck {
                            category: "system".into(),
                            key: Some(format!("{}.{}", key, drift.key)),
                            status: ComplianceStatus::Violation,
                            detail: Some(format!(
                                "expected {}, actual {}",
                                drift.expected, drift.actual
                            )),
                            value: Some(drift.actual.clone()),
                            ..Default::default()
                        });
                    }
                }
            }
            Err(e) => {
                checks.push(ComplianceCheck {
                    category: "system".into(),
                    key: Some(key.clone()),
                    status: ComplianceStatus::Warning,
                    detail: Some(format!("diff failed: {}", e)),
                    ..Default::default()
                });
            }
        }
    }

    Ok(checks)
}

// ---------------------------------------------------------------------------
// Secret checks
// ---------------------------------------------------------------------------

/// Check secrets: for secrets with file targets, verify the target file exists
/// and check its permissions. NEVER reads or logs secret values.
pub fn collect_secret_checks(profile: &MergedProfile) -> Vec<ComplianceCheck> {
    let mut checks = Vec::new();

    for secret in &profile.secrets {
        let Some(ref target_path) = secret.target else {
            // Env-only secret — no file to check
            continue;
        };

        let target = crate::expand_tilde(target_path);
        if target.exists() {
            checks.push(ComplianceCheck {
                category: "secret".into(),
                target: Some(target.display().to_string()),
                status: ComplianceStatus::Compliant,
                detail: Some("target file present".into()),
                ..Default::default()
            });
        } else {
            checks.push(ComplianceCheck {
                category: "secret".into(),
                target: Some(target.display().to_string()),
                status: ComplianceStatus::Violation,
                detail: Some("target file missing".into()),
                ..Default::default()
            });
        }
    }

    checks
}

// ---------------------------------------------------------------------------
// Watch path checks
// ---------------------------------------------------------------------------

/// Stat a watch path and report basic info.
fn collect_watch_path_checks(path_str: &str) -> Vec<ComplianceCheck> {
    let path = crate::expand_tilde(Path::new(path_str));

    if !path.exists() {
        return vec![ComplianceCheck {
            category: "watchPath".into(),
            path: Some(path.display().to_string()),
            status: ComplianceStatus::Warning,
            detail: Some("path does not exist".into()),
            ..Default::default()
        }];
    }

    let meta = match path.metadata() {
        Ok(m) => m,
        Err(e) => {
            return vec![ComplianceCheck {
                category: "watchPath".into(),
                path: Some(path.display().to_string()),
                status: ComplianceStatus::Warning,
                detail: Some(format!("cannot stat: {}", e)),
                ..Default::default()
            }];
        }
    };

    let perms = crate::file_permissions_mode(&meta);
    let kind = if meta.is_dir() {
        "directory"
    } else if meta.is_file() {
        "file"
    } else {
        "other"
    };

    let detail = match perms {
        Some(mode) => format!("{}, permissions {:#o}", kind, mode),
        None => kind.to_string(),
    };

    vec![ComplianceCheck {
        category: "watchPath".into(),
        path: Some(path.display().to_string()),
        status: ComplianceStatus::Compliant,
        detail: Some(detail),
        ..Default::default()
    }]
}

// ---------------------------------------------------------------------------
// Watch package manager checks
// ---------------------------------------------------------------------------

/// Enumerate all installed packages from a named package manager.
/// Each installed package is reported as a `watchPackage` category check,
/// providing a full inventory of what is installed (not just managed packages).
fn collect_watched_package_manager_checks(
    manager_name: &str,
    registry: &ProviderRegistry,
) -> Result<Vec<ComplianceCheck>> {
    let pm = registry
        .available_package_managers()
        .into_iter()
        .find(|pm| pm.name() == manager_name);

    let Some(pm) = pm else {
        return Ok(vec![ComplianceCheck {
            category: "watchPackage".into(),
            manager: Some(manager_name.to_owned()),
            status: ComplianceStatus::Warning,
            detail: Some(format!("package manager '{}' not available", manager_name)),
            ..Default::default()
        }]);
    };

    let installed = match pm.installed_packages() {
        Ok(set) => set,
        Err(e) => {
            return Ok(vec![ComplianceCheck {
                category: "watchPackage".into(),
                manager: Some(manager_name.to_owned()),
                status: ComplianceStatus::Warning,
                detail: Some(format!("cannot query {}: {}", manager_name, e)),
                ..Default::default()
            }]);
        }
    };

    let mut checks: Vec<ComplianceCheck> = installed
        .into_iter()
        .map(|pkg| ComplianceCheck {
            category: "watchPackage".into(),
            name: Some(pkg),
            manager: Some(manager_name.to_owned()),
            status: ComplianceStatus::Compliant,
            detail: Some("installed".into()),
            ..Default::default()
        })
        .collect();

    // Sort for deterministic output
    checks.sort_by(|a, b| a.name.cmp(&b.name));

    Ok(checks)
}

// ---------------------------------------------------------------------------
// Tests
// ---------------------------------------------------------------------------

#[cfg(test)]
mod tests {
    use super::*;

    use std::collections::HashMap;

    #[test]
    fn snapshot_serializes_to_json() {
        let snapshot = ComplianceSnapshot {
            timestamp: "2026-03-25T00:00:00Z".into(),
            machine: MachineInfo {
                hostname: "test-host".into(),
                os: "linux".into(),
                arch: "x86_64".into(),
            },
            profile: "default".into(),
            sources: vec!["local".into()],
            checks: vec![
                ComplianceCheck {
                    category: "file".into(),
                    target: Some("/home/user/.zshrc".into()),
                    status: ComplianceStatus::Compliant,
                    detail: Some("present".into()),
                    ..Default::default()
                },
                ComplianceCheck {
                    category: "package".into(),
                    name: Some("ripgrep".into()),
                    manager: Some("apt".into()),
                    status: ComplianceStatus::Violation,
                    detail: Some("not installed".into()),
                    ..Default::default()
                },
            ],
            summary: ComplianceSummary {
                compliant: 1,
                warning: 0,
                violation: 1,
            },
        };

        let json = serde_json::to_string_pretty(&snapshot).unwrap();
        assert!(json.contains("\"timestamp\""));
        assert!(json.contains("\"machine\""));
        assert!(json.contains("\"test-host\""));
        assert!(json.contains("\"Compliant\""));
        assert!(json.contains("\"Violation\""));

        // Roundtrip
        let parsed: ComplianceSnapshot = serde_json::from_str(&json).unwrap();
        assert_eq!(parsed.profile, "default");
        assert_eq!(parsed.checks.len(), 2);
        assert_eq!(parsed.summary.compliant, 1);
        assert_eq!(parsed.summary.violation, 1);
    }

    #[test]
    fn summary_counts_match_check_statuses() {
        let checks = vec![
            ComplianceCheck {
                category: "file".into(),
                status: ComplianceStatus::Compliant,
                ..Default::default()
            },
            ComplianceCheck {
                category: "file".into(),
                status: ComplianceStatus::Compliant,
                ..Default::default()
            },
            ComplianceCheck {
                category: "package".into(),
                status: ComplianceStatus::Violation,
                ..Default::default()
            },
            ComplianceCheck {
                category: "system".into(),
                status: ComplianceStatus::Warning,
                ..Default::default()
            },
            ComplianceCheck {
                category: "system".into(),
                status: ComplianceStatus::Warning,
                ..Default::default()
            },
            ComplianceCheck {
                category: "file".into(),
                status: ComplianceStatus::Violation,
                ..Default::default()
            },
        ];

        let summary = compute_summary(&checks);
        assert_eq!(summary.compliant, 2);
        assert_eq!(summary.warning, 2);
        assert_eq!(summary.violation, 2);
    }

    #[test]
    fn collect_file_checks_existing_file() {
        let dir = tempfile::tempdir().unwrap();
        let file_path = dir.path().join("test.conf");
        std::fs::write(&file_path, "content").unwrap();

        let profile = MergedProfile {
            files: crate::config::FilesSpec {
                managed: vec![crate::config::ManagedFileSpec {
                    source: "test.conf".into(),
                    target: file_path.clone(),
                    strategy: None,
                    private: false,
                    origin: None,
                    encryption: None,
                    permissions: None,
                }],
                permissions: HashMap::new(),
            },
            ..Default::default()
        };

        let checks = collect_file_checks(&profile);
        assert_eq!(checks.len(), 1);
        assert_eq!(checks[0].status, ComplianceStatus::Compliant);
        assert_eq!(checks[0].detail.as_deref(), Some("present"));
    }

    #[test]
    fn collect_file_checks_missing_file() {
        let profile = MergedProfile {
            files: crate::config::FilesSpec {
                managed: vec![crate::config::ManagedFileSpec {
                    source: "test.conf".into(),
                    target: "/tmp/cfgd-nonexistent-file-12345".into(),
                    strategy: None,
                    private: false,
                    origin: None,
                    encryption: None,
                    permissions: None,
                }],
                permissions: HashMap::new(),
            },
            ..Default::default()
        };

        let checks = collect_file_checks(&profile);
        assert_eq!(checks.len(), 1);
        assert_eq!(checks[0].status, ComplianceStatus::Violation);
        assert_eq!(checks[0].detail.as_deref(), Some("managed file missing"));
    }

    #[cfg(unix)]
    #[test]
    fn collect_file_checks_permissions_match() {
        let dir = tempfile::tempdir().unwrap();
        let file_path = dir.path().join("secret.key");
        std::fs::write(&file_path, "key-data").unwrap();
        crate::set_file_permissions(&file_path, 0o600).unwrap();

        let profile = MergedProfile {
            files: crate::config::FilesSpec {
                managed: vec![crate::config::ManagedFileSpec {
                    source: "secret.key".into(),
                    target: file_path.clone(),
                    strategy: None,
                    private: false,
                    origin: None,
                    encryption: None,
                    permissions: Some("600".into()),
                }],
                permissions: HashMap::new(),
            },
            ..Default::default()
        };

        let checks = collect_file_checks(&profile);
        assert_eq!(checks.len(), 1);
        assert_eq!(checks[0].status, ComplianceStatus::Compliant);
        assert!(checks[0].detail.as_deref().unwrap().contains("0o600"));
    }

    #[cfg(unix)]
    #[test]
    fn collect_file_checks_permissions_mismatch() {
        let dir = tempfile::tempdir().unwrap();
        let file_path = dir.path().join("secret.key");
        std::fs::write(&file_path, "key-data").unwrap();
        crate::set_file_permissions(&file_path, 0o644).unwrap();

        let profile = MergedProfile {
            files: crate::config::FilesSpec {
                managed: vec![crate::config::ManagedFileSpec {
                    source: "secret.key".into(),
                    target: file_path.clone(),
                    strategy: None,
                    private: false,
                    origin: None,
                    encryption: None,
                    permissions: Some("600".into()),
                }],
                permissions: HashMap::new(),
            },
            ..Default::default()
        };

        let checks = collect_file_checks(&profile);
        assert_eq!(checks.len(), 1);
        assert_eq!(checks[0].status, ComplianceStatus::Warning);
        assert!(checks[0].detail.as_deref().unwrap().contains("expected"));
    }

    #[test]
    fn collect_system_checks_maps_drifts() {
        use crate::providers::{ProviderRegistry, SystemDrift};
        use crate::test_helpers::MockSystemConfigurator;

        let mut registry = ProviderRegistry::new();
        registry.system_configurators.push(Box::new(
            MockSystemConfigurator::new("shell").with_drift(vec![SystemDrift {
                key: "defaultShell".into(),
                expected: "/bin/zsh".into(),
                actual: "/bin/bash".into(),
            }]),
        ));

        let mut system = HashMap::new();
        system.insert(
            "shell".to_owned(),
            serde_yaml::Value::String("/bin/zsh".into()),
        );

        let profile = MergedProfile {
            system,
            ..Default::default()
        };

        let checks = collect_system_checks(&profile, &registry).unwrap();
        assert_eq!(checks.len(), 1);
        assert_eq!(checks[0].status, ComplianceStatus::Violation);
        assert_eq!(checks[0].key.as_deref(), Some("shell.defaultShell"));
        assert!(checks[0].detail.as_deref().unwrap().contains("/bin/bash"));
    }

    #[test]
    fn collect_system_checks_compliant_when_no_drift() {
        use crate::providers::ProviderRegistry;
        use crate::test_helpers::MockSystemConfigurator;

        let mut registry = ProviderRegistry::new();
        registry
            .system_configurators
            .push(Box::new(MockSystemConfigurator::new("shell")));

        let mut system = HashMap::new();
        system.insert(
            "shell".to_owned(),
            serde_yaml::Value::String("/bin/zsh".into()),
        );

        let profile = MergedProfile {
            system,
            ..Default::default()
        };

        let checks = collect_system_checks(&profile, &registry).unwrap();
        assert_eq!(checks.len(), 1);
        assert_eq!(checks[0].status, ComplianceStatus::Compliant);
    }

    #[test]
    fn collect_secret_checks_target_exists() {
        let dir = tempfile::tempdir().unwrap();
        let target = dir.path().join("token.txt");
        std::fs::write(&target, "redacted").unwrap();

        let profile = MergedProfile {
            secrets: vec![crate::config::SecretSpec {
                source: "vault://secret/token".into(),
                target: Some(target.clone()),
                template: None,
                backend: None,
                envs: None,
            }],
            ..Default::default()
        };

        let checks = collect_secret_checks(&profile);
        assert_eq!(checks.len(), 1);
        assert_eq!(checks[0].status, ComplianceStatus::Compliant);
    }

    #[test]
    fn collect_secret_checks_target_missing() {
        let profile = MergedProfile {
            secrets: vec![crate::config::SecretSpec {
                source: "vault://secret/token".into(),
                target: Some("/tmp/cfgd-nonexistent-secret-12345".into()),
                template: None,
                backend: None,
                envs: None,
            }],
            ..Default::default()
        };

        let checks = collect_secret_checks(&profile);
        assert_eq!(checks.len(), 1);
        assert_eq!(checks[0].status, ComplianceStatus::Violation);
    }

    #[test]
    fn collect_secret_checks_env_only_skipped() {
        let profile = MergedProfile {
            secrets: vec![crate::config::SecretSpec {
                source: "vault://secret/api-key".into(),
                target: None,
                template: None,
                backend: None,
                envs: Some(vec!["API_KEY=vault://secret/api-key".into()]),
            }],
            ..Default::default()
        };

        let checks = collect_secret_checks(&profile);
        assert!(checks.is_empty());
    }

    #[test]
    fn watch_path_existing_file() {
        let dir = tempfile::tempdir().unwrap();
        let file_path = dir.path().join("watched.conf");
        std::fs::write(&file_path, "data").unwrap();

        let checks = collect_watch_path_checks(&file_path.to_string_lossy());
        assert_eq!(checks.len(), 1);
        assert_eq!(checks[0].status, ComplianceStatus::Compliant);
        assert!(checks[0].detail.as_deref().unwrap().contains("file"));
    }

    #[test]
    fn watch_path_nonexistent() {
        let checks = collect_watch_path_checks("/tmp/cfgd-nonexistent-watch-12345");
        assert_eq!(checks.len(), 1);
        assert_eq!(checks[0].status, ComplianceStatus::Warning);
    }

    #[test]
    fn watch_package_manager_not_available() {
        let registry = ProviderRegistry::new();
        let checks = collect_watched_package_manager_checks("nonexistent-pm", &registry).unwrap();
        assert_eq!(checks.len(), 1);
        assert_eq!(checks[0].category, "watchPackage");
        assert_eq!(checks[0].status, ComplianceStatus::Warning);
        assert!(
            checks[0]
                .detail
                .as_deref()
                .unwrap()
                .contains("not available")
        );
    }

    #[test]
    fn watch_package_manager_returns_installed() {
        use crate::providers::StubPackageManager;

        let mut registry = ProviderRegistry::new();
        registry.package_managers.push(Box::new(
            StubPackageManager::new("mock").with_installed(&["ripgrep", "fd"]),
        ));

        let checks = collect_watched_package_manager_checks("mock", &registry).unwrap();
        assert_eq!(checks.len(), 2);
        assert!(checks.iter().all(|c| c.category == "watchPackage"));
        assert!(
            checks
                .iter()
                .all(|c| c.status == ComplianceStatus::Compliant)
        );
        assert!(checks.iter().all(|c| c.manager.as_deref() == Some("mock")));
        // Sorted by name
        assert_eq!(checks[0].name.as_deref(), Some("fd"));
        assert_eq!(checks[1].name.as_deref(), Some("ripgrep"));
    }

    #[test]
    fn export_snapshot_to_file_json() {
        let dir = tempfile::tempdir().unwrap();
        let export = ComplianceExport {
            format: ComplianceFormat::Json,
            path: dir.path().display().to_string(),
        };
        let snapshot = ComplianceSnapshot {
            timestamp: "2026-03-25T12:00:00Z".into(),
            machine: MachineInfo {
                hostname: "test".into(),
                os: "linux".into(),
                arch: "x86_64".into(),
            },
            profile: "default".into(),
            sources: vec![],
            checks: vec![],
            summary: ComplianceSummary {
                compliant: 0,
                warning: 0,
                violation: 0,
            },
        };

        let path = export_snapshot_to_file(&snapshot, &export).unwrap();
        assert!(path.exists());
        assert!(
            path.file_name()
                .unwrap()
                .to_string_lossy()
                .ends_with(".json")
        );

        let content = std::fs::read_to_string(&path).unwrap();
        let parsed: ComplianceSnapshot = serde_json::from_str(&content).unwrap();
        assert_eq!(parsed.profile, "default");
    }

    #[test]
    fn export_snapshot_to_file_yaml() {
        let dir = tempfile::tempdir().unwrap();
        let export = ComplianceExport {
            format: ComplianceFormat::Yaml,
            path: dir.path().display().to_string(),
        };
        let snapshot = ComplianceSnapshot {
            timestamp: "2026-03-25T12:00:00Z".into(),
            machine: MachineInfo {
                hostname: "test".into(),
                os: "linux".into(),
                arch: "x86_64".into(),
            },
            profile: "default".into(),
            sources: vec![],
            checks: vec![],
            summary: ComplianceSummary {
                compliant: 0,
                warning: 0,
                violation: 0,
            },
        };

        let path = export_snapshot_to_file(&snapshot, &export).unwrap();
        assert!(path.exists());
        assert!(
            path.file_name()
                .unwrap()
                .to_string_lossy()
                .ends_with(".yaml")
        );
    }

    // -----------------------------------------------------------------------
    // collect_package_checks
    // -----------------------------------------------------------------------

    #[test]
    fn collect_package_checks_installed_package_compliant() {
        use crate::config::MergedProfile;
        use crate::providers::StubPackageManager;

        let mut profile = MergedProfile::default();
        // Use pipx (Vec<String>) which is simpler to construct
        profile.packages.pipx = vec!["ripgrep".into()];

        let mut registry = ProviderRegistry::new();
        registry.package_managers.push(Box::new(
            StubPackageManager::new("pipx").with_installed(&["ripgrep"]),
        ));

        let checks = collect_package_checks(&profile, &registry).unwrap();
        assert_eq!(checks.len(), 1);
        assert_eq!(checks[0].status, ComplianceStatus::Compliant);
        assert_eq!(checks[0].name.as_deref(), Some("ripgrep"));
        assert_eq!(checks[0].manager.as_deref(), Some("pipx"));
    }

    #[test]
    fn collect_package_checks_missing_package_violation() {
        use crate::config::MergedProfile;
        use crate::providers::StubPackageManager;

        let mut profile = MergedProfile::default();
        profile.packages.pipx = vec!["missing-pkg".into()];

        let mut registry = ProviderRegistry::new();
        registry.package_managers.push(Box::new(
            StubPackageManager::new("pipx").with_installed(&[]),
        ));

        let checks = collect_package_checks(&profile, &registry).unwrap();
        assert_eq!(checks.len(), 1);
        assert_eq!(checks[0].status, ComplianceStatus::Violation);
        assert!(
            checks[0]
                .detail
                .as_deref()
                .unwrap()
                .contains("not installed")
        );
    }

    #[test]
    fn collect_package_checks_empty_desired_skips_manager() {
        use crate::config::MergedProfile;
        use crate::providers::StubPackageManager;

        let profile = MergedProfile::default();
        let mut registry = ProviderRegistry::new();
        registry.package_managers.push(Box::new(
            StubPackageManager::new("pipx").with_installed(&["curl"]),
        ));

        let checks = collect_package_checks(&profile, &registry).unwrap();
        assert!(checks.is_empty(), "no desired packages = no checks");
    }

    #[test]
    fn collect_package_checks_multiple_managers() {
        use crate::config::MergedProfile;
        use crate::providers::StubPackageManager;

        let mut profile = MergedProfile::default();
        profile.packages.pipx = vec!["ripgrep".into()];
        profile.packages.dnf = vec!["fd-find".into()];

        let mut registry = ProviderRegistry::new();
        registry.package_managers.push(Box::new(
            StubPackageManager::new("pipx").with_installed(&["ripgrep"]),
        ));
        registry
            .package_managers
            .push(Box::new(StubPackageManager::new("dnf").with_installed(&[])));

        let checks = collect_package_checks(&profile, &registry).unwrap();
        assert_eq!(checks.len(), 2);
        let pipx_check = checks
            .iter()
            .find(|c| c.manager.as_deref() == Some("pipx"))
            .unwrap();
        assert_eq!(pipx_check.status, ComplianceStatus::Compliant);
        let dnf_check = checks
            .iter()
            .find(|c| c.manager.as_deref() == Some("dnf"))
            .unwrap();
        assert_eq!(dnf_check.status, ComplianceStatus::Violation);
    }

    // -----------------------------------------------------------------------
    // collect_system_checks
    // -----------------------------------------------------------------------

    // Inline mock for system configurator tests (test_helpers is feature-gated)
    struct InlineSystemMock {
        configurator_name: String,
        // Store as tuples to avoid Clone requirement on SystemDrift
        drift_tuples: Vec<(String, String, String)>,
        should_fail: bool,
    }
    impl crate::providers::SystemConfigurator for InlineSystemMock {
        fn name(&self) -> &str {
            &self.configurator_name
        }
        fn is_available(&self) -> bool {
            true
        }
        fn current_state(&self) -> crate::errors::Result<serde_yaml::Value> {
            Ok(serde_yaml::Value::Mapping(serde_yaml::Mapping::new()))
        }
        fn diff(
            &self,
            _desired: &serde_yaml::Value,
        ) -> crate::errors::Result<Vec<crate::providers::SystemDrift>> {
            if self.should_fail {
                Err(crate::errors::CfgdError::Io(std::io::Error::other(
                    "mock diff failure",
                )))
            } else {
                Ok(self
                    .drift_tuples
                    .iter()
                    .map(|(k, e, a)| crate::providers::SystemDrift {
                        key: k.clone(),
                        expected: e.clone(),
                        actual: a.clone(),
                    })
                    .collect())
            }
        }
        fn apply(
            &self,
            _desired: &serde_yaml::Value,
            _printer: &crate::output::Printer,
        ) -> crate::errors::Result<()> {
            Ok(())
        }
    }

    #[test]
    fn collect_system_checks_no_drift_compliant() {
        use crate::config::MergedProfile;

        let mut profile = MergedProfile::default();
        profile.system.insert(
            "mock".to_string(),
            serde_yaml::Value::Mapping(serde_yaml::Mapping::new()),
        );

        let mut registry = ProviderRegistry::new();
        registry
            .system_configurators
            .push(Box::new(InlineSystemMock {
                configurator_name: "mock".to_string(),
                drift_tuples: vec![],
                should_fail: false,
            }));

        let checks = collect_system_checks(&profile, &registry).unwrap();
        assert_eq!(checks.len(), 1);
        assert_eq!(checks[0].status, ComplianceStatus::Compliant);
    }

    #[test]
    fn collect_system_checks_with_drift_violation() {
        use crate::config::MergedProfile;
        let mut profile = MergedProfile::default();
        profile.system.insert(
            "mock".to_string(),
            serde_yaml::Value::String("desired".into()),
        );

        let mut registry = ProviderRegistry::new();
        registry
            .system_configurators
            .push(Box::new(InlineSystemMock {
                configurator_name: "mock".to_string(),
                drift_tuples: vec![("net.ipv4.ip_forward".into(), "1".into(), "0".into())],
                should_fail: false,
            }));

        let checks = collect_system_checks(&profile, &registry).unwrap();
        assert_eq!(checks.len(), 1);
        assert_eq!(checks[0].status, ComplianceStatus::Violation);
        assert!(checks[0].detail.as_deref().unwrap().contains("expected 1"));
        assert!(checks[0].detail.as_deref().unwrap().contains("actual 0"));
    }

    #[test]
    fn collect_system_checks_missing_configurator_warning() {
        use crate::config::MergedProfile;

        let mut profile = MergedProfile::default();
        profile.system.insert(
            "nonexistent".to_string(),
            serde_yaml::Value::Mapping(serde_yaml::Mapping::new()),
        );

        let registry = ProviderRegistry::new();
        let checks = collect_system_checks(&profile, &registry).unwrap();
        assert_eq!(checks.len(), 1);
        assert_eq!(checks[0].status, ComplianceStatus::Warning);
        assert!(
            checks[0]
                .detail
                .as_deref()
                .unwrap()
                .contains("no configurator")
        );
    }

    #[test]
    fn collect_system_checks_diff_error_warning() {
        use crate::config::MergedProfile;

        let mut profile = MergedProfile::default();
        profile.system.insert(
            "mock".to_string(),
            serde_yaml::Value::String("desired".into()),
        );

        let mut registry = ProviderRegistry::new();
        registry
            .system_configurators
            .push(Box::new(InlineSystemMock {
                configurator_name: "mock".to_string(),
                drift_tuples: vec![],
                should_fail: true,
            }));

        let checks = collect_system_checks(&profile, &registry).unwrap();
        assert_eq!(checks.len(), 1);
        assert_eq!(checks[0].status, ComplianceStatus::Warning);
        assert!(checks[0].detail.as_deref().unwrap().contains("diff failed"));
    }

    #[test]
    fn collect_system_checks_multiple_drifts_multiple_violations() {
        use crate::config::MergedProfile;
        let mut profile = MergedProfile::default();
        profile.system.insert(
            "mock".to_string(),
            serde_yaml::Value::String("desired".into()),
        );

        let mut registry = ProviderRegistry::new();
        registry
            .system_configurators
            .push(Box::new(InlineSystemMock {
                configurator_name: "mock".to_string(),
                drift_tuples: vec![
                    ("a".into(), "1".into(), "0".into()),
                    ("b".into(), "true".into(), "false".into()),
                ],
                should_fail: false,
            }));

        let checks = collect_system_checks(&profile, &registry).unwrap();
        assert_eq!(checks.len(), 2);
        assert!(
            checks
                .iter()
                .all(|c| c.status == ComplianceStatus::Violation)
        );
    }

    #[test]
    fn watch_path_directory() {
        let dir = tempfile::tempdir().unwrap();
        let checks = collect_watch_path_checks(&dir.path().to_string_lossy());
        assert_eq!(checks.len(), 1);
        assert_eq!(checks[0].status, ComplianceStatus::Compliant);
        assert!(checks[0].detail.as_deref().unwrap().contains("directory"));
    }

    #[test]
    fn export_snapshot_creates_parent_dir() {
        let dir = tempfile::tempdir().unwrap();
        let nested = dir.path().join("deep/nested/dir");
        let export = ComplianceExport {
            format: ComplianceFormat::Json,
            path: nested.display().to_string(),
        };
        let snapshot = ComplianceSnapshot {
            timestamp: "2026-03-25T12:00:00Z".into(),
            machine: MachineInfo {
                hostname: "test".into(),
                os: "linux".into(),
                arch: "x86_64".into(),
            },
            profile: "default".into(),
            sources: vec![],
            checks: vec![],
            summary: ComplianceSummary {
                compliant: 0,
                warning: 0,
                violation: 0,
            },
        };

        let path = export_snapshot_to_file(&snapshot, &export).unwrap();
        assert!(path.exists());
        assert!(nested.exists());
    }

    #[test]
    fn compute_summary_all_statuses() {
        let checks = vec![
            ComplianceCheck {
                status: ComplianceStatus::Compliant,
                ..Default::default()
            },
            ComplianceCheck {
                status: ComplianceStatus::Compliant,
                ..Default::default()
            },
            ComplianceCheck {
                status: ComplianceStatus::Warning,
                ..Default::default()
            },
            ComplianceCheck {
                status: ComplianceStatus::Violation,
                ..Default::default()
            },
            ComplianceCheck {
                status: ComplianceStatus::Violation,
                ..Default::default()
            },
            ComplianceCheck {
                status: ComplianceStatus::Violation,
                ..Default::default()
            },
        ];
        let summary = compute_summary(&checks);
        assert_eq!(summary.compliant, 2);
        assert_eq!(summary.warning, 1);
        assert_eq!(summary.violation, 3);
    }
}