alef 0.67.6

use super::*;

fn gen_file(rel: &str, content: &str) -> crate::core::backend::GeneratedFile {
    crate::core::backend::GeneratedFile {
        path: std::path::PathBuf::from(rel),
        content: content.to_string(),
        generated_header: true,
    }
}

fn gen_file_unheadered(rel: &str, content: &str) -> crate::core::backend::GeneratedFile {
    crate::core::backend::GeneratedFile {
        path: std::path::PathBuf::from(rel),
        content: content.to_string(),
        generated_header: false,
    }
}

/// The defect this closes: a pre-existing file at a path alef would emit
/// and mark, but that predates the marker system, deadlocks the write
/// guard forever (see `FrozenFile`'s doc). `alef verify` must surface it
/// even though it never carries a hash to compare, which is why this is a
/// distinct check from `verify_walk`'s stale-hash comparison.
#[test]
fn frozen_managed_paths_reports_an_unmarked_pre_existing_file() {
    let dir = tempfile::tempdir().expect("tempdir");
    std::fs::write(dir.path().join("SomeType.java"), "final class SomeType {}\n").unwrap();
    let files = vec![gen_file("SomeType.java", "final class SomeType {}\n")];

    let frozen = frozen_managed_paths(&files, dir.path());

    assert_eq!(frozen.len(), 1);
    assert_eq!(frozen[0].path, dir.path().join("SomeType.java").display().to_string());
    assert_eq!(
        frozen[0].remedy.as_deref(),
        Some("// This file is auto-generated by alef — DO NOT EDIT.")
    );
    assert_eq!(
        frozen[0].near_miss, None,
        "plain hand-written content has no near miss to report"
    );
}

/// A pre-existing file whose leading lines look like a failed attempt at a marker (mentions
/// both "alef" and "generated" without matching `content_has_alef_marker`) is still frozen,
/// but the report should name what's already there, not just what's missing.
#[test]
fn frozen_managed_paths_reports_a_near_miss_when_one_is_present() {
    let dir = tempfile::tempdir().expect("tempdir");
    std::fs::write(
        dir.path().join("SomeType.java"),
        "// This alef-generated file should not be edited.\nfinal class SomeType {}\n",
    )
    .unwrap();
    let files = vec![gen_file("SomeType.java", "final class SomeType {}\n")];

    let frozen = frozen_managed_paths(&files, dir.path());

    assert_eq!(frozen.len(), 1);
    assert_eq!(
        frozen[0].near_miss.as_deref(),
        Some("// This alef-generated file should not be edited.")
    );
}

/// A managed file that already carries the marker is stale-or-fresh
/// territory (`verify_walk`'s job), never frozen — the guard that would
/// deadlock a write never engages once a marker is present.
#[test]
fn frozen_managed_paths_reports_nothing_when_the_existing_file_already_carries_the_marker() {
    let dir = tempfile::tempdir().expect("tempdir");
    let marked = format!(
        "{}final class SomeType {{}}\n",
        crate::core::hash::header(crate::core::hash::CommentStyle::DoubleSlash)
    );
    std::fs::write(dir.path().join("SomeType.java"), &marked).unwrap();
    let files = vec![gen_file("SomeType.java", "final class SomeType {}\n")];

    assert!(frozen_managed_paths(&files, dir.path()).is_empty());
}

/// A managed file that does not yet exist is `missing_managed_paths`'
/// territory, not frozen's -- there is nothing on disk to be frozen.
#[test]
fn frozen_managed_paths_reports_nothing_when_the_file_does_not_exist() {
    let dir = tempfile::tempdir().expect("tempdir");
    let files = vec![gen_file("SomeType.java", "final class SomeType {}\n")];

    assert!(frozen_managed_paths(&files, dir.path()).is_empty());
}

/// The required negative control: a legitimately user-owned, unmarked
/// scaffold-once file (`Cargo.toml`, `package.json`, gemspec, lockfiles)
/// must never be reported frozen, even though it exists on disk without a
/// marker -- exactly the shape a naive "unmarked file that looks
/// generated" heuristic would misfire on. Getting this wrong would tell
/// users to hand ownership of their own hand-edited files to alef.
#[test]
fn frozen_managed_paths_ignores_a_hand_written_scaffold_file() {
    let dir = tempfile::tempdir().expect("tempdir");
    std::fs::write(dir.path().join("Cargo.toml"), "[package]\nname = \"demo\"\n").unwrap();
    let files = vec![gen_file_unheadered("Cargo.toml", "[package]\nname = \"demo\"\n")];

    assert!(frozen_managed_paths(&files, dir.path()).is_empty());
}

/// A self-marking backend (custom Swift/Kotlin/Dart/Gleam/Zig headers,
/// `docs::render`'s `.md` pages) bakes its literal header straight into
/// `GeneratedFile::content` regardless of `generated_header`. The remedy
/// must be read from that content, not reconstructed from the path -- a
/// path-derived generic header would be the wrong text to hand back here.
#[test]
fn frozen_managed_paths_reads_the_remedy_from_self_marked_content() {
    let dir = tempfile::tempdir().expect("tempdir");
    std::fs::write(dir.path().join("Foo.swift"), "struct Foo {}\n").unwrap();
    let files = vec![gen_file_unheadered(
        "Foo.swift",
        "// Generated by alef. Do not edit by hand.\nstruct Foo {}\n",
    )];

    let frozen = frozen_managed_paths(&files, dir.path());

    assert_eq!(frozen.len(), 1);
    assert_eq!(
        frozen[0].remedy.as_deref(),
        Some("// Generated by alef. Do not edit by hand.")
    );
}

/// A managed path whose format has no comment syntax at all (`.json`) and carries no
/// `.alef-ownership.toml` record either is still reported frozen when `generated_header`
/// claims ownership, with no literal marker line to hand back -- there is nothing to
/// paste in, and (unlike the paired positive control below) alef genuinely has no proof
/// of authorship for this path yet, so the write guard would refuse it too.
#[test]
fn frozen_managed_paths_reports_no_remedy_for_an_unmarkable_extension() {
    let dir = tempfile::tempdir().expect("tempdir");
    std::fs::write(dir.path().join("manifest.json"), "{}\n").unwrap();
    let files = vec![gen_file("manifest.json", "{}\n")];

    let frozen = frozen_managed_paths(&files, dir.path());

    assert_eq!(frozen.len(), 1);
    assert_eq!(frozen[0].remedy, None);
}

/// The defect this closes (alef #-frozen-verify-disagreement): a `.json`-style path that
/// cannot carry a marker but that alef *has* durably recorded owning -- exactly what
/// `alef adopt` or a delete-and-regenerate leaves behind -- must not be reported frozen.
/// Before `frozen_managed_paths` consulted `is_owned_by_ownership_record`, this positive
/// control failed identically to the negative control above: the function only ever
/// checked the content marker, so a file the write guard would happily accept stayed
/// "frozen" in `alef verify`'s report forever.
#[test]
fn frozen_managed_paths_reports_nothing_for_an_unmarkable_extension_with_a_committed_ownership_record() {
    let dir = tempfile::tempdir().expect("tempdir");
    let path = dir.path().join("manifest.json");
    std::fs::write(&path, "{}\n").unwrap();
    crate::cli::cache::record_scaffold_owned_path(dir.path(), &path).expect("record ownership");
    let files = vec![gen_file("manifest.json", "{}\n")];

    assert!(
        frozen_managed_paths(&files, dir.path()).is_empty(),
        "a path the committed ownership record already proves alef owns must agree with \
         the write guard, which would happily overwrite it"
    );
}

/// Defect B: `.clang-format` is YAML underneath (`#` line comments), so once
/// `marker_header_syntax` recognizes it by file name, a pre-existing unmarked copy must
/// get a real, pasteable remedy -- not the "no comment syntax" message that is only true
/// for genuinely unmarkable formats like `.json`/`DESCRIPTION`. Reporting an impossible
/// remedy for a format that can actually carry one is exactly the failure mode this
/// closes.
#[test]
fn frozen_managed_paths_offers_a_real_remedy_for_clang_format() {
    let dir = tempfile::tempdir().expect("tempdir");
    std::fs::write(dir.path().join(".clang-format"), "---\nBasedOnStyle: LLVM\n").unwrap();
    let files = vec![gen_file(".clang-format", "---\nBasedOnStyle: LLVM\n")];

    let frozen = frozen_managed_paths(&files, dir.path());

    assert_eq!(frozen.len(), 1);
    assert_eq!(
        frozen[0].remedy.as_deref(),
        Some("# This file is auto-generated by alef — DO NOT EDIT.")
    );
}

/// Defect: `carries_alef_marker()` is `generated_header || content_has_alef_marker`, so a
/// `GeneratedFile` with `generated_header: false` whose content embeds no marker at all --
/// exactly the PHP backend's `config.m4` (`generate_config_m4`,
/// `src/backends/php/gen_bindings/rust_items.rs`, emitted with `generated_header: false`
/// alongside `.m4` content that carries no alef marker text) -- is filtered out by
/// `managed_generated_files` before `frozen_managed_paths` ever runs its own
/// ownership-record fallback (`is_owned_by_ownership_record`) over it. The write guard
/// (`write_files_report`, `src/cli/pipeline/generate/write.rs`) still refuses to overwrite
/// such a path once it exists without a committed ownership record -- so this was a real
/// write refusal `alef generate` reports but `alef verify` had no way to see, because the
/// candidate never reached the frozen check at all. ~keep
#[test]
fn frozen_managed_paths_reports_an_unmarkable_generated_header_false_file_with_no_ownership_record() {
    let dir = tempfile::tempdir().expect("tempdir");
    std::fs::write(dir.path().join("config.m4"), "dnl old content\n").unwrap();
    let files = vec![gen_file_unheadered(
        "config.m4",
        "dnl Configuration for Rust-based PHP extension via ext-php-rs.\n",
    )];

    let frozen = frozen_managed_paths(&files, dir.path());

    assert_eq!(
        frozen.len(),
        1,
        "an unmarkable, generated_header: false, unmarked-content file the write guard would \
         refuse must be surfaced by alef verify too"
    );
    assert_eq!(frozen[0].path, dir.path().join("config.m4").display().to_string());
    assert_eq!(
        frozen[0].remedy, None,
        "`.m4` has no comment syntax alef stamps, so there is no literal marker line to hand back"
    );
}

/// The paired positive control: once `.alef-ownership.toml` durably records this exact
/// path -- what `alef generate`'s writer itself does on the run that first authors it
/// (`write_files_report`'s `record_scaffold_owned_path` call) -- the write guard would
/// happily accept the file again, so `alef verify` must agree and stay silent.
#[test]
fn frozen_managed_paths_reports_nothing_for_an_unmarkable_generated_header_false_file_with_a_committed_ownership_record()
 {
    let dir = tempfile::tempdir().expect("tempdir");
    let path = dir.path().join("config.m4");
    std::fs::write(&path, "dnl old content\n").unwrap();
    crate::cli::cache::record_scaffold_owned_path(dir.path(), &path).expect("record ownership");
    let files = vec![gen_file_unheadered(
        "config.m4",
        "dnl Configuration for Rust-based PHP extension via ext-php-rs.\n",
    )];

    assert!(
        frozen_managed_paths(&files, dir.path()).is_empty(),
        "a path the committed ownership record already proves alef owns must agree with the \
         write guard, which would happily overwrite it"
    );
}

/// THE REGRESSION TEST for the frozen/adopt disagreement (task #133): `alef verify` used
/// to report every frozen path under one heading with one remedy ("run `alef adopt
/// <path>`"), and `alef adopt --write` then refused every create-once seed among them
/// outright -- measured at 85 of 85 frozen paths refused in one consumer repo and 99 of
/// 99 (all of them seeds) in another, naming a flag (`--clobber-create-once-seeds`) the
/// report never mentioned.
///
/// A test that only checked the report's message text would miss this entirely -- the
/// message could say the right words and the command could still refuse the exact path
/// named. This instead drives the real `alef adopt` command against every path
/// `frozen_managed_paths` reports, using exactly the flags its own `create_once` field
/// implies (see `FrozenFile::create_once`'s doc for the remedies `alef verify` actually
/// prints for each), and asserts the command accepts what the report told the operator
/// to run. It is a property of the *pair*, not of either side alone: `create_once` is
/// computed by calling `crate::cli::commands::adopt::is_create_once_seed` directly, so
/// this test cannot pass by the two sides coincidentally agreeing today and silently
/// drifting apart again tomorrow -- only by them sharing one predicate, which is the fix. ~keep
#[test]
fn every_frozen_path_is_actually_accepted_by_the_adopt_invocation_its_create_once_flag_implies() {
    let dir = tempfile::tempdir().expect("tempdir");
    let base = dir.path();

    // A create-once seed: unmarkable format, no prior ownership record -- the exact
    // shape that was 100% of both consumer repos' frozen reports.
    std::fs::write(base.join("config.m4"), "dnl old content\n").unwrap();
    let seed_file = gen_file_unheadered(
        "config.m4",
        "dnl Configuration for Rust-based PHP extension via ext-php-rs.\n",
    );

    // A genuinely adoptable frozen file: on the marker rail, markable format -- the
    // other remedy `alef verify` prints under the split heading.
    std::fs::write(base.join("SomeType.java"), "final class SomeType {}\n").unwrap();
    let marker_rail_file = gen_file("SomeType.java", "final class SomeType {}\n");

    let files = vec![seed_file, marker_rail_file];
    let frozen = frozen_managed_paths(&files, base);
    assert_eq!(
        frozen.len(),
        2,
        "fixture precondition: both paths must be reported frozen"
    );

    let seed = frozen
        .iter()
        .find(|f| f.path.ends_with("config.m4"))
        .expect("config.m4 must be in the frozen report");
    assert!(
        seed.create_once,
        "an unmarkable, unrecorded seed must classify as create-once"
    );

    let adoptable = frozen
        .iter()
        .find(|f| f.path.ends_with("SomeType.java"))
        .expect("SomeType.java must be in the frozen report");
    assert!(
        !adoptable.create_once,
        "a marker-rail file must never classify as create-once"
    );

    let managed = crate::cli::commands::adopt::managed_outputs(&files, base);

    // The create-once remedy `alef verify` prints names `--clobber-create-once-seeds`
    // explicitly -- prove a plain `--write` is still refused (the old, wrong remedy)
    // and that the flag verify actually names is what the command accepts.
    let plain_write = crate::cli::commands::adopt::AdoptOptions {
        target: "config.m4".to_owned(),
        base_dir: base.to_path_buf(),
        write: true,
        converged_only: false,
        clobber_create_once_seeds: false,
    };
    assert!(
        crate::cli::commands::adopt::run(&plain_write, &managed).is_err(),
        "a plain `alef adopt --write` must still refuse a create-once seed -- if this ever \
         passes, `is_create_once_seed` and this fixture's `config.m4` have drifted apart"
    );
    let clobbering = crate::cli::commands::adopt::AdoptOptions {
        clobber_create_once_seeds: true,
        ..plain_write
    };
    let seed_report = crate::cli::commands::adopt::run(&clobbering, &managed)
        .expect("the exact remedy `alef verify` prints for a create-once seed must be accepted");
    assert_eq!(seed_report.adopted, vec![std::path::PathBuf::from("config.m4")]);

    // The genuinely-adoptable remedy `alef verify` prints under the other heading is a
    // plain `--write`, no clobber flag -- prove that succeeds too.
    let adopt_marker_rail = crate::cli::commands::adopt::AdoptOptions {
        target: "SomeType.java".to_owned(),
        base_dir: base.to_path_buf(),
        write: true,
        converged_only: false,
        clobber_create_once_seeds: false,
    };
    let adoptable_report = crate::cli::commands::adopt::run(&adopt_marker_rail, &managed).expect(
        "the remedy `alef verify` prints for a genuinely adoptable frozen file must be accepted \
         under a plain --write",
    );
    assert_eq!(
        adoptable_report.adopted,
        vec![std::path::PathBuf::from("SomeType.java")]
    );
}

/// The paired control for the create-once-only case: a single genuinely adoptable
/// (non-create-once) frozen file must still be reported, even sitting alongside a create-once
/// seed that must not. Mixing both shapes in one fixture proves `has_adoptable_frozen_files`
/// reads each entry's own `create_once` flag rather than, say, checking only the first element
/// or the list length. Salvaged from a superseded branch whose fix landed by another route. ~keep
#[test]
fn has_adoptable_frozen_files_is_true_when_one_of_several_frozen_files_is_adoptable() {
    let dir = tempfile::tempdir().expect("tempdir");
    std::fs::write(dir.path().join("seed.zzz"), "old seed content\n").unwrap();
    std::fs::write(dir.path().join("SomeType.java"), "final class SomeType {}\n").unwrap();
    let files = vec![
        gen_file_unheadered("seed.zzz", "fresh seed content\n"),
        gen_file("SomeType.java", "final class SomeType {}\n"),
    ];

    let frozen = frozen_managed_paths(&files, dir.path());
    assert_eq!(frozen.len(), 2, "fixture precondition: both paths must be frozen");

    assert!(
        has_adoptable_frozen_files(&frozen),
        "a genuinely adoptable frozen file must still be detected even alongside a \
         create-once seed that must not gate the exit code on its own"
    );
}

/// Base case: nothing frozen means nothing to adopt.
#[test]
fn has_adoptable_frozen_files_is_false_for_an_empty_list() {
    assert!(!super::has_adoptable_frozen_files(&[]));
}

/// Drives the real `frozen_managed_paths` on a fixture whose only frozen path is a create-once
/// seed -- `generated_header: false`, no self-marked content, no ownership record, and an
/// extension `is_alef_derived_output` does not recognize (the `.csproj`/`.zon`/`.m4` shape two
/// consumer repos hit, 85 of 85 and 99 of 99 frozen paths respectively). Before the exit-code
/// fix the gate was "is the frozen list non-empty", which this fixture would have failed
/// forever, since a plain `alef generate` deliberately never adds a seed's marker. ~keep
#[test]
fn has_adoptable_frozen_files_is_false_when_every_frozen_file_is_a_create_once_seed() {
    let dir = tempfile::tempdir().expect("tempdir");
    std::fs::write(dir.path().join("seed.zzz"), "old seed content\n").unwrap();
    let files = vec![crate::core::backend::GeneratedFile {
        path: std::path::PathBuf::from("seed.zzz"),
        content: "fresh seed content\n".to_string(),
        generated_header: false,
    }];

    let frozen = super::frozen_managed_paths(&files, dir.path());
    assert_eq!(
        frozen.len(),
        1,
        "fixture precondition: exactly one frozen create-once seed"
    );
    assert!(
        frozen[0].create_once,
        "fixture precondition: the seed must classify as create-once"
    );
    assert!(
        !super::has_adoptable_frozen_files(&frozen),
        "a frozen list of only create-once seeds has nothing `alef adopt --write` accepts, so \
         verify must not gate its exit code on it"
    );
}

/// Negative control: a genuinely adoptable frozen file MUST still gate. Without this the test
/// above would pass just as well if the predicate always returned false. ~keep
#[test]
fn has_adoptable_frozen_files_is_true_when_a_real_adoptable_frozen_file_remains() {
    let dir = tempfile::tempdir().expect("tempdir");
    std::fs::write(dir.path().join("binding.rs"), "fn hand_written() {}\n").unwrap();
    let files = vec![crate::core::backend::GeneratedFile {
        path: std::path::PathBuf::from("binding.rs"),
        content: "fn generated() {}\n".to_string(),
        generated_header: true,
    }];

    let frozen = super::frozen_managed_paths(&files, dir.path());
    assert_eq!(frozen.len(), 1, "fixture precondition: exactly one frozen file");
    assert!(
        !frozen[0].create_once,
        "fixture precondition: this one is on the marker rail"
    );
    assert!(super::has_adoptable_frozen_files(&frozen));
}

/// THE Part 1 regression, end to end through the same call `alef verify` makes.
///
/// A create-once seed on disk with no marker must not appear in the frozen report at all, and
/// the report must not name `--clobber-create-once-seeds`. Measured cause: a consumer's two CI
/// jobs failed on "Frozen generated files detected" listing 102 paths, of which `alef adopt
/// --converged-only` adopted zero -- 72 refused by alef itself as create-once seeds (13 LICENSE
/// files, `mvnw`, `gradlew`, `build.zig.zon`, `.gitkeep`s), leaving the destructive flag as the
/// only escape alef offered for files its own documentation calls user-owned after scaffold.
///
/// Driven through `frozen_managed_paths` rather than a hand-built `FrozenFile`, so a
/// classification change that stopped marking these `create_once` would fail here rather than
/// pass by accident. `LICENSE` has no extension and so no comment syntax alef will key on,
/// which is exactly the shape every one of the 72 refused paths had: unmarkABLE, emitted
/// `generated_header: false`, and therefore a create-once seed by `is_create_once_seed`. ~keep
#[test]
fn report_lines_omits_a_create_once_seed_and_never_names_the_clobber_flag() {
    let dir = tempfile::tempdir().expect("tempdir");
    std::fs::write(dir.path().join("LICENSE"), "Copyright the consumer\n").unwrap();
    let files = vec![gen_file_unheadered("LICENSE", "Copyright <holder>\n")];

    let frozen = frozen_managed_paths(&files, dir.path());
    assert_eq!(frozen.len(), 1, "the seed is still classified");
    assert!(
        frozen[0].create_once,
        "an unmarked seed with unmarked content is create-once"
    );

    let report = super::report_lines(&frozen);
    assert!(
        report.is_empty(),
        "a create-once seed must not be reported as frozen: {report:?}"
    );
    assert_eq!(super::unmarked_create_once_seeds(&frozen).len(), 1);
}

/// The other half: a genuinely adoptable frozen file must still get its heading and a pointer
/// to `alef adopt <path> --write` -- never an instruction to hand-paste the marker, which
/// `crate::cli::pipeline::generate::write::report_refused_writes` (the write guard's own
/// refusal message) explicitly warns against. Without this, deleting the whole report would
/// satisfy the test above. ~keep
#[test]
fn report_lines_still_reports_a_genuinely_adoptable_frozen_file() {
    let dir = tempfile::tempdir().expect("tempdir");
    std::fs::write(dir.path().join("SomeType.java"), "final class SomeType {}\n").unwrap();
    let files = vec![gen_file("SomeType.java", "final class SomeType {}\n")];

    let frozen = frozen_managed_paths(&files, dir.path());
    let report = super::report_lines(&frozen).join("\n");
    assert!(report.contains("Frozen generated files detected"), "{report}");
    assert!(report.contains("SomeType.java"), "{report}");
    assert!(report.contains("alef adopt <path> --write"), "{report}");
    assert!(
        !report.contains("add marker:"),
        "the report must never instruct a reader to hand-paste the marker -- that is the exact \
         workflow the write guard warns against: {report}"
    );
    assert!(super::unmarked_create_once_seeds(&frozen).is_empty());
}