pmat 3.26.0

#![cfg_attr(coverage_nightly, coverage(off))]
//! Supply chain, examples, book validation, cross-crate, and regression gate checks.

use super::cache::{read_cached_metric, read_deny_cache_fallback};
use super::deny_refresh::{
    refresh_deny_cache, DenyRefresh, CARGO_DENY_INSTALL_HINT, DENY_STATUS_PATH,
};
use super::types::CachedMetric;
use crate::cli::handlers::work_contract::{EvidenceType, FalsificationResult};
use anyhow::Result;
use std::path::{Path, PathBuf};
use std::process::Command;

/// True if the project is a Rust crate/workspace (has a `Cargo.toml`).
///
/// PMAT-058: Rust-only supply-chain gates (`cargo deny` / `cargo audit`) are
/// inapplicable to repos without a `Cargo.toml` (e.g. the infra fleet repo,
/// pure-YAML/Makefile repos). Detect this and skip rather than hard-fail on a
/// missing deny cache.
pub(crate) fn is_rust_project(project_path: &Path) -> bool {
    project_path.join("Cargo.toml").exists()
}

/// Test supply chain integrity.
///
/// O(1) on a fresh passing cache; a stale, absent or failing one costs one
/// bounded `cargo deny check`, which is the only thing that writes that cache.
#[provable_contracts_macros::contract("pmat-core.yaml", equation = "check_compliance")]
pub(crate) async fn test_supply_chain_integrity(
    project_path: &Path,
) -> Result<FalsificationResult> {
    print!("Reading deny cache... ");

    // PMAT-058: cargo deny / audit only apply to Rust projects. A repo with no
    // Cargo.toml has no supply chain to vet, so skip instead of failing on a
    // missing (and unobtainable) deny cache.
    if !is_rust_project(project_path) {
        return Ok(FalsificationResult::passed(
            "N/A (non-Rust repo: no Cargo.toml)".to_string(),
        ));
    }

    // O(1) hot path: a cache inside the block window is a stat + parse.
    // Try primary cache location, then fallback to work-item and .pmat directories.
    let cached = read_cached_metric(project_path, "deny-status.json")
        .or_else(|| read_deny_cache_fallback(project_path));

    match cached {
        // Only a fresh PASS is authoritative. Caching a failing verdict for the
        // full block window would rebuild #629 in time-boxed form: the user
        // fixes the advisory, and the gate keeps failing from the recorded
        // verdict without re-running cargo-deny, with no action that clears it.
        Some(cache) if !cache.is_stale_block && cache_passed(&cache) => {
            Ok(evaluate_deny_cache(&cache))
        }
        // GH #629: a stale or absent cache used to be a dead end. The gate said
        // "Run 'cargo deny check' first", but cargo-deny writes to stdout and
        // nothing ever wrote the file the gate reads, so no user action could
        // clear it and every completion needed --override-claims supply-chain.
        // Refresh it ourselves; this costs one subprocess per block window.
        _ => Ok(refresh_then_evaluate(project_path)),
    }
}

/// Re-run cargo-deny, record the verdict, and judge the claim on it.
fn refresh_then_evaluate(project_path: &Path) -> FalsificationResult {
    match refresh_deny_cache(project_path) {
        DenyRefresh::Recorded(cache) => evaluate_deny_cache(&cache),
        DenyRefresh::ToolMissing => FalsificationResult::failed(
            format!(
                "cargo-deny is not installed, so the supply chain cannot be vetted. \
                 Install it with: {CARGO_DENY_INSTALL_HINT}"
            ),
            EvidenceType::BooleanCheck(false),
        ),
        DenyRefresh::Failed(why) => FalsificationResult::failed(
            format!("Could not refresh {DENY_STATUS_PATH}: {why}"),
            EvidenceType::BooleanCheck(false),
        ),
    }
}

/// True if the cache records a passing verdict.
///
/// A malformed cache is deliberately not a pass: it is re-derived rather than
/// trusted, and `evaluate_deny_cache` still reports the malformed case if the
/// refresh cannot replace it.
fn cache_passed(cache: &CachedMetric) -> bool {
    cache.value.get("passed").and_then(|v| v.as_bool()) == Some(true)
}

/// Judge the supply-chain claim from a cache entry known to be fresh enough.
fn evaluate_deny_cache(cache: &CachedMetric) -> FalsificationResult {
    // Validate 'passed' field exists -- reject malformed cache (Popperian Audit v2.1)
    let Some(passed) = cache.value.get("passed").and_then(|v| v.as_bool()) else {
        return FalsificationResult::failed(
            format!("Invalid deny cache (missing 'passed' field). Delete {DENY_STATUS_PATH} and re-run."),
            EvidenceType::BooleanCheck(false),
        );
    };
    let stale_note = format!(" (cached {} min ago)", cache.age_minutes);

    if passed {
        return FalsificationResult::passed(format!("No vulnerabilities{}", stale_note));
    }

    let count = cache
        .value
        .get("vulnerability_count")
        .and_then(|v| v.as_u64())
        .unwrap_or(0);
    // cargo-deny also fails on bans, licences and sources, none of which carry a
    // vulnerability count. Reporting those as "0 vulnerabilities" phrased a
    // failure as a success, so fall back to the recorded reason.
    if count > 0 {
        return FalsificationResult::failed(
            format!("{} vulnerabilities{}", count, stale_note),
            EvidenceType::NumericComparison {
                actual: count as f64,
                threshold: 0.0,
            },
        );
    }

    // A failing check with no vulnerability count is a bans/licence/source
    // failure, or a text-fallback cache that records no count at all. Reporting
    // it as "0 vulnerabilities" phrased a failure as a success, and attaching
    // `0.0 vs 0.0` gave the receipt machine-readable evidence that supported
    // PASS while the verdict said FAIL.
    let reason = cache
        .value
        .get("summary")
        .and_then(|v| v.as_str())
        .filter(|s| !s.is_empty())
        .unwrap_or("no vulnerability count in cache");
    FalsificationResult::failed(
        format!("supply chain check failed: {}{}", reason, stale_note),
        EvidenceType::BooleanCheck(false),
    )
}

/// Test examples compile: O(1) - reads from cached examples status
#[provable_contracts_macros::contract("pmat-core.yaml", equation = "check_compliance")]
pub(crate) async fn test_examples_compile(project_path: &Path) -> Result<FalsificationResult> {
    print!("Reading examples cache... ");

    // O(1): Read from cache instead of running cargo build
    if let Some(cache) = read_cached_metric(project_path, "examples-status.json") {
        if cache.is_stale_block {
            return Ok(FalsificationResult::failed(
                format!(
                    "Examples cache too old ({} min). Run 'cargo build --examples' first.",
                    cache.age_minutes
                ),
                EvidenceType::BooleanCheck(false),
            ));
        }

        // Validate 'passed' field exists -- reject malformed cache (Popperian Audit v2.1)
        let passed = match cache.value.get("passed").and_then(|v| v.as_bool()) {
            Some(p) => p,
            None => {
                return Ok(FalsificationResult::failed(
                    "Invalid examples cache (missing 'passed' field). Re-run 'cargo build --examples'.".to_string(),
                    EvidenceType::BooleanCheck(false),
                ));
            }
        };
        let count = cache
            .value
            .get("count")
            .and_then(|v| v.as_u64())
            .unwrap_or(0);
        let stale_note = format!(" (cached {} min ago)", cache.age_minutes);

        if passed {
            return Ok(FalsificationResult::passed(format!(
                "{} examples OK{}",
                count, stale_note
            )));
        } else {
            let failed = cache
                .value
                .get("failed")
                .and_then(|v| v.as_array())
                .map(|a| {
                    a.iter()
                        .filter_map(|v| v.as_str())
                        .collect::<Vec<_>>()
                        .join(", ")
                })
                .unwrap_or_default();
            return Ok(FalsificationResult::failed(
                format!("Examples failed{}: {}", stale_note, failed),
                EvidenceType::CounterExample { details: failed },
            ));
        }
    }

    // Check if examples directory exists
    let examples_dir = project_path.join("examples");
    if !examples_dir.exists() {
        return Ok(FalsificationResult::passed(
            "No examples directory found (skipping)".to_string(),
        ));
    }

    // No cache available, and nothing in the repo writes one.
    Ok(FalsificationResult::unmeasured(
        "No examples cache; nothing writes .pmat-metrics/examples-status.json".to_string(),
    ))
}

/// Run `make validate-book` and return the result.
///
/// Returns `Some(result)` if the command executed (pass or fail),
/// or `None` if `make` was not available.
fn try_make_validate_book(project_path: &Path) -> Option<FalsificationResult> {
    let output = Command::new("make")
        .args(["validate-book"])
        .current_dir(project_path)
        .output()
        .ok()?;

    if output.status.success() {
        Some(FalsificationResult::passed(
            "pmat-book validation passed".to_string(),
        ))
    } else {
        let stderr = String::from_utf8_lossy(&output.stderr);
        Some(FalsificationResult::failed(
            "pmat-book validation failed".to_string(),
            EvidenceType::CounterExample {
                details: stderr.chars().take(500).collect(),
            },
        ))
    }
}

/// Run pmat-book chapter test script as a fallback.
///
/// Returns `Some(result)` if the script exists and executed,
/// or `None` if not available.
fn try_book_chapter_tests(book_path: &Path) -> Option<FalsificationResult> {
    let test_script = book_path.join("tests/ch13/test_language_examples.sh");
    if !test_script.exists() {
        return None;
    }

    let output = Command::new("bash")
        .arg(&test_script)
        .current_dir(book_path)
        .output()
        .ok()?;

    if output.status.success() {
        Some(FalsificationResult::passed(
            "pmat-book chapter tests passed".to_string(),
        ))
    } else {
        let stderr = String::from_utf8_lossy(&output.stderr);
        Some(FalsificationResult::failed(
            "pmat-book chapter tests failed".to_string(),
            EvidenceType::CounterExample {
                details: stderr.chars().take(500).collect(),
            },
        ))
    }
}

/// Test pmat-book validation: book tests must pass
#[provable_contracts_macros::contract("pmat-core.yaml", equation = "check_compliance")]
pub(crate) async fn test_book_validation(project_path: &Path) -> Result<FalsificationResult> {
    print!("Validating pmat-book... ");

    // Check if this is the pmat repository by looking for pmat-book sibling
    let book_path = match project_path.parent().map(|p| p.join("pmat-book")) {
        Some(p) if p.exists() => p,
        _ => {
            return Ok(FalsificationResult::passed(
                "pmat-book not found (skipping validation)".to_string(),
            ));
        }
    };

    // Try make validate-book first, then fall back to chapter test script
    if let Some(result) = try_make_validate_book(project_path) {
        return Ok(result);
    }

    if let Some(result) = try_book_chapter_tests(&book_path) {
        return Ok(result);
    }

    // No validation method available
    Ok(FalsificationResult::passed(
        "pmat-book not found (skipping validation)".to_string(),
    ))
}

/// Test cross-crate parity: verify sibling project tests still pass after changes.
///
/// Reads `.pmat-work/cross-crate.json` config for sibling project paths and test commands.
/// Only runs if config exists (opt-in per project).
#[provable_contracts_macros::contract("pmat-core.yaml", equation = "check_compliance")]
pub(crate) async fn test_cross_crate_parity(project_path: &Path) -> Result<FalsificationResult> {
    print!("Checking cross-crate config... ");

    // Look for cross-crate config
    let config_path = project_path.join(".pmat-work/cross-crate.json");

    if !config_path.exists() {
        return Ok(FalsificationResult::passed(
            "No cross-crate config (create .pmat-work/cross-crate.json to enable)".to_string(),
        ));
    }

    let content = std::fs::read_to_string(&config_path)?;
    let config: serde_json::Value = serde_json::from_str(&content)?;

    let Some(projects) = config.get("projects").and_then(|p| p.as_array()) else {
        return Ok(FalsificationResult::passed(
            "No projects in cross-crate config".to_string(),
        ));
    };

    let mut failures = Vec::new();
    let mut passed_count = 0;

    for project in projects {
        let Some(path) = project.get("path").and_then(|p| p.as_str()) else {
            continue;
        };
        let test_cmd = project
            .get("test_command")
            .and_then(|c| c.as_str())
            .unwrap_or("cargo test --lib");

        let full_path = project_path.join(path);
        if !full_path.exists() {
            continue;
        }

        // Split test command into program + args
        let parts: Vec<&str> = test_cmd.split_whitespace().collect();
        let (program, args) = parts.split_first().unwrap_or((&"cargo", &[]));

        let output = Command::new(program)
            .args(args)
            .current_dir(&full_path)
            .output();

        match output {
            Ok(out) if out.status.success() => passed_count += 1,
            Ok(_) => failures.push(path.to_string()),
            Err(_) => failures.push(format!("{} (command failed)", path)),
        }
    }

    if failures.is_empty() {
        Ok(FalsificationResult::passed(format!(
            "{} sibling project(s) pass",
            passed_count
        )))
    } else {
        let paths: Vec<PathBuf> = failures.iter().map(PathBuf::from).collect();
        Ok(FalsificationResult::failed(
            format!(
                "{} sibling project(s) failed: {}",
                failures.len(),
                failures.join(", ")
            ),
            EvidenceType::FileList(paths),
        ))
    }
}

/// Test regression gate: verify no performance regressions from cached benchmarks.
///
/// Reads `.pmat-metrics/benchmark-status.json` for cached benchmark results.
#[provable_contracts_macros::contract("pmat-core.yaml", equation = "check_compliance")]
pub(crate) async fn test_regression_gate(project_path: &Path) -> Result<FalsificationResult> {
    print!("Reading benchmark cache... ");

    // O(1): Read from cache
    if let Some(cache) = read_cached_metric(project_path, "benchmark-status.json") {
        if cache.is_stale_block {
            return Ok(FalsificationResult::passed(format!(
                "Benchmark cache old ({} min), skipping",
                cache.age_minutes
            )));
        }

        let passed = cache
            .value
            .get("passed")
            .and_then(|v| v.as_bool())
            .unwrap_or(true);

        let stale_note = format!(" (cached {} min ago)", cache.age_minutes);

        if passed {
            let benchmarks = cache
                .value
                .get("count")
                .and_then(|v| v.as_u64())
                .unwrap_or(0);
            return Ok(FalsificationResult::passed(format!(
                "{} benchmark(s) OK{}",
                benchmarks, stale_note
            )));
        } else {
            let regressions = cache
                .value
                .get("regressions")
                .and_then(|v| v.as_array())
                .map(|a| {
                    a.iter()
                        .filter_map(|v| v.as_str())
                        .collect::<Vec<_>>()
                        .join(", ")
                })
                .unwrap_or_default();
            return Ok(FalsificationResult::failed(
                format!("Performance regression{}: {}", stale_note, regressions),
                EvidenceType::CounterExample {
                    details: regressions,
                },
            ));
        }
    }

    // No cache, and nothing in the repo writes one.
    Ok(FalsificationResult::unmeasured(
        "No benchmark cache (run benchmarks to populate .pmat-metrics/benchmark-status.json)"
            .to_string(),
    ))
}

/// Test meta-falsification: verify the falsifier itself is not broken
#[provable_contracts_macros::contract("pmat-core.yaml", equation = "check_compliance")]
pub(crate) fn test_meta_falsification(project_path: &Path) -> Result<FalsificationResult> {
    print!("Injecting dummy failure... ");

    let detector_working = crate::services::gaming_detector::run_meta_falsification(project_path)?;

    if detector_working {
        Ok(FalsificationResult::passed(
            "Detected dummy gaming pattern correctly".to_string(),
        ))
    } else {
        Ok(FalsificationResult::failed(
            "Falsifier FAILED to detect known gaming pattern (SYSTEM BROKEN)".to_string(),
            EvidenceType::CounterExample {
                details: "Dummy #[cfg(not(coverage))] was ignored by detector".into(),
            },
        ))
    }
}