"""The skills are shared outside the source projects: no patient data, internal IPs,
credentials or keys in any bundled file, and the Superbill extracts are marked as examples."""
import re
from pathlib import Path

import pytest

ROOT = Path(__file__).resolve().parents[1]
SKILLS = [ROOT / "skills" / "rpa-dashboard-ai", ROOT / "skills" / "rpa-dashboard-no-ai"]
AI_REFERENCE = ROOT / "skills" / "rpa-dashboard-ai" / "templates" / "reference"
FORBIDDEN = {
    "internal IP": r"\b(10\.\d{1,3}|192\.168|172\.(1[6-9]|2\d|3[01]))\.\d{1,3}\.\d{1,3}\b",
    "Google API key": r"AIza[0-9A-Za-z_-]{30,}",
    "OpenAI/Anthropic key": r"\bsk-[A-Za-z0-9_-]{20,}",
    "AWS key": r"\bAKIA[0-9A-Z]{16}\b",
    "private key": r"-----BEGIN [A-Z ]*PRIVATE KEY-----",
    "hard-coded secret": r"""(?i)\b(password|passwd|api_?key|secret|client_secret)\b\s*[:=]\s*['"][^'"{}\s]{6,}['"]""",
    "SSN": r"\b\d{3}-\d{2}-\d{4}\b",
    "quoted roster name ('SURNAME, FIRST')": r"""["'][A-Z]{2,}, [A-Z]""",
    "client name": r"Gulf Coast",
}
MARKER = "EXAMPLE ONLY"


def text_files():
    for skill in SKILLS:
        for f in skill.rglob("*"):
            if f.is_file() and "node_modules" not in f.parts and f.name != "package-lock.json":
                yield f


@pytest.mark.parametrize("what", FORBIDDEN)
def test_no_sensitive_data_in_bundled_files(what):
    hits = [f"{f.relative_to(ROOT)}:{n}" for f in text_files()
            for n, line in enumerate(f.read_text(encoding="utf-8", errors="ignore").splitlines(), 1)
            if re.search(FORBIDDEN[what], line)]
    assert not hits, f"{what} found: {hits}"


def test_superbill_extracts_are_marked_as_examples():
    files = [f for f in AI_REFERENCE.rglob("*") if f.is_file()]
    assert files
    unmarked = [str(f.relative_to(ROOT)) for f in files
                if MARKER not in "".join(f.read_text(encoding="utf-8").splitlines(keepends=True)[:5])]
    assert not unmarked, f"no '{MARKER}' banner in the first lines: {unmarked}"