// Security contracts for malformed upstream media payload handling.
//
// Scope: inspect server-side bundled upstream media ingress before UVC/UAC
// handoff.
// Targets: server/src/main/relay_service.rs and
// server/src/main/relay_service/upstream_media_rpc.rs.
// Why: upstream media payloads arrive from remote clients; malformed, stale,
// replayed, or impossible bundles should be dropped as data, not played into
// the browser-visible webcam/microphone path.

const RELAY_SERVICE: &str = include_str!(concat!(
    env!("CARGO_MANIFEST_DIR"),
    "/server/src/main/relay_service.rs"
));
const UPSTREAM_RPC: &str = include_str!(concat!(
    env!("CARGO_MANIFEST_DIR"),
    "/server/src/main/relay_service/upstream_media_rpc.rs"
));
const MEDIA_V2: &str = include_str!(concat!(
    env!("CARGO_MANIFEST_DIR"),
    "/server/src/main/relay_service/media_v2.rs"
));

#[test]
fn empty_and_impossible_mixed_bundles_are_rejected_before_handoff() {
    for marker in [
        "if !has_audio && !has_video",
        "return None;",
        "MEDIA_V2_MAX_MIXED_CAPTURE_SPAN_US",
        "dropping mixed bundle with impossible A/V capture span",
        "continue;",
    ] {
        assert!(
            RELAY_SERVICE.contains(marker)
                || UPSTREAM_RPC.contains(marker)
                || MEDIA_V2.contains(marker),
            "upstream media ingress should preserve malformed-bundle guard {marker}"
        );
    }

    let impossible_span_idx = UPSTREAM_RPC
        .find("dropping mixed bundle with impossible A/V capture span")
        .expect("impossible span drop marker");
    let audio_handoff_idx = UPSTREAM_RPC
        .find(".send(scheduled_audio)")
        .expect("audio handoff send marker");
    assert!(
        impossible_span_idx < audio_handoff_idx,
        "impossible A/V capture spans must be dropped before handoff workers receive media"
    );
}

#[test]
fn stale_or_replayed_bundles_are_dropped_before_codec_recovery_state_advances() {
    for marker in [
        "bundle.seq <= seq",
        "dropping duplicate/stale bundled packet",
        "max_queue_age_ms",
        "media_v2_handoff_schedule",
        "dropping whole bundle because it is already outside the freshness budget",
    ] {
        assert!(
            RELAY_SERVICE.contains(marker) || UPSTREAM_RPC.contains(marker),
            "upstream media ingress should preserve replay/stale guard {marker}"
        );
    }

    let stale_seq_idx = UPSTREAM_RPC
        .find("dropping duplicate/stale bundled packet")
        .expect("stale sequence marker");
    let schedule_idx = UPSTREAM_RPC
        .find("media_v2_handoff_schedule")
        .expect("schedule marker");
    assert!(
        stale_seq_idx < schedule_idx,
        "replayed bundles should be dropped before scheduling output media"
    );
}

#[test]
fn stale_hevc_video_enters_recovery_instead_of_streaming_delta_damage() {
    for marker in [
        "waiting_for_hevc_keyframe = true",
        "v2 held HEVC delta frame until next recovery keyframe",
        "media_v2_should_hold_hevc_video_for_recovery",
        "media_v2_has_hevc_recovery_keyframe",
    ] {
        assert!(
            RELAY_SERVICE.contains(marker) || UPSTREAM_RPC.contains(marker),
            "HEVC ingress should preserve recovery marker {marker}"
        );
    }
}
