tests/test_semantics.py

"""The AST checkers, and the fragment gate that decides when to trust them.

Each test names the defect it guards. Every one of them fails against the code
as it stood before the session that wrote them.
"""
import inspect

import pytest

import corpus
import semantics


# ------------------------------------------------- prefer_sql_constraint_applies

UNIQUENESS_IN_PYTHON = """@api.constrains('code')
def _check_unique_code(self):
    for rec in self:
        if self.search_count([('code', '=', rec.code), ('id', '!=', rec.id)]):
            raise ValidationError('Code must be unique')"""

SQL_CONSTRAINT = """_sql_constraints = [
    ('code_uniq', 'UNIQUE(code)', 'Code must be unique.'),
]"""

LITERAL_BOUND = """@api.constrains('product_uom_qty')
def _check_quantity(self):
    for rec in self:
        if rec.product_uom_qty < 0:
            raise ValidationError('Quantity cannot be negative')"""

CROSS_TABLE = """@api.constrains('product_id', 'product_uom_qty', 'company_id')
def _check_available_qty(self):
    for rec in self:
        if not rec.product_id or rec.product_uom_qty <= 0:
            continue
        available = rec.product_id.with_company(rec.company_id).qty_available
        if rec.product_uom_qty > available:
            raise ValidationError('too much')"""

TWO_COLUMN_COMPARISON = """@api.constrains('date_start', 'date_end')
def _check_dates(self):
    for rec in self:
        if rec.date_start and rec.date_end and rec.date_end < rec.date_start:
            raise ValidationError('End before start')"""

FLOAT_UTILS = """@api.constrains('selling_price')
def _check_price(self):
    precision = self.env['decimal.precision'].precision_get('Product Price')
    for rec in self:
        if float_is_zero(rec.selling_price, precision_digits=precision):
            raise ValidationError('Price cannot be zero')"""


def fires(code):
    return bool(semantics.prefer_sql_constraint_applies(code))


def test_uniqueness_in_python_is_caught():
    """The rule's own 'wrong' sample. validate fails the build without this."""
    assert fires(UNIQUENESS_IN_PYTHON)


def test_sql_constraint_is_silent():
    """The rule's own 'correct' sample. A checker that fires here cries wolf."""
    assert not fires(SQL_CONSTRAINT)


def test_literal_bound_is_caught():
    """The gap that started it all.

    The predecessor regex matched only `@api.constrains ... search_count`, so a
    single-column bound -- the commonest case the rule governs -- passed twelve
    domain checks in silence.
    """
    assert fires(LITERAL_BOUND)


def test_decorator_call_does_not_disqualify_the_function():
    """@api.constrains(...) is itself an ast.Call.

    Walking the whole function node counts it among the body's calls, and since
    any call disqualifies a candidate, every constraint disqualified itself. The
    checker looked correct and caught nothing.
    """
    assert fires(LITERAL_BOUND)
    assert semantics.prefer_sql_constraint_applies(LITERAL_BOUND)[0][0] == 4


def test_cross_table_access_is_silent():
    """A CHECK genuinely cannot read another table, so this must not fire.

    Verified against real 30B output, not an invented sample: the reach through
    rec.product_id.with_company(...) is what puts it out of scope.
    """
    assert not fires(CROSS_TABLE)


def test_two_column_comparison_is_silent():
    """A declared limit, asserted so it cannot be lost by accident.

    CHECK(date_end >= date_start) is valid SQL, so this is recall deliberately
    traded for precision on a `high` rule. If someone later widens the checker,
    this test should fail and make them say so on purpose.
    """
    assert not fires(TWO_COLUMN_COMPARISON)


def test_helper_call_in_the_condition_is_silent():
    assert not fires(FLOAT_UTILS)


def test_message_only_field_read_does_not_block_a_finding():
    """rec.display_name is read to phrase the error, not to decide the rule."""
    code = """@api.constrains('qty')
def _check_qty(self):
    for rec in self:
        if rec.qty <= 0:
            raise ValidationError('Bad qty on %s' % rec.display_name)"""
    assert fires(code)


def test_unparseable_code_yields_no_findings():
    assert semantics.prefer_sql_constraint_applies("def broken(:") == []


# ---------------------------------------------------------- is_lifted_fragment

def test_method_taking_self_is_a_lifted_fragment():
    """A method shown without its class was never going to carry its imports.

    Flagging them turned a correct answer into WARN and buried the real finding
    under two that could never have been otherwise.
    """
    tree, _ = semantics.parse_python(LITERAL_BOUND)
    assert semantics.is_lifted_fragment(tree, [])


def test_real_module_is_not_a_fragment():
    """The gate must not disable the import check wholesale."""
    code = """from odoo import api

def helper(x):
    return ValidationError(x)"""
    tree, _ = semantics.parse_python(code)
    assert not semantics.is_lifted_fragment(tree, [])
    assert [m for _, m in semantics.missing_imports(tree)]


def test_repair_notes_alone_mark_a_fragment():
    tree, _ = semantics.parse_python("x = 1")
    assert semantics.is_lifted_fragment(tree, ["the block only parses as a class body"])


# ------------------------------------------------------------ the other checks

def test_constrains_missing_field_is_caught():
    code = """@api.constrains('date_start')
def _check_dates(self):
    for rec in self:
        if rec.date_end < rec.date_start:
            raise ValidationError('End before start')"""
    hits = semantics.constrains_lists_every_field_read(code)
    assert any("date_end" in m for _, m in hits)


def test_constrains_listing_every_field_is_silent():
    assert semantics.constrains_lists_every_field_read(TWO_COLUMN_COMPARISON) == []


def test_depends_missing_dotted_path_is_caught():
    code = """@api.depends('line_ids')
def _compute_total(self):
    for rec in self:
        rec.total = sum(rec.line_ids.price)"""
    hits = semantics.depends_covers_compute_reads(code)
    assert any("line_ids.price" in m for _, m in hits)


@pytest.mark.parametrize("name", sorted(semantics.CHECKS))
def test_every_registered_checker_is_callable_and_returns_triples(name):
    """run_check raises on an unknown name rather than passing silently.

    A renamed checker that returned 'clean' would turn a critical rule into a
    permanent false pass, so the registry is part of the contract.

    The third element is the likelihood a finding earned from a trigger, or None
    to keep its rule's grade. run_check normalises it, so a checker with no
    opinion about triggers still answers in the one shape every caller unpacks.
    """
    out = semantics.run_check(name, LITERAL_BOUND)
    assert isinstance(out, list)
    for item in out:
        assert len(item) == 3
        assert isinstance(item[0], int) and isinstance(item[1], str)
        assert item[2] is None or item[2] in corpus.LIKELIHOOD_ORDER


@pytest.mark.parametrize("name", sorted(semantics.CONTEXT_CHECKS))
def test_a_context_checker_is_registered_and_takes_facts(name):
    """CONTEXT_CHECKS is a hand-written set, so it can name a checker that no
    longer takes facts -- which would pass the tree to a positional argument
    meaning something else."""
    assert name in semantics.CHECKS
    argspec = inspect.getfullargspec(semantics.CHECKS[name])
    assert argspec.args[:2] == ["code", "facts"]


def test_unknown_checker_name_raises():
    with pytest.raises(KeyError):
        semantics.run_check("no_such_checker", "x = 1")


# ------------------------------------------------- ondelete, read through

ONDELETE_READ = """class Thing(models.Model):
    _name = "my.thing"

    task_id = fields.Many2one("my.task")

    def _label(self):
        for rec in self:
            rec.name = rec.task_id.filepath
"""

ONDELETE_DECLARED_ONLY = """class Thing(models.Model):
    _name = "my.thing"

    task_id = fields.Many2one("my.task")
"""


def test_a_dereferenced_many2one_without_ondelete_is_caught():
    """The shape where 'set null' silently changes an answer: delete the parent,
    the reference is nulled, and rec.task_id.filepath becomes False."""
    hits = semantics.ondelete_leaves_a_dangling_read(ONDELETE_READ)
    assert hits, "no finding"
    assert "filepath" in hits[0][1], "name the read that makes it matter"
    assert hits[0][0] == 4, "the line has to point at the declaration"


def test_a_declaration_nobody_reads_through_is_silent():
    """Nulling a reference no code dereferences changes no answer. Flagging it
    produced 4.1 findings per 1000 lines on reviewed OCA code."""
    assert semantics.ondelete_leaves_a_dangling_read(ONDELETE_DECLARED_ONLY) == []


def test_required_many2one_is_exempt_from_ondelete():
    """Odoo defaults a required Many2one to 'restrict', which is what the rule
    recommends, so the orphaning cannot happen there."""
    code = ONDELETE_READ.replace('fields.Many2one("my.task")',
                                 'fields.Many2one("my.task", required=True)')
    assert semantics.ondelete_leaves_a_dangling_read(code) == []


def test_related_many2one_is_exempt_from_ondelete():
    code = ONDELETE_READ.replace('fields.Many2one("my.task")',
                                 'fields.Many2one("my.task", related="x.task_id")')
    assert semantics.ondelete_leaves_a_dangling_read(code) == []


def test_a_declared_ondelete_is_silent():
    code = ONDELETE_READ.replace('fields.Many2one("my.task")',
                                 'fields.Many2one("my.task", ondelete="restrict")')
    assert semantics.ondelete_leaves_a_dangling_read(code) == []


def test_reading_the_relation_itself_is_not_a_dereference():
    """`if rec.task_id:` is a recordset test and is falsy-safe. It is
    `rec.task_id.filepath` that quietly becomes False."""
    code = """class Thing(models.Model):
    task_id = fields.Many2one("my.task")

    def _label(self):
        for rec in self:
            if rec.task_id:
                rec.name = "yes"
"""
    assert semantics.ondelete_leaves_a_dangling_read(code) == []


def test_a_read_through_mapped_stays_unread():
    """Measured and not taken (ARCHITECTURE 3.79). mapped("task_id.filepath")
    reads through the relation as the attribute does, but a read is placed by
    the field's name, and a mapped() is often called on records of another
    model: on the three trees it added one finding, a quant's location_id read
    in stock.location's file, and nothing true."""
    code = ONDELETE_READ.replace(
        "rec.name = rec.task_id.filepath",
        'rec.name = ",".join(self.mapped("task_id.filepath"))')
    assert semantics.ondelete_leaves_a_dangling_read(code) == []


# ----------------------------------------------------- check_company scope

COMPANY_SCOPED = """class Thing(models.Model):
    _name = "my.thing"

    company_id = fields.Many2one("res.company", required=True)
    journal_id = fields.Many2one("account.journal")
"""


def test_a_company_scoped_model_needs_check_company():
    hits = semantics.check_company_missing_on_company_owned_relation(COMPANY_SCOPED)
    assert hits, "no finding"
    assert "account.journal" in hits[0][1]


def test_check_company_present_is_silent():
    code = COMPANY_SCOPED.replace('fields.Many2one("account.journal")',
                                  'fields.Many2one("account.journal", check_company=True)')
    assert semantics.check_company_missing_on_company_owned_relation(code) == []


def test_a_model_with_no_company_is_not_asked_for_check_company():
    """check_company compares the record's company against the target's. On a
    model that has no company_id there is nothing to compare, and the regex
    that preceded this could not see the class at all."""
    code = COMPANY_SCOPED.replace(
        '    company_id = fields.Many2one("res.company", required=True)\n', "")
    assert semantics.check_company_missing_on_company_owned_relation(code) == []


def test_res_company_itself_is_exempt():
    """Odoo's own fields.py carries a branch for check_company on a field of
    res.company. Six of the 37 OCA hits were this."""
    code = COMPANY_SCOPED.replace('_name = "my.thing"', '_inherit = "res.company"')
    assert semantics.check_company_missing_on_company_owned_relation(code) == []


def test_a_wizard_is_exempt():
    """A TransientModel's records do not persist, and the harm the rule names is
    a multi-company client seeing another tenant's data on a DOCUMENT. Eleven of
    the 37 OCA hits were wizards."""
    code = COMPANY_SCOPED.replace("models.Model", "models.TransientModel")
    assert semantics.check_company_missing_on_company_owned_relation(code) == []


def test_a_bare_declaration_block_is_still_checked():
    """A generated answer arrives with no class around it. Treating the module
    as one implicit model body keeps the rule working on snippets, and costs
    nothing on real code, where fields always live in a class."""
    code = """company_id = fields.Many2one("res.company", required=True)
journal_id = fields.Many2one("account.journal")
"""
    assert semantics.check_company_missing_on_company_owned_relation(code)


# --------------------------------------------- storedness, and underscores

def test_a_non_stored_compute_is_outside_the_rule():
    """The rule is about STORED computes -- "written once and never recomputed,
    survives restarts". None of that happens to a value the database never
    holds. 30 of 95 OCA findings were non-stored computes."""
    code = """total = fields.Float(compute="_compute_total")

@api.depends('line_ids')
def _compute_total(self):
    for rec in self:
        rec.total = sum(l.price for l in rec.line_ids)
"""
    assert semantics.depends_covers_compute_reads(code) == []


def test_a_stored_compute_is_still_checked():
    code = """total = fields.Float(compute="_compute_total", store=True)

@api.depends('line_ids')
def _compute_total(self):
    for rec in self:
        rec.total = sum(l.price for l in rec.line_ids)
"""
    hits = semantics.depends_covers_compute_reads(code)
    assert any("line_ids.price" in m for _, m in hits)


def test_an_undeclared_compute_keeps_the_rules_assumption():
    """Most of this checker's work is on generated snippets, where no field
    declaration is present at all. Absence is unknown, not unstored."""
    code = """@api.depends('line_ids')
def _compute_total(self):
    for rec in self:
        rec.total = sum(l.price for l in rec.line_ids)
"""
    assert semantics.depends_covers_compute_reads(code)


# A compute that fills its field through a helper, update() or write() makes
# no attribute store, so the field it produces used to read as a dependency.
# calendar.recurrence's _compute_rrule compares and write()s its own rrule;
# OpenSPP's _compute_center_area_ids clears and fills its own through update().
OWN_OUTPUT = """class Recurrence(models.Model):
    rrule = fields.Char(compute="_compute_rrule", store=True)
    rrule_type = fields.Selection([("daily", "Daily")])
    label = fields.Char(compute="_compute_label", store=True)

    @api.depends("rrule_type")
    def _compute_rrule(self):
        for recurrence in self:
            current = recurrence._serialize()
            if recurrence.rrule != current:
                recurrence.write({"rrule": current})
"""


def test_a_field_the_file_says_the_method_computes_is_its_own_output():
    assert semantics.run_check("depends_covers_compute_reads", OWN_OUTPUT) == []


def test_another_computed_field_or_the_same_one_through_a_relation_still_counts():
    """The exemption is the method's own output on the same record. A field
    another method computes is an input, and rrule read off a parent is a
    recursive dependency, which Odoo supports and wants declared."""
    code = OWN_OUTPUT.replace(
        "if recurrence.rrule != current:",
        "if recurrence.rrule != current or recurrence.label or recurrence.parent_id.rrule:")
    reads = sorted(message.split("'")[1] for _, message, _ in
                   semantics.run_check("depends_covers_compute_reads", code))
    assert reads == ["label", "parent_id", "parent_id.rrule"], reads


def test_a_read_through_the_methods_own_output_stays_exempt():
    """Measured and kept (ARCHITECTURE 3.73). Odoo drops @api.depends("team_id")
    from team_id's own triggers but keeps "team_id.member_ids", so this read
    could be declared. With the exemption narrowed to the bare field, core
    gained 37 findings: 17 true, 16 of them a smart default like this one,
    checking its own earlier choice, and 20 false."""
    code = """class Lead(models.Model):
    team_id = fields.Many2one("crm.team", compute="_compute_team_id", store=True, readonly=False)

    @api.depends("user_id")
    def _compute_team_id(self):
        for lead in self:
            if lead.team_id and lead.user_id in lead.team_id.member_ids:
                continue
            lead.team_id = lead._default_team(lead.user_id)
"""
    assert semantics.run_check("depends_covers_compute_reads", code) == []


def test_an_underscore_name_is_not_a_field():
    """Odoo reserves the underscore prefix for ORM internals and mixin
    configuration. base_time_window reads self._time_window_overlap_check_field,
    and the checker told its author to declare it in @api.constrains, where the
    ORM ignores it."""
    code = """@api.constrains('start', 'end')
def _check_window(self):
    for rec in self:
        field = rec._time_window_overlap_check_field
        if rec.start > rec.end:
            raise ValidationError('bad')
"""
    hits = semantics.constrains_lists_every_field_read(code)
    assert not any("_time_window" in m for _, m in hits)


# mapped("a.b") names a field without an attribute access ever appearing. The
# checker used to read only the receiver, so this compute looked declared and
# the same read spelled as a generator was reported.
MAPPED_COMPUTE = """@api.depends({declared})
def _compute_outstanding_total(self):
    for account in self:
        account.outstanding_total = sum(account.invoice_ids.{call})
"""


def test_a_mapped_path_is_a_read_the_depends_must_declare():
    code = MAPPED_COMPUTE.format(declared='"invoice_ids"',
                                 call='mapped("amount_residual")')
    hits = semantics.run_check("depends_covers_compute_reads", code)
    assert [(line, "'invoice_ids.amount_residual'" in message)
            for line, message, _ in hits] == [(4, True)], hits


def test_a_mapped_path_the_depends_declares_is_quiet():
    for declared in ('"invoice_ids.amount_residual"',
                     '"invoice_ids.amount_residual.currency_id"'):
        code = MAPPED_COMPUTE.format(declared=declared,
                                     call='mapped("amount_residual")')
        assert semantics.run_check("depends_covers_compute_reads", code) == [], \
            declared


def test_a_mapped_path_keeps_the_checkers_exemptions():
    """A trailing .id names the relation, and a filtered() receiver is still
    the recordset it filters."""
    code = MAPPED_COMPUTE.format(
        declared='"invoice_ids.partner_id"',
        call='filtered(lambda i: i.posted).mapped("partner_id.id")')
    assert semantics.run_check("depends_covers_compute_reads", code) == []


def test_a_mapped_lambda_or_name_is_not_guessed():
    for call in ("mapped(lambda i: i.amount_residual)", "mapped(FIELD)"):
        code = MAPPED_COMPUTE.format(declared='"invoice_ids"', call=call)
        assert semantics.run_check("depends_covers_compute_reads", code) == [], call


# mapped()'s siblings name what they read the same way, and were silent after
# it was not. Each call below reads the paths beside it, relative to
# invoice_ids; a trailing id names the relation and is never asked for.
NAMED_READS = [
    ('filtered("is_paid")', ["is_paid"]),
    ('filtered("partner_id.is_company")', ["partner_id.is_company"]),
    ('grouped("journal_id")', ["journal_id"]),
    ('sorted("sequence")', ["sequence"]),
    ('sorted(key="sequence", reverse=True)', ["sequence"]),
    ('sorted("date desc, id")', ["date"]),
    ('sorted("partner_id.name DESC NULLS LAST, date:month")', ["partner_id.name", "date"]),
    ('filtered_domain([("state", "=", "done"), "|", (1, "=", 1), '
     '("partner_id.id", "=", 7)])', ["partner_id", "state"]),
    ('filtered_domain([("line_ids", "any", [("paid", "=", True)])])',
     ["line_ids", "line_ids.paid"]),
]


@pytest.mark.parametrize("call, reads", NAMED_READS)
def test_a_field_named_in_a_string_is_a_read_the_depends_must_declare(call, reads):
    code = MAPPED_COMPUTE.format(declared='"invoice_ids"', call=call)
    hits = semantics.run_check("depends_covers_compute_reads", code)
    reported = sorted(message.split("'")[1] for _, message, _ in hits)
    assert reported == sorted("invoice_ids." + read for read in reads), hits


@pytest.mark.parametrize("call, reads", NAMED_READS)
def test_a_field_named_in_a_string_the_depends_declares_is_quiet(call, reads):
    declared = ", ".join('"invoice_ids.{0}"'.format(read) for read in reads)
    code = MAPPED_COMPUTE.format(declared=declared, call=call)
    assert semantics.run_check("depends_covers_compute_reads", code) == []


@pytest.mark.parametrize("call", [
    "filtered(lambda i: i.is_paid)",
    "sorted(key=lambda i: i.sequence)",
    "sorted(ORDER)",
    "grouped(KEY)",
    "filtered_domain(DOMAIN)",
    "filtered_domain(DOMAIN + [LEAF])",
    'sorted("date desc limit 1")',
    'filtered("line_ids[0]")',
])
def test_a_field_not_written_as_a_literal_is_not_guessed(call):
    code = MAPPED_COMPUTE.format(declared='"invoice_ids"', call=call)
    assert semantics.run_check("depends_covers_compute_reads", code) == [], call


NAMED_EXEMPT = """{head}
    @api.depends("invoice_ids", "line_ids.partner_id.name")
    def _compute_total(self):
        for rec in self:
            {body}
"""


@pytest.mark.parametrize("head, body", [
    # declared as a longer path: line_ids.partner_id.name covers line_ids.partner_id
    ("class A(models.Model):", 'rec.total = rec.line_ids.filtered("partner_id")'),
    # the field this method computes
    ("class A(models.Model):", 'rec.total = rec.filtered("total") and 1'),
    # a non-stored compute
    ('class A(models.Model):\n    total = fields.Float(compute="_compute_total")',
     'rec.total = len(rec.invoice_ids.filtered("is_paid"))'),
    # a wizard
    ("class A(models.TransientModel):",
     'rec.total = len(rec.invoice_ids.filtered("is_paid"))'),
    # phrasing a message
    ("class A(models.Model):",
     'raise UserError(rec.invoice_ids.filtered("is_paid").mapped("name"))'),
    ("class A(models.Model):",
     '_logger.info("%s", rec.invoice_ids.sorted("date")[:1].name)'),
])
def test_a_field_named_in_a_string_keeps_the_checkers_exemptions(head, body):
    code = NAMED_EXEMPT.format(head=head, body=body)
    assert semantics.run_check("depends_covers_compute_reads", code) == [], body


def test_a_named_display_name_override_is_left_alone():
    code = """@api.depends("invoice_ids")
def _compute_display_name(self):
    for rec in self:
        rec.display_name = ", ".join(rec.invoice_ids.sorted("date").mapped("name"))
"""
    assert semantics.run_check("depends_covers_compute_reads", code) == []


# A subscript stopped the path. rec.line_ids[0].amount read nothing past
# line_ids, so a compute taking its value from the first line looked declared.
SUBSCRIPT_COMPUTE = """@api.depends({declared})
def _compute_first(self):
    for rec in self:
        rec.first = {read}
"""


@pytest.mark.parametrize("read, path", [
    ("rec.line_ids[0].amount", "line_ids.amount"),
    ("rec.line_ids[-1].amount", "line_ids.amount"),
    ("rec.line_ids[1:3].amount", "line_ids.amount"),
    ("rec.line_ids.filtered(lambda l: l.paid)[:1].amount", "line_ids.amount"),
    ("self[0].line_ids.amount", "line_ids.amount"),
    ('rec.line_ids[:1].mapped("amount")', "line_ids.amount"),
])
def test_a_read_after_a_subscript_by_position_is_a_read(read, path):
    code = SUBSCRIPT_COMPUTE.format(declared='"line_ids"', read=read)
    hits = semantics.run_check("depends_covers_compute_reads", code)
    assert ["'{0}'".format(path) in message for _, message, _ in hits] == [True], hits
    code = SUBSCRIPT_COMPUTE.format(declared='"{0}"'.format(path), read=read)
    assert semantics.run_check("depends_covers_compute_reads", code) == [], read


def test_a_subscript_reads_every_segment_of_the_chain_after_it():
    """rec.partner_id.child_ids[:1].email reported partner_id.child_ids and
    never the email, which is the field whose change goes unnoticed."""
    code = SUBSCRIPT_COMPUTE.format(declared='"partner_id"',
                                    read="rec.partner_id.child_ids[:1].email")
    hits = semantics.run_check("depends_covers_compute_reads", code)
    assert sorted(message.split("'")[1] for _, message, _ in hits) == [
        "partner_id.child_ids", "partner_id.child_ids.email"], hits


def test_a_loop_over_a_slice_binds_the_same_path():
    code = """@api.depends("line_ids")
def _compute_rest(self):
    for rec in self:
        for line in rec.line_ids.sorted("sequence")[1:]:
            rec.rest += line.discount
"""
    hits = semantics.run_check("depends_covers_compute_reads", code)
    assert sorted(message.split("'")[1] for _, message, _ in hits) == [
        "line_ids.discount", "line_ids.sequence"], hits


@pytest.mark.parametrize("read", [
    "rec[fname].name",            # a field read by name, not records by position
    "rec.line_ids[i].amount",     # a name could hold either
    'rec["partner_id"].name',
    "rec.line_ids[0].id",         # the relation itself, which is declared
])
def test_a_subscript_that_does_not_pick_records_by_position_is_not_followed(read):
    code = SUBSCRIPT_COMPUTE.format(declared='"line_ids"', read=read)
    assert semantics.run_check("depends_covers_compute_reads", code) == [], read


# A call stopped the path the same way. rec.sudo().partner_id.name read nothing
# past the call, so a compute taking a partner's name through sudo() looked as
# if it read nothing from the partner (ARCHITECTURE 3.78).
@pytest.mark.parametrize("read, declared, path", [
    ("rec.sudo().partner_id.name", "partner_id", "partner_id.name"),
    ('rec.with_context(lang="fr_FR").partner_id.name', "partner_id", "partner_id.name"),
    ("rec.line_ids.filtered(lambda l: l.paid).amount", "line_ids", "line_ids.amount"),
    ("rec.line_ids.exists().amount", "line_ids", "line_ids.amount"),
    ("rec.sudo().line_ids[:1].amount", "line_ids", "line_ids.amount"),
])
def test_a_read_through_a_call_that_keeps_the_records_is_a_read(read, declared, path):
    code = SUBSCRIPT_COMPUTE.format(declared='"{0}"'.format(declared), read=read)
    hits = semantics.run_check("depends_covers_compute_reads", code)
    assert ["'{0}'".format(path) in message for _, message, _ in hits] == [True], hits
    code = SUBSCRIPT_COMPUTE.format(declared='"{0}"'.format(path), read=read)
    assert semantics.run_check("depends_covers_compute_reads", code) == [], read


@pytest.mark.parametrize("read", [
    'rec.mapped("line_ids").amount',      # mapped() hands back values
    'rec.env["res.partner"].browse(1).name',   # records of another model
    "rec._first_line().amount",           # a method returns what it likes
])
def test_a_read_through_any_other_call_is_not_followed(read):
    code = SUBSCRIPT_COMPUTE.format(declared='"line_ids"', read=read)
    assert semantics.run_check("depends_covers_compute_reads", code) == [], read


def test_a_constraint_reading_through_sudo_must_list_the_field():
    code = NAMED_CONSTRAINT.format(
        declared='"date_start"',
        body='if self.sudo().date_end:\n        raise ValidationError("x")')
    hits = semantics.run_check("constrains_lists_every_field_read", code)
    assert ["reads 'date_end'" in message for _, message, _ in hits] == [True], hits


def test_a_read_through_a_name_assigned_records_stays_unread():
    """Measured and not taken (ARCHITECTURE 3.80). pending is the first
    pending review exactly, and binding every name whose assignments all
    resolve to one path is exact too. What the depends check then reads
    through such names is mostly not a dependency: on odoo core 37 of 113
    findings read true, 28 of them smart defaults, and the false ones were
    values kept on purpose, fields stored nowhere, and decorators merged or
    covered from outside the file. The tree facts decide 27 of the 113 now,
    and at most 37 of the 86 left can be true (ARCHITECTURE 3.87)."""
    depends = """@api.depends('review_ids.status', 'review_ids.sequence')
def _compute_current_tier(self):
    for rec in self:
        pending = rec.review_ids.filtered(lambda r: r.status == 'pending').sorted('sequence')[:1]
        rec.current_tier_id = pending.tier_id
"""
    constrains = """@api.constrains('is_default')
def _check_unique_default(self):
    defaults = self.filtered('is_default')
    companies = {rec.id: rec.company_id.id for rec in defaults}
    if len(set(companies.values())) < len(companies):
        raise ValidationError('bad')
"""
    assert semantics.run_check("depends_covers_compute_reads", depends) == []
    assert semantics.run_check("constrains_lists_every_field_read", constrains) == []


# A constraint reads a field through a string as a compute does, and writing
# that field alone skips the check. Only the root is compared, as for every
# other read here: @api.constrains cannot follow a dotted name.
NAMED_CONSTRAINT = """@api.constrains({declared})
def _check_dates(self):
    {body}
"""


@pytest.mark.parametrize("body, root", [
    ('if any(self.mapped("date_end")):\n        raise ValidationError("x")', "date_end"),
    ('for rec in self.filtered("active"):\n        rec._check()', "active"),
    ('if self.sorted("sequence")[:1].date_start:\n        raise ValidationError("x")',
     "sequence"),
    ('if self.filtered_domain([("state", "=", "done")]):\n        raise ValidationError("x")',
     "state"),
    ('if self[0].code:\n        raise ValidationError("x")', "code"),
    ('for spread in self:\n        moves = spread.mapped("line_ids.move_id")', "line_ids"),
])
def test_a_constraint_reading_a_field_through_a_string_must_list_it(body, root):
    code = NAMED_CONSTRAINT.format(declared='"date_start"', body=body)
    hits = semantics.run_check("constrains_lists_every_field_read", code)
    assert ["reads '{0}'".format(root) in message for _, message, _ in hits] == [True], hits
    code = NAMED_CONSTRAINT.format(declared='"date_start", "{0}"'.format(root), body=body)
    assert semantics.run_check("constrains_lists_every_field_read", code) == [], body


def test_a_constraint_naming_a_field_only_in_its_message_is_quiet():
    code = NAMED_CONSTRAINT.format(
        declared='"date_start"',
        body='if self.date_start:\n'
             '        raise ValidationError(", ".join(self.mapped("name")))')
    assert semantics.run_check("constrains_lists_every_field_read", code) == []


# ------------------------------------------------------ what a lambda reads

def test_a_read_through_a_lambda_parameter_stays_unread():
    """Measured and not taken (ARCHITECTURE 3.72). Binding the parameter is
    exact: filtered() hands its lambda every record of the receiver. But what
    a filter tests is mostly a field that selects records rather than one that
    feeds the value: on odoo core 40 of 127 depends findings read true, 28 of
    them smart defaults, and 9 of 27 constrains findings. The tree facts decide
    32 of the 121 depends findings left since then, and at most 41 of the 89
    they leave can be true (ARCHITECTURE 3.87)."""
    depends = """@api.depends('line_ids.amount')
def _compute_total(self):
    for rec in self:
        rec.total = sum(rec.line_ids.filtered(lambda l: l.state == 'done').mapped('amount'))
"""
    constrains = """@api.constrains('date_start')
def _check(self):
    if self.filtered(lambda r: r.date_end and r.date_end < r.date_start):
        raise ValidationError('bad')
"""
    assert semantics.run_check("depends_covers_compute_reads", depends) == []
    assert semantics.run_check("constrains_lists_every_field_read", constrains) == []


# ------------------------------------------- narrowed by `nexa recall --aim`

# Placed against the method each fix edited, prefer-sql-constraint scored 0
# on-target against 47 other-symbol and ondelete 1 against 34 -- the two worst
# in the corpus. These pin the narrowings that came out of reading their
# findings on 229,600 lines of OpenSPP.

def test_uniqueness_across_another_model_is_not_this_rule():
    """`self.env["other.model"].search(...)` tests uniqueness across tables, and
    a UNIQUE on THIS table cannot express it. Recommending one is advice that
    cannot be followed, which is worse than advice nobody wanted."""
    code = '''
class Handler(models.Model):
    _name = "endpoint.route.handler"

    @api.constrains("route")
    def _check_route_unique_across_models(self):
        for model in self._consumer_models():
            if self.env[model].sudo().search_count([("route", "in", self.routes)]):
                raise ValidationError("Non unique route")
'''
    assert semantics.run_check("prefer_sql_constraint_applies", code) == []


def test_uniqueness_on_self_is_still_reported():
    """The narrowing must not cost the case the rule is for."""
    code = '''
class Client(models.Model):
    _name = "api.client"

    @api.constrains("client_id")
    def _check_unique_client_id(self):
        for record in self:
            if self.search([("client_id", "=", record.client_id),
                            ("id", "!=", record.id)], limit=1):
                raise ValidationError("Client ID must be unique")
'''
    found = semantics.run_check("prefer_sql_constraint_applies", code)
    assert len(found) == 1
    assert "cannot race" in found[0][1]


def test_a_class_that_already_declares_the_constraint_is_left_alone():
    """Telling an author to do the thing they did is how a checker gets
    switched off. Both spellings: _sql_constraints, and the models.Constraint
    form Odoo 17 introduced."""
    modern = '''
class Client(models.Model):
    _name = "api.client"
    _client_id_unique = models.Constraint("UNIQUE(client_id)", "Must be unique.")

    @api.constrains("client_id")
    def _check_unique_client_id(self):
        for record in self:
            if self.search([("client_id", "=", record.client_id)], limit=1):
                raise ValidationError("Client ID must be unique")
'''
    classic = modern.replace(
        '_client_id_unique = models.Constraint("UNIQUE(client_id)", "Must be unique.")',
        '_sql_constraints = [("client_id_uniq", "UNIQUE(client_id)", "Must be unique.")]')
    assert semantics.run_check("prefer_sql_constraint_applies", modern) == []
    assert semantics.run_check("prefer_sql_constraint_applies", classic) == []


def test_a_constraint_on_a_different_column_does_not_excuse_this_one():
    """The narrowing is per column. A model guarding `code` has not guarded
    `client_id`, and treating the class as covered would lose real findings."""
    code = '''
class Client(models.Model):
    _name = "api.client"
    _code_unique = models.Constraint("UNIQUE(code)", "Code must be unique.")

    @api.constrains("client_id")
    def _check_unique_client_id(self):
        for record in self:
            if self.search([("client_id", "=", record.client_id)], limit=1):
                raise ValidationError("Client ID must be unique")
'''
    assert len(semantics.run_check("prefer_sql_constraint_applies", code)) == 1


ONDELETE_BODY = '''
class Alert(models.Model):
    _name = "spp.alert"

    model_id = fields.Many2one("ir.model")

    def run(self):
{body}
'''


def test_a_guarded_dereference_is_not_a_dangling_read():
    """The rule's complaint is that a nulled reference yields False rather than
    raising. An author who tested for it has answered that, and on OpenSPP the
    guard is the majority idiom: 101 findings became 20 once it was read."""
    for guard in (
            "        if not self.model_id:\n            return 0\n"
            "        return self.model_id.model",
            "        if self.model_id:\n            return self.model_id.model",
            "        return self.model_id and self.model_id.model or ''",
            "        return self.model_id.model if self.model_id else ''"):
        code = ONDELETE_BODY.format(body=guard)
        assert semantics.run_check("ondelete_leaves_a_dangling_read", code) == [], guard


def test_an_unguarded_dereference_is_still_reported():
    """The narrowing must not cost the case the rule is for: a compute that
    reads straight through the relation and silently writes False."""
    code = ONDELETE_BODY.format(body="        return self.model_id.model")
    found = semantics.run_check("ondelete_leaves_a_dangling_read", code)
    assert len(found) == 1
    assert "set null" in found[0][1]


def test_a_guard_in_one_method_does_not_excuse_another():
    """Function-level, not file-level. A method that checks the field says
    nothing about the method next to it that does not."""
    code = '''
class Alert(models.Model):
    _name = "spp.alert"

    model_id = fields.Many2one("ir.model")

    def careful(self):
        if not self.model_id:
            return 0
        return self.model_id.model

    def careless(self):
        return self.model_id.name
'''
    found = semantics.run_check("ondelete_leaves_a_dangling_read", code)
    assert len(found) == 1


def test_an_unproven_advisory_rule_still_fires_correctly():
    """odoo.except-order-follows-the-hierarchy ships advisory because nothing
    measured here has met the defect, not because the defect is imaginary. The
    checker still has to work, or the label is covering for a broken rule."""
    shadowed = (
        "try:\n"
        "    record.action_approve()\n"
        "except UserError as exc:\n"
        "    pass\n"
        "except AccessError as exc:\n"
        "    pass\n")
    found = semantics.run_check("handler_order_shadows_a_subclass", shadowed)
    assert len(found) == 1
    assert "never runs" in found[0][1]
    assert semantics.run_check(
        "handler_order_shadows_a_subclass",
        shadowed.replace("UserError", "_TMP").replace("AccessError", "UserError")
                .replace("_TMP", "AccessError")) == []


def test_the_odoo_hierarchy_matches_odoo_exceptions():
    """Read out of odoo/exceptions.py, identical in 16.0 and 18.0. If Odoo ever
    reparents one of these the rule is wrong, and this is where that shows."""
    for name in ("AccessDenied", "AccessError", "MissingError", "ValidationError"):
        assert semantics._is_subclass_of(name, "UserError"), name
    assert not semantics._is_subclass_of("UserError", "ValidationError")
    assert not semantics._is_subclass_of("RedirectWarning", "UserError")


# ---------------------------------------------- triggers on the two conditionals

def facts(declared=(), deleted=(), multi_company=False, complete=True):
    return {"walked": True, "complete": complete, "files": 1,
            "models_declared": set(declared), "models_deleted": set(deleted),
            "multi_company": multi_company}


UNGUARDED = ONDELETE_BODY.format(body="        return self.model_id.model")


def test_ondelete_says_nothing_when_the_parent_is_never_deleted():
    """Master data. The rule's harm is a read through a NULLED reference, and
    nothing nulls one if nothing deletes the parent."""
    quiet = facts(declared=["ir.model"])
    assert semantics.run_check("ondelete_leaves_a_dangling_read",
                               UNGUARDED, quiet) == []


def test_ondelete_is_a_defect_when_the_parent_really_is_deleted():
    found = semantics.run_check("ondelete_leaves_a_dangling_read", UNGUARDED,
                                facts(declared=["ir.model"],
                                      deleted=["ir.model"]))
    assert len(found) == 1
    assert found[0][2] == "defect", "a trigger that fired should promote"
    assert "does delete ir.model" in found[0][1]


def test_ondelete_keeps_its_grade_when_the_trigger_cannot_be_answered():
    """No tree, or a parent this tree does not define. The rule is reported
    exactly as it was before triggers existed, which is the honest answer."""
    for supplied in (None, facts(declared=["something.else"])):
        found = semantics.run_check("ondelete_leaves_a_dangling_read",
                                    UNGUARDED, supplied)
        assert len(found) == 1
        assert found[0][2] is None, "an unanswered trigger must not promote"


CHECK_COMPANY_BODY = '''
class Thing(models.Model):
    _name = "my.thing"

    company_id = fields.Many2one("res.company")
    journal_id = fields.Many2one("account.journal")
'''


def test_check_company_says_nothing_in_a_single_company_codebase():
    """One company cannot leak to another. The rule describes a boundary this
    codebase does not have."""
    assert semantics.run_check("check_company_missing_on_company_owned_relation",
                               CHECK_COMPANY_BODY, facts()) == []


def test_check_company_is_a_defect_where_multi_company_is_in_use():
    found = semantics.run_check("check_company_missing_on_company_owned_relation",
                                CHECK_COMPANY_BODY, facts(multi_company=True))
    assert len(found) == 1
    assert found[0][2] == "defect"
    assert "runs multi-company" in found[0][1]


def test_check_company_keeps_its_grade_with_no_tree():
    found = semantics.run_check("check_company_missing_on_company_owned_relation",
                                CHECK_COMPANY_BODY, None)
    assert len(found) == 1 and found[0][2] is None


def test_an_incomplete_walk_never_silences_either_rule():
    """Promote on evidence, never drop on the absence of it. A module-sized walk
    is exactly the case where absence means 'not in this module'."""
    partial = facts(declared=["ir.model"], complete=False)
    assert len(semantics.run_check("ondelete_leaves_a_dangling_read",
                                   UNGUARDED, partial)) == 1
    assert len(semantics.run_check("check_company_missing_on_company_owned_relation",
                                   CHECK_COMPANY_BODY, partial)) == 1


# ------------------------------------------ depends: prefix coverage, both ways

STORED_COMPUTE_DOTTED = """total = fields.Float(compute='_c', store=True)

@api.depends('line_ids.price')
def _c(self):
    for rec in self:
        rec.total = sum(l.price for l in rec.line_ids)"""

STORED_COMPUTE_ROOT_ONLY = """total = fields.Float(compute='_c', store=True)

@api.depends('line_ids')
def _c(self):
    for rec in self:
        rec.total = sum(l.price for l in rec.line_ids)"""


def test_a_dotted_depends_covers_a_read_of_its_own_prefix():
    """@api.depends('line_ids.price') registers the whole chain, so the ORM
    already recomputes when line_ids itself changes and a body reading
    rec.line_ids needs nothing more.

    Comparing declarations as exact strings made that correct code stale: 42 of
    this checker's 104 findings on OpenSPP were this, 40% of its output. The
    rule's own `correct` sample hid it by declaring 'line_ids' redundantly
    alongside the dotted paths, so validate passed throughout.
    """
    assert semantics.depends_covers_compute_reads(STORED_COMPUTE_DOTTED) == []


def test_a_declared_prefix_still_does_not_cover_what_hangs_off_it():
    """The converse, which is the rule itself and must not follow.

    Declaring 'line_ids' cannot excuse a body reading line_ids.price -- that is
    the value that goes stale, and the whole reason the checker exists. A
    coverage test asserting only the first direction would happily accept a
    checker that had stopped working.
    """
    hits = semantics.depends_covers_compute_reads(STORED_COMPUTE_ROOT_ONLY)
    assert hits, "the incomplete depends stopped being reported"
    assert any("line_ids.price" in message for _, message in hits)


# -------------------------------------- decorators nothing can read statically

COMPUTED_CONSTRAINS = """@api.constrains(*FIELDS)
def _check(self):
    for rec in self:
        if rec.date_start > rec.date_end:
            raise ValidationError('bad range')"""


def test_a_computed_decorator_is_a_gap_and_not_a_finding():
    """@api.constrains(*FIELDS) is legal code that a static pass cannot read.

    It used to collapse into the same answer as "declares nothing", so every
    field the body read became a missing declaration -- and the sentence it
    produced said "declares only nothing", which is where the bug announced
    itself. Nothing is wrong with the code, so nothing is reported; what could
    not be decided is recorded instead.
    """
    gaps = []
    assert semantics.constrains_lists_every_field_read(
        COMPUTED_CONSTRAINS, gaps=gaps) == []
    assert gaps and "not string literals" in gaps[0]
    assert "_check()" in gaps[0], "the gap names the method it could not read"


def test_every_checker_survives_a_decorator_it_cannot_read():
    """Four checkers read a decorator's arguments and two of them only tested
    for absence. Handing them a sentinel they did not expect turned a false
    positive into a crash, which scan_source reports as a broken checker."""
    for name in semantics.CHECKS:
        semantics.run_check(name, COMPUTED_CONSTRAINS)


# ------------------------------------------ constrains_declares_a_dotted_name

def dotted(code, gaps=None):
    return semantics.constrains_declares_a_dotted_name(code, gaps=gaps)


def test_a_dotted_name_of_three_segments_is_caught():
    """The regex wanted a closing quote after the second segment. In
    partner_id.country_id.code it found a dot there, and said nothing about a
    name the ORM ignores exactly as it ignores a two-segment one."""
    hits = dotted("""@api.constrains('partner_id.country_id.code')
def _check_country(self):
    for rec in self:
        if rec.partner_id.country_id.code not in ('BE', 'FR'):
            raise ValidationError('Unsupported country')""")
    assert [line for line, _ in hits] == [1]
    assert "'partner_id.country_id.code'" in hits[0][1]
    assert "never runs the check" in hits[0][1]


def test_a_dotted_name_with_a_digit_in_it_is_caught():
    """[a-z_] has no digits, so every name through an l10n_ field was invisible
    to the regex. The plain name beside it still registers, and the message says
    that is now the only write that runs the check."""
    hits = dotted("""@api.constrains('l10n_in_gst_treatment', 'partner_id.l10n_in_pan')
def _check_pan(self):
    for move in self:
        if not move.partner_id.l10n_in_pan:
            raise ValidationError('PAN required')""")
    assert len(hits) == 1
    assert "'partner_id.l10n_in_pan'" in hits[0][1]
    assert "only when l10n_in_gst_treatment is written" in hits[0][1]


def test_plain_names_are_not_a_finding():
    """Every literal declaration on the three trees is this shape, 41 of them
    with a digit in a name. A checker that fired here would fire on all of it."""
    assert dotted("""@api.constrains('l10n_in_pan', 'date_start', 'date_end')
def _check(self):
    pass""") == []
    assert dotted("""@api.constrains()
def _check(self):
    pass""") == []


def test_a_dotted_name_is_reported_on_its_decorator():
    """Where the names are and where a marker goes, whichever line the dotted
    one sits on and whatever else decorates the method."""
    hits = dotted("""class Move(models.Model):
    @api.model
    @api.constrains(
        'name',
        'partner_id.country_id',
    )
    def _check(self):
        pass""")
    assert [line for line, _ in hits] == [3]


def test_a_computed_constrains_list_is_a_gap_and_not_a_finding():
    """*FIELDS might hold a dotted name or not; nothing here can say. Reading it
    as "nothing dotted" would be a clean result nobody earned."""
    gaps = []
    assert dotted(COMPUTED_CONSTRAINS, gaps=gaps) == []
    assert gaps and "not string literals" in gaps[0] and "_check()" in gaps[0]


def test_a_method_neither_constrains_checker_can_read_is_one_gap():
    """Both constrains checkers skip @api.constrains(*FIELDS), and each says so.
    `check` printed that twice, and fieldtest counted it twice as a file it
    could not fully read."""
    import layers
    assert {"constrains_lists_every_field_read",
            "constrains_declares_a_dotted_name"} <= semantics.GAP_CHECKS
    rules = [r for r in corpus.load_rules() if r["stack"] == "odoo"]
    gaps = []
    layers.scan_source(COMPUTED_CONSTRAINS, rules, "odoo", gaps=gaps)
    assert len(gaps) == 1, gaps


# ---------------------------------------------- balance_js: regex vs division

def test_a_regex_after_a_keyword_is_not_read_as_division():
    """`return /[(]/` is ordinary JavaScript. The heuristic only knew about
    punctuation, so the slash after a keyword read as division and the regex
    BODY was scanned as code -- its lone bracket reported as unbalanced in a
    file that is fine. That reaches the user as a high finding, and in
    `nexa run` it buys an escalation to the 30B over nothing at all."""
    for source in ("function f(){ return /[(]/.test(s); }",
                   "switch (c) { case 'a': return /]/.test(v); }",
                   "const ok = typeof v === 'string' && /[)]/.test(v);",
                   "function g(){ return /[{]/.test(x) ? 1 : 2; }"):
        assert semantics.balance_js(source) == [], source


def test_division_stays_division_and_a_real_imbalance_still_fires():
    """The other half of the same change. Widening the regex heuristic must not
    turn arithmetic into a literal, and must not stop the scanner catching the
    truncated answer it exists for."""
    assert semantics.balance_js("const r = total / count; f();") == []
    assert semantics.balance_js("const r = 10 / 2; f();") == []
    assert semantics.balance_js("function f(){ return 1;") != []
    assert semantics.balance_js("function f(){ return [1; }") != []


# ------------------------------- narrowings from the OCA classification (3.43)

WIZARD_STORED_COMPUTE = """class Wiz(models.TransientModel):
    _name = "my.wizard"

    total = fields.Float(compute="_c", store=True)

    @api.depends("line_ids")
    def _c(self):
        for rec in self:
            rec.total = sum(l.price for l in rec.line_ids)
"""

ONDELETE_SHAPE = """class Alert(models.{kind}):
    _name = "spp.alert"

    model_id = fields.Many2one("ir.model"{extra})

    def run(self):
        return self.model_id.model
"""

CHECK_COMPANY_SHAPE = """class Thing(models.Model):
    _name = "my.thing"

    company_id = fields.Many2one("res.company", required=True)
    journal_id = fields.Many2one("account.journal"{extra})
"""

MULTI_COMPANY = {"walked": True, "complete": True, "files": 1,
                 "models_declared": set(), "models_deleted": set(),
                 "multi_company": True}


def test_a_wizard_is_not_asked_for_a_complete_depends():
    """A TransientModel row is vacuumed. "Written once and never recomputed,
    survives restarts, diverges from reality" is about a row that outlives what
    it was computed from, and a wizard's does not. Five of the 24 false
    positives classified on OCA were this."""
    assert semantics.depends_covers_compute_reads(WIZARD_STORED_COMPUTE) == []


def test_the_same_compute_on_a_persistent_model_still_fires():
    """The narrowing has to cost nothing. Identical code on a models.Model is
    the defect the rule exists for."""
    persistent = WIZARD_STORED_COMPUTE.replace("models.TransientModel", "models.Model")
    assert semantics.depends_covers_compute_reads(persistent)


def test_ondelete_is_not_asked_of_a_wizard_or_a_field_with_no_column():
    """ondelete governs a foreign key. A TransientModel's row is vacuumed before
    a parent can be deleted under it, and a compute= without store=True has no
    column at all -- so in both the advice names something that is not there."""
    assert semantics.ondelete_leaves_a_dangling_read(
        ONDELETE_SHAPE.format(kind="TransientModel", extra="")) == []
    assert semantics.ondelete_leaves_a_dangling_read(
        ONDELETE_SHAPE.format(kind="Model", extra=', compute="_c"')) == []


def test_ondelete_still_fires_on_a_real_column():
    """Both halves of the same predicate: a persistent model, and a compute that
    IS stored, still have a foreign key to govern."""
    assert semantics.ondelete_leaves_a_dangling_read(
        ONDELETE_SHAPE.format(kind="Model", extra=""))
    assert semantics.ondelete_leaves_a_dangling_read(
        ONDELETE_SHAPE.format(kind="Model", extra=', compute="_c", store=True'))


def test_check_company_is_not_asked_of_a_mirror_or_a_field_with_no_column():
    """A related= field mirrors a value owned by another record, so the
    constraint belongs on the source -- which the same run flags in its own
    right, making this the same decision reported twice. A computed field with
    no store has no column to constrain."""
    assert semantics.check_company_missing_on_company_owned_relation(
        CHECK_COMPANY_SHAPE.format(extra=', related="parent_id.journal_id"'),
        MULTI_COMPANY) == []
    assert semantics.check_company_missing_on_company_owned_relation(
        CHECK_COMPANY_SHAPE.format(extra=', compute="_c"'), MULTI_COMPANY) == []


def test_check_company_still_fires_on_a_stored_relation():
    assert semantics.check_company_missing_on_company_owned_relation(
        CHECK_COMPANY_SHAPE.format(extra=""), MULTI_COMPANY)
    assert semantics.check_company_missing_on_company_owned_relation(
        CHECK_COMPANY_SHAPE.format(extra=', compute="_c", store=True'), MULTI_COMPANY)


MESSAGE_IN_A_VARIABLE = """@api.constrains("sequence_id")
def _check(self):
    for j in self:
        if j.sequence_id and not j.sequence_id.company_id:
            msg = _("no company on %(s)s for %(j)s", s=j.sequence_id.name, j=j.display_name)
            raise ValidationError(msg)
"""


def test_a_message_built_into_a_variable_is_still_only_a_message():
    """A field read to phrase an error does not decide whether the invariant
    holds, so it cannot decide when the constraint must re-run. That exemption
    existed and knew only the inline spelling -- OCA builds the message one line
    before the raise, and display_name was reported as a dependency."""
    assert semantics.constrains_lists_every_field_read(MESSAGE_IN_A_VARIABLE) == []


def test_a_field_read_in_the_condition_is_still_caught():
    """The exemption is about the nodes inside the message, not the field name.
    A constraint that TESTS an undeclared field is the defect either way."""
    hits = semantics.constrains_lists_every_field_read(
        MESSAGE_IN_A_VARIABLE.replace("not j.sequence_id.company_id",
                                      "not j.active"))
    assert any("active" in message for _, message in hits)


CALLERS_CURSOR = """def go(self):
    for rec in self:
        rec.write({"x": 1})
        self.env.cr.commit()
"""

OWN_CURSOR = """def batch_unlink(self):
    with Registry(self.env.cr.dbname).cursor() as new_cr:
        new_env = api.Environment(new_cr, self.env.uid, self.env.context)
        while self:
            batch = self[0:1000]
            self -= batch
            batch.with_env(new_env).unlink()
            new_env.cr.commit()
"""


def test_a_commit_on_a_cursor_this_function_opened_is_not_the_callers():
    """The rule says let the CALLER own the transaction, and a cursor opened
    three lines earlier is not the caller's. Both of this rule's real-world
    instances are the two sides of that line: OpenSPP's expiry cron commits
    self.env.cr and is a true positive its author marked and kept, OCA's
    batch_unlink commits one it opened itself."""
    assert semantics.commit_inside_a_loop(CALLERS_CURSOR)
    assert semantics.commit_inside_a_loop(OWN_CURSOR) == []


def test_the_independent_cursor_exemption_does_not_leak_between_functions():
    """Bound positively and scoped per function. A new_cr opened in one method
    must not excuse a commit in another that reuses the name -- which is what a
    file-wide scan of the names would have done."""
    hits = semantics.commit_inside_a_loop(CALLERS_CURSOR + OWN_CURSOR)
    assert len(hits) == 1, hits


# ------------------------------ a constraint the series will not create (3.45)

UNIQUENESS_BESIDE = """class Thing(models.Model):
    _name = "my.thing"

    {declaration}

    @api.constrains("code")
    def _check_unique_code(self):
        for rec in self:
            if self.search_count([("code", "=", rec.code), ("id", "!=", rec.id)]):
                raise ValidationError("Code must be unique")
"""

LEGACY = '_sql_constraints = [("code_uniq", "UNIQUE(code)", "Code must be unique.")]'
MODERN = '_code_uniq = models.Constraint("UNIQUE(code)", "Code must be unique.")'


def test_a_legacy_sql_constraint_is_not_a_constraint_on_odoo_19():
    """Odoo 19 ignores the _sql_constraints attribute: the registry logs a
    warning at load and the constraint is never created. Reading it as the
    column being spoken for exempts a class on the strength of nothing, and
    leaves the racing Python check as the only thing standing."""
    code = UNIQUENESS_BESIDE.format(declaration=LEGACY)
    assert semantics.prefer_sql_constraint_applies(code, {"odoo_series": "19.0"})


def test_the_same_declaration_still_counts_on_16():
    """It is a real constraint there, and firing on every 16, 17 and 18 module
    that did exactly the right thing is the worse trade."""
    code = UNIQUENESS_BESIDE.format(declaration=LEGACY)
    assert semantics.prefer_sql_constraint_applies(code, {"odoo_series": "16.0"}) == []
    assert semantics.prefer_sql_constraint_applies(code, {"odoo_series": None}) == []
    assert semantics.prefer_sql_constraint_applies(code) == []


def test_models_constraint_counts_on_every_series():
    """The spelling that works from 17 onwards is never the dead one."""
    code = UNIQUENESS_BESIDE.format(declaration=MODERN)
    for series in (None, "16.0", "17.0", "19.0"):
        assert semantics.prefer_sql_constraint_applies(
            code, {"odoo_series": series}) == [], series


def test_the_corpus_does_not_advise_a_declaration_odoo_19_ignores():
    """Two rules told an author to write _sql_constraints, which from 19 creates
    nothing. A corpus whose subject is 'a check that looks like it holds and
    does not' cannot be the thing recommending one."""
    advising = []
    for rule in corpus.load_rules():
        for line in rule["correct"].splitlines():
            # In a comment it is documentation of the older spelling, which is
            # the point. Uncommented, it is the advice.
            if "_sql_constraints" in line and not line.lstrip().startswith("#"):
                advising.append(rule["id"])
    assert advising == [], advising


def test_the_onchange_guard_knows_every_spelling_of_a_constraint():
    """The guard has to accept the legacy attribute: that IS a constraint on 16
    through 18. Narrowing it to models.Constraint alone was tried and reverted --
    the next field test reported OCA's account_loan, branch 18.0, with a real
    _sql_constraints block and an onchange properly backed by it.

    The 19 case is closed where the series is legible instead, in
    prefer_sql_constraint_applies.

    Asserted against the checker rather than against a satisfied_pattern,
    which is where the guard moved when the rule became an AST pass. The
    three spellings are the same three."""
    body = ('class M(models.Model):\n'
            '    @api.onchange("qty")\n'
            '    def _onchange_qty(self):\n'
            '        if self.qty <= 0:\n'
            '            raise ValidationError("no")\n')
    assert semantics.run_check("onchange_tries_to_enforce", body), \
        "an unbacked onchange that raises is the violation"

    for spelling in ('    @api.constrains("qty")\n    def _check(self):\n        pass\n',
                     '    _sql_constraints = [("q", "CHECK(qty > 0)", "no")]\n',
                     '    _qty = models.Constraint("CHECK(qty > 0)", "no")\n'):
        backed = body + spelling
        assert not semantics.run_check("onchange_tries_to_enforce", backed), spelling


def test_a_dead_sql_constraint_does_not_back_an_onchange_on_19():
    """From 19 the registry never creates a _sql_constraints block, so it
    backs nothing. On 18 and on an unknown series it still counts, as the
    test above requires."""
    body = ('class M(models.Model):\n'
            '    _sql_constraints = [("q", "CHECK(qty > 0)", "no")]\n'
            '\n'
            '    @api.onchange("qty")\n'
            '    def _onchange_qty(self):\n'
            '        if self.qty <= 0:\n'
            '            raise ValidationError("no")\n')
    on_19 = semantics.run_check("onchange_tries_to_enforce", body,
                                {"odoo_series": "19.0"})
    assert [line for line, _, _ in on_19] == [4], on_19
    for series in ("18.0", None):
        assert semantics.run_check("onchange_tries_to_enforce", body,
                                   {"odoo_series": series}) == [], series

    real = body.replace('    _sql_constraints = [("q", "CHECK(qty > 0)", "no")]\n',
                        '    _q = models.Constraint("CHECK(qty > 0)", "no")\n')
    assert semantics.run_check("onchange_tries_to_enforce", real,
                               {"odoo_series": "19.0"}) == []


CREDIT_ONCHANGE = ('class M(models.Model):\n'
                   '{constraint}'
                   '    @api.onchange("credit_limit")\n'
                   '    def _onchange_credit_limit(self):\n'
                   '        if self.credit_limit < 0:\n'
                   '            raise ValidationError("no")\n')


@pytest.mark.parametrize("constraint", [
    '    _ref = models.Constraint("UNIQUE(reference)", "no")\n',
    '    _sql_constraints = [("ref", "UNIQUE(reference)", "no")]\n',
    '    @api.constrains("reference")\n    def _check(self):\n        pass\n',
    '    @api.constrains("partner_id.credit_limit")\n    def _check(self):\n        pass\n',
])
def test_a_constraint_on_another_field_does_not_back_an_onchange(constraint):
    """A uniqueness rule on `reference` used to silence an onchange raising
    on `credit_limit`. A dotted @api.constrains name registers nothing."""
    code = CREDIT_ONCHANGE.format(constraint=constraint)
    assert semantics.run_check("onchange_tries_to_enforce", code), constraint


@pytest.mark.parametrize("constraint", [
    '    _c = models.Constraint("CHECK(credit_limit >= 0)", "no")\n',
    '    @api.constrains("credit_limit")\n    def _check(self):\n        pass\n',
    '    @api.constrains(*FIELDS)\n    def _check(self):\n        pass\n',
    '    _sql_constraints = BASE + [("c", "CHECK(credit_limit >= 0)", "no")]\n',
])
def test_a_constraint_on_a_watched_field_or_an_unreadable_one_backs_it(constraint):
    code = CREDIT_ONCHANGE.format(constraint=constraint)
    assert semantics.run_check("onchange_tries_to_enforce", code) == [], constraint


WARNING_ONCHANGE = ('class M(models.Model):\n'
                    '    @api.onchange("qty")\n'
                    '    def _onchange_qty(self):\n'
                    '        self.hint = False\n'
                    '        if self.qty < 0:\n'
                    '{branch}'
                    '            return {{"warning": {{"title": "x", "message": "y"}}}}\n')


@pytest.mark.parametrize("branch,refuses", [
    ("", False),                                        # a notice
    ("            self.qty = 0\n", True),               # the watched field back
    ("            self.update({'qty': 0})\n", True),
    ("            self.partner_id = False\n", True),    # a field cleared
    ("            self.location_id = self.other\n", False),   # a suggestion
])
def test_a_warning_refuses_only_when_its_branch_takes_the_value_back(branch, refuses):
    """Most warning dicts on core inform: "this reference already exists",
    "the rate is far from the previous one". The user saves past them in the
    form as in an import, so nothing is enforced anywhere. `self.hint = False`
    outside the branch does not count: it is a UI flag, not the refusal."""
    code = WARNING_ONCHANGE.format(branch=branch)
    found = semantics.run_check("onchange_tries_to_enforce", code)
    assert bool(found) is refuses, (branch, found)


UNPLAN = ('_("It is not possible to unplan one single Work Order. "\n'
          '                   "Unplan the manufacturing order instead.")')
WORKORDER = ('class W(models.Model):\n'
             '    _name = "w"\n'
             '    date_finished = fields.Datetime({field})\n'
             '\n'
             '    def {server}(self):\n'
             '        if not self.date_finished:\n'
             '            raise UserError({server_message})\n'
             '\n'
             '    @api.onchange("date_finished")\n'
             '    def _onchange_date_finished(self):\n'
             '        if not self.date_finished:\n'
             '            raise UserError(' + UNPLAN + ')\n')


@pytest.mark.parametrize("field,server,message,backed", [
    ('inverse="_set_dates"', "_set_dates", UNPLAN, True),      # mrp.workorder
    ('', "write", UNPLAN, True),
    ('', "action_unplan", UNPLAN, False),     # not run on every write
    ('inverse="_set_dates"', "_set_dates",
     '_("Unplanning one work order alone is not allowed at all.")', False),
])
def test_the_server_raising_the_same_message_backs_an_onchange(field, server,
                                                               message, backed):
    """The same sentence raised again where the server runs it on every
    write is the same check. A paraphrase is not, and neither is a method
    the client has to choose to call."""
    code = WORKORDER.format(field=field, server=server, server_message=message)
    found = semantics.run_check("onchange_tries_to_enforce", code)
    assert (found == []) is backed, found


APIKEY = ('class D(models.TransientModel):\n'
          '    _name = "d"\n'
          '\n'
          '    @api.onchange("expiration_date")\n'
          '    def _onchange_expiration_date(self):\n'
          '        self.env["k"]._check_expiration_date({onchange_arg})\n'
          '        if not self.expiration_date:\n'
          '            raise UserError("no")\n'
          '\n'
          '    def create(self, vals_list):\n'
          '        res = super().create(vals_list)\n'
          '        self.env["k"]._check_expiration_date(res.expiration_date)\n'
          '        return res\n')


def test_the_same_check_helper_on_the_watched_field_backs_an_onchange():
    """res.users.apikeys.description: the onchange and create() both call
    _check_expiration_date on the watched field. A check helper handed
    nothing the onchange watches, like a bare _check_company(), is not."""
    backed = APIKEY.format(onchange_arg="self.expiration_date")
    assert semantics.run_check("onchange_tries_to_enforce", backed) == []
    other = APIKEY.format(onchange_arg="self.company_id")
    assert semantics.run_check("onchange_tries_to_enforce", other)


# ------------------------------------------------ the value-origin trace
#
# Four rules were classified false for one reason: each read a variable's NAME
# and treated that as evidence about its value. Every case below is a finding
# somebody read by hand and recorded a verdict for, in
# artifacts/classification-{oca,openspp,python}-2026-09.json.

INT_ZERO_CASES = [
    ("search_count", """
def f(self):
    total_population = self.env["res.partner"].search_count([])
    if total_population == 0:
        return 0
"""),
    ("read_group _count, keyed by an f-string", """
def f(self, field_name, rows):
    for row in rows:
        group_total = row[f"{field_name}_count"]
        if group_total == 0:
            continue
"""),
    ("SELECT COUNT(*) through a cursor", """
def f(cr, table, where):
    cr.execute(f"SELECT COUNT(*) FROM {table} WHERE {where}")
    total = cr.fetchone()[0]
    if total == 0:
        return []
"""),
    ("a field the same file declares as fields.Integer", """
class L(models.Model):
    qty = fields.Integer(string="Quantity")

    def f(self):
        self.line_ids.filtered(lambda x: x.qty == 0).unlink()
"""),
]


@pytest.mark.parametrize("label,body", INT_ZERO_CASES,
                         ids=[c[0] for c in INT_ZERO_CASES])
def test_an_integer_compared_to_zero_is_not_a_float_comparison(label, body):
    """All five false positives on this rule compared an INTEGER to zero, where
    == is exact and the rule has nothing to say. Three of them and both true
    positives were spelled `total == 0`, so the name could never have separated
    them."""
    assert semantics.run_check("float_equality_against_zero", body) == [], label


def test_a_float_compared_to_zero_still_fires():
    """The guard suppresses; it must not suppress everything. `sum()` over
    amounts is the true positive that shares its spelling with three of the
    false ones."""
    body = """
def f(sorted_amounts):
    total = sum(sorted_amounts)
    if total == 0:
        return 0.0
"""
    assert semantics.run_check("float_equality_against_zero", body)


def test_a_locally_built_filename_is_not_a_traversal():
    """0 true, 4 false. All four join a configured directory to a name the
    module itself produced, and the pattern matched the word `filename`."""
    body = """
def f(self, data_path):
    for file_config in [{"filename": "a.csv"}]:
        file_path = os.path.join(data_path, file_config["filename"])
"""
    assert semantics.run_check("path_join_takes_an_external_name", body) == []


def test_a_component_from_outside_the_file_still_fires():
    body = "full = os.path.join(UPLOAD_DIR, request.args['name'])\n"
    assert semantics.run_check("path_join_takes_an_external_name", body)


def test_resolving_the_path_clears_the_join_in_that_function_only():
    """The fix is to resolve and compare, and it is written beside the join. A
    realpath in a DIFFERENT function says nothing about this one."""
    fixed = """
def f(base):
    full = os.path.realpath(os.path.join(base, request.args['name']))
    if os.path.commonpath([base, full]) != base:
        raise ValueError("escapes")
"""
    assert semantics.run_check("path_join_takes_an_external_name", fixed) == []
    elsewhere = fixed + """

def g(base):
    return open(os.path.join(base, request.args['other']), 'rb')
"""
    assert semantics.run_check("path_join_takes_an_external_name", elsewhere)


def test_the_orm_monetary_idiom_is_not_a_decimal_violation():
    """Odoo's Monetary field IS a float -- the ORM defines it that way -- so
    inside a module the rule fired on the idiom and named a remedy that cannot
    be taken. Both shapes below were classified false."""
    for body in ("""
class E(models.Model):
    def f(self):
        ctx = {"base_amount": float(self.amount or 0.0)}
""", """
def f(self):
    result = self.env["spp.cel.service"].evaluate_expression(self.e, {})
    amount = float(result)
"""):
        assert semantics.run_check("float_coercion_of_external_money", body) == [], body


def test_a_money_string_from_outside_still_fires():
    """Where the value arrives as a string, Decimal(value) IS available and the
    rule's remedy can be taken. This is the rule's own wrong sample."""
    body = "price = float(payload['price'])\n"
    assert semantics.run_check("float_coercion_of_external_money", body)


def test_an_onchange_does_not_answer_for_the_method_below_it():
    """All three false positives on this rule were the same failure: a short
    onchange that assigns a field, followed by an action method that raises,
    with the regex's 400-character window crossing between them.
    spp_studio/wizard/variable_remap_wizard.py is the shape, verbatim."""
    body = """
class W(models.TransientModel):
    @api.onchange("variable_id")
    def _onchange_variable_id(self):
        if self.variable_id and self.variable_id.source_model:
            self.target_model = self.variable_id.source_model

    def action_remap(self):
        self.ensure_one()
        if not self.new_field_id:
            raise UserError(_("Please select a field to map to."))
"""
    assert semantics.run_check("onchange_tries_to_enforce", body) == []


def test_the_onchange_finding_anchors_on_the_decorator():
    """Where the rule is, and where a marker about it gets written. A
    FunctionDef's own lineno is the `def`, one line further down."""
    body = ('class M(models.Model):\n'
            '    @api.onchange("qty")\n'
            '    def _onchange_qty(self):\n'
            '        raise ValidationError("no")\n')
    found = semantics.run_check("onchange_tries_to_enforce", body)
    assert [line for line, _, _ in found] == [2]


# ------------------------------------------------- sudo, all three clauses

@pytest.mark.parametrize("clause,body", [
    ("read", "def f(self):\n"
             "    return self.env['res.partner'].sudo().search([])\n"),
    ("create", "def f(self, vals):\n"
               "    return self.env['res.partner'].sudo().create(vals)\n"),
    ("write", "def f(self):\n"
              "    self.env['res.partner'].sudo().write({'name': 'x'})\n"),
    ("unlink", "def f(self):\n"
               "    self.env['res.partner'].sudo().unlink()\n"),
    ("handed to a call", "def f(self):\n"
                         "    p = self.env['res.partner'].sudo()\n"
                         "    return self._handle(p)\n"),
    ("returned", "def f(self):\n"
                 "    p = self.env['res.partner'].sudo()\n"
                 "    return p\n"),
])
def test_sudo_covers_the_three_clauses_its_rule_states(clause, body):
    """The rule says three things -- scope it narrowly, re-apply company
    filtering, never pass a sudo recordset onward -- and only the read was
    checked. `.sudo(` is the largest cluster in the recall harvest at 70
    missed against 6 caught, and on the OpenSPP tree the unchecked write
    clause has 136 call sites against the read clause's 116."""
    assert semantics.run_check("sudo_drops_record_rules", body), clause


@pytest.mark.parametrize("why,body", [
    ("the call re-applies company scoping by hand",
     "def f(self):\n"
     "    return self.env['res.partner'].sudo().search("
     "[('company_id', 'in', self.env.company.ids)])\n"),
    ("the recordset never leaves the function",
     "def f(self):\n"
     "    p = self.env['res.partner'].sudo()\n"
     "    return p.mapped('name')\n"),
])
def test_sudo_stays_quiet_where_the_rule_is_already_followed(why, body):
    assert semantics.run_check("sudo_drops_record_rules", body) == [], why


# ------------------------------------------------------------- docstrings

def test_a_docstring_is_prose_and_is_not_matched_as_code():
    """Two of the 50 findings the Python composition added were this: `eval()`
    named in a docstring in a sentence arguing against using it, and a
    `datetime.now()` inside a doctest example."""
    src = ('def f():\n'
           '    """Never use eval() here.\n'
           '\n'
           '    >>> datetime.now()\n'
           '    """\n'
           '    return 1\n')
    view = semantics.strip_comments(src)
    assert "eval(" not in view
    assert "datetime.now()" not in view


def test_a_real_string_literal_survives_and_the_geometry_does_too():
    """Only docstrings. A triple-quoted SQL query is data the checkers have a
    legitimate interest in, and a line or column that moved would misreport
    every finding below it."""
    src = 'Q = """SELECT COUNT(*) FROM t"""\n\ndef f():\n    """doc"""\n    return Q\n'
    view = semantics.strip_comments(src)
    assert "SELECT COUNT(*)" in view
    assert "doc" not in view
    assert len(view) == len(src)
    assert view.count("\n") == src.count("\n")


def test_rebinding_self_to_sudo_elevates_the_rest_of_the_method():
    """The shape behind the one miss the README names by hand.

    OCA server-tools cbefaa511485, "[FIX] excel_import_export: remove sudo()
    when importing record", deletes a single line -- `self = self.sudo()` --
    and says what it cost: "finding multiple records across all companies
    during import when they have same record name. Previously, importing with
    sudo could bypass multi-company record rules."

    Nothing below that line names sudo, so every clause that looks for
    `.sudo().<method>()` is blind to it, and the recordset is never passed
    anywhere either. It replaces the thing the whole method is written
    against, which is the escape clause at its widest.

    Run against that commit's own before and after images, the finding sits on
    line 283, is gone afterwards, and 283 is one of the two lines the fix
    changed -- an on-target catch by recall's own definition.
    """
    before = ("class X(models.AbstractModel):\n"
              "    def import_xlsx(self, res_id, template):\n"
              "        self = self.sudo()\n"
              "        record = self.env[template.res_model].browse(res_id)\n"
              "        return record\n")
    after = before.replace("        self = self.sudo()\n", "")
    found = semantics.run_check("sudo_drops_record_rules", before)
    assert [line for line, _, _ in found] == [3]
    assert not semantics.run_check("sudo_drops_record_rules", after)


def test_a_rebind_keeps_the_rules_own_grade():
    """The touch and escape clauses report `unproven` because nothing measured
    has met a real one. This clause has: a fix commit that deletes the line and
    explains the multi-company leak it caused. So it carries no grade of its
    own and keeps the rule's `defect`."""
    body = ("def f(self):\n"
            "    self = self.sudo()\n"
            "    return self.env['res.partner'].search([])\n")
    grades = {grade for _, _, grade in
              semantics.run_check("sudo_drops_record_rules", body)}
    assert None in grades, "a rebind must not be downgraded to unproven"


def test_a_sudo_recordset_bound_to_a_fresh_name_is_not_a_rebind():
    """`p = self.env['x'].sudo()` binds a new name and elevates nothing that
    was not already written against it. Only rebinding a name to its OWN sudo
    form silently elevates the code below."""
    body = ("def f(self):\n"
            "    p = self.env['res.partner'].sudo()\n"
            "    return p.mapped('name')\n")
    assert semantics.run_check("sudo_drops_record_rules", body) == []


def test_sudo_false_is_de_escalation_and_is_never_a_finding():
    """`sudo(False)` turns record rules back ON.

    It is how a method that must run under the caller's own rights says so.
    Odoo core does it 60 times, including mail's `_check_attachments_access`,
    whose docstring reads "This method relies on access rules/rights and
    therefore it should not be called from a sudo env." Reading it as an
    escalation reports the safeguard as the defect.

    Neither OpenSPP nor the OCA trees contain a single `sudo(False)`, so this
    was invisible until the corpus was pointed at odoo core.
    """
    for body in ("class A(models.Model):\n"
                 "    def f(self, toks):\n"
                 "        self = self.sudo(False)\n"
                 "        return self.env['x'].search([])\n",
                 "def f(self):\n"
                 "    return self.env['res.partner'].sudo(False).search([])\n",
                 "def f(self, vals):\n"
                 "    return self.env['res.partner'].sudo(False).create(vals)\n"):
        assert semantics.run_check("sudo_drops_record_rules", body) == [], body


def test_a_computed_sudo_flag_still_counts_as_escalation():
    """`sudo(flag)` can be either, and an unreadable argument must leave the
    finding standing rather than suppress it -- the same direction every other
    trigger on this rule errs in."""
    body = ("def f(self, flag):\n"
            "    self = self.sudo(flag)\n"
            "    return self.env['x'].search([])\n")
    assert semantics.run_check("sudo_drops_record_rules", body)


def test_an_unstored_framework_field_is_not_a_stored_compute():
    """odoo/models.py adds display_name to every model as
    `fields.Char(automatic=True, compute='_compute_display_name', search=...)`
    with no store. An override that omits a dependency therefore cannot leave
    a stale row, because there is no row.

    The checker read "no declaration in this file" as unknown storedness and
    kept the finding, which is right for an ordinary field declared in another
    module and wrong here: the framework's declaration is knowable and says
    not stored. 121 of the 1,051 findings this rule made on odoo core were
    this shape.
    """
    body = ("class M(models.Model):\n"
            "    _inherit = 'res.partner'\n"
            "\n"
            "    @api.depends('phone')\n"
            "    def _compute_display_name(self):\n"
            "        for rec in self:\n"
            "            rec.display_name = rec.name + rec.phone\n")
    assert semantics.run_check("depends_covers_compute_reads", body) == []


def test_a_model_that_stores_display_name_itself_is_still_checked():
    """The narrowing is about the framework's default, not about the name. A
    model that declares `display_name = fields.Char(..., store=True)` in its
    own file has opted into a stored row, and all 10 hand-verified true
    positives that compute display_name -- every one of them in OpenSPP -- do
    exactly that. Losing those is what this test exists to prevent.
    """
    body = ("class M(models.Model):\n"
            "    _name = 'a.b'\n"
            "\n"
            "    display_name = fields.Char(compute='_compute_display_name', store=True)\n"
            "\n"
            "    @api.depends('phone')\n"
            "    def _compute_display_name(self):\n"
            "        for rec in self:\n"
            "            rec.display_name = rec.name + rec.phone\n")
    found = semantics.run_check("depends_covers_compute_reads", body)
    assert any("'name'" in message for _, message, _ in found), found


def test_a_sql_view_model_has_no_foreign_key_to_decide_about():
    """`_auto = False` means odoo builds no table for the model, so there is
    no foreign key, and `ondelete` is not a decision anybody can make about
    it. Two of the 15 sampled ondelete findings on odoo core were report
    models of exactly this kind: hr.contract.history and
    purchase.bill.line.match.

    None of the 26 hand-verified true positives for this rule sits on an
    _auto = False model, which is what makes the exemption free.
    """
    view = ("class R(models.Model):\n"
            "    _name = 'a.report'\n"
            "    _auto = False\n"
            "\n"
            "    employee_id = fields.Many2one('hr.employee', readonly=True)\n"
            "\n"
            "    def f(self):\n"
            "        return self.employee_id.name\n")
    assert semantics.run_check("ondelete_leaves_a_dangling_read", view) == []

    table = view.replace("    _auto = False\n", "")
    assert semantics.run_check("ondelete_leaves_a_dangling_read", table), \
        "a real table with the same declaration is still the rule's subject"


def test_sudo_de_escalation_is_recognised_by_keyword_too():
    """odoo's signature is `sudo(self, flag=True)`, so `sudo(flag=False)` is
    the same de-escalation as `sudo(False)`. Reading only positional
    arguments missed it, and core writes it that way twice."""
    body = "def f(self):\n    return self.env['res.partner'].sudo(flag=False).search([])\n"
    assert semantics.run_check("sudo_drops_record_rules", body) == []


def test_restoring_the_ambient_level_is_not_an_escalation():
    """`x.sudo(self.env.su)` sets su to whatever the environment already has,
    so it cannot raise privilege above ambient. It is how a method hands a
    record back at the caller's own level, and odoo core writes it beside the
    comment "Unsudo the invoice after creation if not already sudoed".

    `sudo(self.env.su or field.compute_sudo)` is not the same thing: the `or`
    can turn it on, so only the bare attribute reads as ambient.
    """
    ambient = "def f(self, invoice):\n    invoice = invoice.sudo(self.env.su)\n    return invoice\n"
    assert semantics.run_check("sudo_drops_record_rules", ambient) == []

    may_raise = ("def f(self, rec):\n"
                 "    rec = rec.sudo(self.env.su or self.compute_sudo)\n"
                 "    return rec\n")
    assert semantics.run_check("sudo_drops_record_rules", may_raise)


# ------------------------------------------------------ parent_can_form_a_cycle

def _hierarchy(header, field='parent_id = fields.Many2one("my.category", "Parent")'):
    return ("from odoo import fields, models\n\n\n"
            "class Category(models.Model):\n"
            '    _name = "my.category"\n' + header +
            "    " + field + "\n")


def test_a_self_referencing_parent_with_no_guard_is_caught():
    """The rule's subject: spp.dms.directory, which declares a parent_path
    Char but never turns _parent_store on, so nothing refuses a loop."""
    found = semantics.run_check("parent_can_form_a_cycle", _hierarchy(""))
    assert [line for line, _, _ in found] == [6]
    assert "my.category" in found[0][1]


def test_parent_store_already_refuses_the_cycle():
    """odoo's _parent_store_update raises "Recursion Detected." on a write that
    would close a loop. Six of seven verdicts once classified true were this."""
    body = _hierarchy("    _parent_store = True\n")
    assert semantics.run_check("parent_can_form_a_cycle", body) == []


def test_parent_store_on_another_chain_leaves_parent_id_bare():
    body = _hierarchy('    _parent_store = True\n    _parent_name = "location_id"\n')
    assert semantics.run_check("parent_can_form_a_cycle", body)


def test_a_parent_on_another_model_cannot_close_a_loop():
    """OCA's account.cash.deposit.line.parent_id points at account.cash.deposit:
    an ordinary foreign key, classified false as wrong-construct."""
    body = _hierarchy("", 'parent_id = fields.Many2one("my.batch", ondelete="cascade")')
    assert semantics.run_check("parent_can_form_a_cycle", body) == []


def test_self_reference_is_read_through_name_and_a_module_constant():
    """spp.area writes Many2one(_name, ...); spp.area.type assigns both _name
    and the comodel from one module constant."""
    by_name = _hierarchy("", 'parent_id = fields.Many2one(_name, "Parent")')
    assert semantics.run_check("parent_can_form_a_cycle", by_name)

    shared = ('from odoo import fields, models\n\n_type_model = "my.type"\n\n\n'
              "class AreaType(models.Model):\n"
              "    _name = _type_model\n"
              '    parent_id = fields.Many2one(_type_model, "Parent")\n')
    assert semantics.run_check("parent_can_form_a_cycle", shared)
    elsewhere = shared.replace('fields.Many2one(_type_model', 'fields.Many2one("my.zone"')
    assert semantics.run_check("parent_can_form_a_cycle", elsewhere) == []


def test_either_guard_clears_the_hierarchy_rule():
    for guard in ("_has_cycle", "_check_recursion"):
        body = _hierarchy("") + (
            "\n    @api.constrains('parent_id')\n"
            "    def _check_parent(self):\n"
            "        if self.{0}():\n"
            "            raise ValidationError('loop')\n").format(guard)
        assert semantics.run_check("parent_can_form_a_cycle", body) == [], guard


def test_a_chained_name_assignment_is_still_the_models_name():
    """odoo's test models write `_name = _description = 'x'`. Read as nameless,
    a parent_id to a different model fired as if it could loop."""
    body = ("from odoo import fields, models\n\n\n"
            "class Child(models.Model):\n"
            "    _name = _description = 'my.child'\n"
            "    parent_id = fields.Many2one('my.parent')\n")
    assert semantics.run_check("parent_can_form_a_cycle", body) == []


def test_a_view_and_a_redeclaration_are_not_the_hierarchy_rules_subject():
    view = _hierarchy("    _auto = False\n")
    assert semantics.run_check("parent_can_form_a_cycle", view) == []
    override = _hierarchy("", "parent_id = fields.Many2one(tracking=3)")
    assert semantics.run_check("parent_can_form_a_cycle", override) == []


# ------------------------------------------------ editable_record_without_noupdate

PARAMS = """<?xml version="1.0" encoding="utf-8" ?>
<odoo>
    <record id="view_thing_form" model="ir.ui.view">
        <field name="name">thing.form</field>
    </record>
    <record id="retention_days" model="ir.config_parameter">
        <field name="key">my.retention_days</field>
        <field name="value">90</field>
    </record>
    <data noupdate="1">
        <record id="seq_thing" model="ir.sequence">
            <field name="name">Thing</field>
        </record>
    </data>
</odoo>
"""


def test_an_editable_record_outside_noupdate_is_reported_on_its_own_line():
    """The regex this replaced fired once, on <odoo>, for any record at all --
    and one noupdate block anywhere cleared the whole file."""
    found = semantics.run_check("editable_record_without_noupdate", PARAMS)
    assert [line for line, _, _ in found] == [6]
    assert "retention_days" in found[0][1] and "migration" in found[0][1]


def test_a_view_is_not_the_noupdate_rules_subject():
    """Views, menus and actions have to upgrade: core keeps 0-2% of them under
    noupdate, so reporting them would be advice nobody should take."""
    body = PARAMS.replace('model="ir.config_parameter"', 'model="ir.actions.act_window"')
    assert semantics.run_check("editable_record_without_noupdate", body) == []


def test_noupdate_is_inherited_and_can_be_switched_back_off():
    root = PARAMS.replace("<odoo>", '<odoo noupdate="1">')
    assert semantics.run_check("editable_record_without_noupdate", root) == []
    inner = root.replace('<data noupdate="1">', '<data noupdate="0">')
    assert [l for l, _, _ in semantics.run_check(
        "editable_record_without_noupdate", inner)] == [11]


def test_stages_and_precisions_are_editable_data_too():
    for model in ("crm.stage", "decimal.precision", "ir.sequence"):
        body = PARAMS.replace('model="ir.config_parameter"', 'model="{0}"'.format(model))
        assert semantics.run_check("editable_record_without_noupdate", body), model


def test_a_cron_counts_only_when_it_ships_disabled():
    """57 of 62 cron findings read false: a schedule is usually the mechanism.
    The shape that held up ships active=False for an operator to switch on,
    which is the decision an upgrade then undoes."""
    running = PARAMS.replace('model="ir.config_parameter"', 'model="ir.cron"')
    assert semantics.run_check("editable_record_without_noupdate", running) == []
    for spelling in ('<field name="active" eval="False"/>',
                     '<field name="active">0</field>'):
        disabled = running.replace('<field name="value">90</field>', spelling)
        assert semantics.run_check("editable_record_without_noupdate", disabled), spelling


def test_xml_inside_an_answer_is_still_read():
    """A generated answer carries its XML among prose and Python; the whole text
    does not parse, the document inside it does."""
    answer = "Add this data file:\n\n" + PARAMS.split("\n", 1)[1] + "\nand then def f(): pass\n"
    found = semantics.run_check("editable_record_without_noupdate", answer)
    # Line 7 of the answer: two lines of prose, and the declaration dropped.
    assert [line for line, _, _ in found] == [7]


def test_check_company_is_not_asked_of_a_sql_view():
    """A SQL view has no table and so no foreign key to guard; OpenSPP's
    fund_report was this rule's last live false positive."""
    body = ("from odoo import fields, models\n\n\n"
            "class FundReport(models.Model):\n"
            "    _name = 'my.fund.report'\n"
            "    _auto = False\n"
            "    company_id = fields.Many2one('res.company')\n"
            "    journal_id = fields.Many2one('account.journal')\n")
    assert semantics.run_check("check_company_missing_on_company_owned_relation", body) == []
    table = body.replace("    _auto = False\n", "")
    assert semantics.run_check("check_company_missing_on_company_owned_relation", table)


def test_a_field_read_only_to_log_is_not_a_dependency():
    """Five of OpenSPP's live false positives read rec.name only to phrase a
    log line. A value read to phrase something decides nothing."""
    body = ("from odoo import api, models\n\n\n"
            "class Thing(models.Model):\n"
            "    _name = 'my.thing'\n\n"
            "    @api.constrains('source_type')\n"
            "    def _check_source(self):\n"
            "        for rec in self:\n"
            "            if rec.source_type == 'external':\n"
            "                _logger.warning('thing %s has no provider', rec.name)\n")
    assert semantics.run_check("constrains_lists_every_field_read", body) == []
    decides = body.replace("if rec.source_type == 'external':",
                           "if rec.source_type == 'external' and rec.name:")
    found = semantics.run_check("constrains_lists_every_field_read", decides)
    assert found and "'name'" in found[0][1], "a read in the condition still counts"


def test_a_message_collected_before_it_is_raised_is_still_a_message():
    """odoo core's event seats check appends each line to a list and raises
    the joined list; event.name only ever phrases it."""
    body = ("from odoo import api, models\n\n\n"
            "class Event(models.Model):\n"
            "    _name = 'my.event'\n\n"
            "    @api.constrains('seats_max')\n"
            "    def _check_seats(self):\n"
            "        sold_out = []\n"
            "        for event in self:\n"
            "            if event.seats_max < 0:\n"
            "                sold_out.append(_('%(n)s', n=event.name))\n"
            "        if sold_out:\n"
            "            raise ValidationError('\n'.join(sold_out))\n")
    assert semantics.run_check("constrains_lists_every_field_read", body) == []


def test_an_override_that_calls_super_adds_triggers_for_the_chain():
    """Odoo merges @api.depends across overrides, so an override that calls
    super() is adding triggers for fields the parent's body reads. Three of
    core's sampled depends-unread findings were this, the partner avatars
    among them."""
    body = ("from odoo import api, models\n\n\n"
            "class Partner(models.Model):\n"
            "    _inherit = 'res.partner'\n\n"
            "    @api.depends('name', 'image_128', 'is_company')\n"
            "    def _compute_avatar_128(self):\n"
            "        super()._compute_avatar_128()\n")
    assert semantics.run_check("depends_names_unread_fields", body) == []


def test_a_body_that_only_assigns_a_constant_stays_a_finding():
    """Tried as an exemption and withdrawn: on core such bodies were stubs or
    deliberate resets, on OpenSPP and OCA three were leftovers classified true
    by hand. The file cannot tell which."""
    body = ("from odoo import api, fields, models\n\n\n"
            "class Field(models.Model):\n"
            "    _name = 'my.field'\n\n"
            "    @api.depends('target_type')\n"
            "    def _compute_target_model(self):\n"
            "        for record in self:\n"
            "            record.target_model = 'res.partner'\n")
    assert semantics.run_check("depends_names_unread_fields", body)


_API = "from datetime import datetime\nfrom fastapi import APIRouter\n\n\n"


@pytest.mark.parametrize("why, body", [
    ("a pydantic response built with a naive timestamp: OpenSPP's consent revoke",
     _API + "def revoke(cid):\n"
            "    return ConsentRevokeResponse(consent_id=cid, revoked_at=datetime.utcnow())\n"),
    ("a returned dict carrying the ISO string: the commit recall credits",
     _API + "async def notify():\n"
            "    return {'status': 'rjct', 'timestamp': datetime.utcnow().isoformat()}\n"),
    ("an ISO string into a signed document, no HTTP anywhere: l10n_es_edi_tbai",
     "from datetime import datetime\n\n\n"
     "def sign(self):\n"
     "    return {'dsig': {'iso_now': datetime.now().isoformat()}}\n"),
    ("the value reached through a name",
     _API + "def status():\n"
            "    now = datetime.now()\n"
            "    return StatusResponse(checked_at=now)\n"),
    ("the server's datetime into a vals key named date: purchase_unreconciled",
     "from datetime import datetime\n\n\n"
     "def writeoff(self, vals):\n"
     "    move_date = vals.get('date', datetime.now())\n"
     "    return self.env['account.move'].create({'date': move_date})\n"),
    ("the server's date into a domain on a date field",
     "from datetime import datetime\n\n\n"
     "def due(self):\n"
     "    return self.search([('date_due', '<', datetime.now().date())])\n"),
    ("a Date field defaulting to the server's date",
     "from datetime import datetime\nfrom odoo import fields, models\n\n\n"
     "class Visit(models.Model):\n"
     "    _name = 'my.visit'\n"
     "    visit_date = fields.Date(default=lambda self: datetime.now().date())\n"),
])
def test_datetime_reports_the_two_shapes_that_survived(why, body):
    assert semantics.run_check("naive_time_leaves_or_dates_a_day", body), why


@pytest.mark.parametrize("why, body", [
    ("a comparison inside the ORM: naive UTC against naive UTC",
     "from datetime import datetime, timedelta\n\n\n"
     "def vacuum(self, days):\n"
     "    deadline = datetime.now() - timedelta(days=days)\n"
     "    return self.search([('create_date', '<', deadline)])\n"),
    ("a filename: display only",
     "from datetime import datetime\n\n\n"
     "def backup(self):\n"
     "    return self.filename(datetime.now(), ext='zip')\n"),
    ("a JWT payload: PyJWT reads a naive exp as UTC",
     _API + "def token(client):\n"
            "    now = datetime.utcnow()\n"
            "    payload = {'iat': now, 'sub': client}\n"
            "    return jwt.encode(payload, 'k')\n"),
    ("the offset written by hand after the ISO string",
     _API + "def stamp():\n"
            "    return {'at': f\"{datetime.now().isoformat()}Z\"}\n"),
    ("a returned dict in a model file, not at an HTTP edge",
     "from datetime import datetime\n\n\n"
     "def aggregate(self):\n"
     "    return {'computed_at': datetime.now()}\n"),
    ("a naive time into a key that may be a Datetime field",
     "from datetime import datetime\n\n\n"
     "def schedule(self):\n"
     "    return self.create({'scheduled_date': datetime.now()})\n"),
    ("the fix at the edge",
     "from datetime import datetime, timezone\nfrom fastapi import APIRouter\n\n\n"
     "def revoke(cid):\n"
     "    return ConsentRevokeResponse(revoked_at=datetime.now(timezone.utc))\n"),
])
def test_datetime_leaves_the_shapes_that_did_not(why, body):
    assert semantics.run_check("naive_time_leaves_or_dates_a_day", body) == [], why


_LEGACY = ("from odoo import models\n\n\n"
           "class ReasonDocument(models.Model):\n"
           "    _name = 'spp.cr.type.reason.document'\n\n"
           "    _sql_constraints = [\n"
           "        ('reason_uniq', 'UNIQUE(cr_type_id, reason)', 'One rule per reason.'),\n"
           "    ]\n")


def test_sql_constraints_on_19_are_a_constraint_that_does_not_exist():
    """OpenSPP's 208d9758: the block sat on a 19.0 module and created nothing."""
    found = semantics.run_check("legacy_sql_constraints_on_19", _LEGACY,
                                facts={"walked": True, "odoo_series": "19.0"})
    assert [(line, grade) for line, _, grade in found] == [(7, None)]


def test_sql_constraints_before_19_are_the_only_spelling():
    """18.0 core declares the attribute in 174 files and has no
    models.Constraint, so a finding there is advice that cannot be taken."""
    for series in ("16.0", "17.0", "18.0"):
        assert semantics.run_check("legacy_sql_constraints_on_19", _LEGACY,
                                   facts={"walked": True, "odoo_series": series}) == []


def test_sql_constraints_series_unknown_after_a_walk_is_silent():
    """odoo core's own manifests pin no series; 174 findings there would all
    be wrong."""
    assert semantics.run_check("legacy_sql_constraints_on_19", _LEGACY,
                               facts={"walked": True, "odoo_series": None}) == []


def test_sql_constraints_with_nothing_walked_is_advisory():
    """Nobody looked is not the same answer as looked and it does not say."""
    found = semantics.run_check("legacy_sql_constraints_on_19", _LEGACY)
    assert [grade for _, _, grade in found] == [semantics.UNPROVEN]


def test_an_empty_sql_constraints_list_declares_nothing():
    body = ("from odoo import models\n\n\n"
            "class Thing(models.Model):\n"
            "    _name = 'my.thing'\n"
            "    _sql_constraints = []\n")
    assert semantics.run_check("legacy_sql_constraints_on_19", body,
                               facts={"walked": True, "odoo_series": "19.0"}) == []


def _sudo_in_method(body_line, params="self"):
    return ("from odoo import models\n\n\n"
            "class Employee(models.Model):\n"
            "    _inherit = 'hr.employee'\n\n"
            "    def f(" + params + "):\n"
            "        " + body_line + "\n")


@pytest.mark.parametrize("why, line", [
    ("contracts of the employees the caller holds",
     "return self.env['hr.contract'].sudo().search([('employee_id', 'in', self.ids)])"),
    ("the moves of one journal, reached from self",
     "return self.env['account.move'].sudo().search([('journal_id', '=', self.journal_id.id)])"),
    ("the user's own partner",
     "return self.env['loyalty.card'].sudo().search([('partner_id', '=', self.env.user.partner_id.id)])"),
    ("a subset of self, filtered",
     "return self.env['hr.leave'].sudo().search([('employee_id', 'in', self.filtered('active').ids)])"),
])
def test_sudo_tied_to_held_records_is_re_scoped(why, line):
    assert semantics.run_check("sudo_drops_record_rules", _sudo_in_method(line)) == [], why


@pytest.mark.parametrize("why, line, params", [
    ("ids the caller passed in are not records it was shown",
     "return self.env['hr.contract'].sudo().search([('employee_id', 'in', employee_ids)])",
     "self, employee_ids"),
    ("browse applies no rule, so it holds whatever it was handed",
     "return self.env['hr.contract'].sudo().search([('employee_id', 'in', self.env['hr.employee'].browse(ids).ids)])",
     "self, ids"),
    ("a helper on self may sudo inside; its result is not held",
     "return self.env['hr.contract'].sudo().search([('employee_id', 'in', self._others().ids)])",
     "self"),
    ("an ordering against a held value selects everything else: set_sequence_up",
     "return self.sudo().search([('website_sequence', '<', self.website_sequence)])",
     "self"),
    ("not in a held set is the opposite of scoping",
     "return self.env['hr.contract'].sudo().search([('employee_id', 'not in', self.ids)])",
     "self"),
])
def test_sudo_not_tied_to_held_records_stays_a_finding(why, line, params):
    assert semantics.run_check("sudo_drops_record_rules", _sudo_in_method(line, params)), why


def _sudo_on_a_page(body, auth="public", website="True"):
    return ("from odoo import http\n"
            "from odoo.http import request\n\n\n"
            "class Customers(http.Controller):\n\n"
            "    @http.route(['/customers'], type='http', auth=" + repr(auth)
            + ", website=" + website + ")\n"
            "    def customers(self, search=None, **post):\n"
            + "".join("        " + line + "\n" for line in body))


@pytest.mark.parametrize("why, body", [
    ("the /customers listing: published partners only",
     ["return request.env['res.partner'].sudo().search([('website_published', '=', True)])"]),
    ("built in a name, a search term ORed below the published leaf: website_customer",
     ["domain = [('website_published', '=', True), ('assigned_partner_id', '!=', False)]",
      "if search:",
      "    domain += ['|', ('name', 'ilike', search), ('website_description', 'ilike', search)]",
      "return request.env['res.partner'].sudo().read_group(domain, ['id'], groupby='country_id')"]),
    ("copied with list() and added to: website_crm_partner_assign",
     ["base = [('is_company', '=', True), ('website_published', '=', True)]",
      "country_domain = list(base)",
      "return request.env['res.partner'].sudo().search_count(country_domain + [('country_id', '!=', False)])"]),
])
def test_sudo_published_on_a_public_page_is_re_scoped(why, body):
    assert semantics.run_check("sudo_drops_record_rules", _sudo_on_a_page(body)) == [], why


@pytest.mark.parametrize("why, body, auth, website", [
    ("the published leaf ORed with something else admits unpublished records",
     ["return request.env['res.partner'].sudo().search(['|', ('website_published', '=', True), ('customer_rank', '>', 0)])"],
     "public", "True"),
    ("an operator glued in front makes the leaf one side of an OR",
     ["domain = [('website_published', '=', True)]",
      "return request.env['res.partner'].sudo().search(['|', ('email', '!=', False)] + domain)"],
     "public", "True"),
    ("insert can put an operator in front of the leaf",
     ["domain = [('website_published', '=', True), ('email', '!=', False)]",
      "domain.insert(0, '|')",
      "return request.env['res.partner'].sudo().search(domain)"],
     "public", "True"),
    ("reassigned without the leaf on one path",
     ["domain = [('website_published', '=', True)]",
      "if search:",
      "    domain = [('name', 'ilike', search)]",
      "return request.env['res.partner'].sudo().search(domain)"],
     "public", "True"),
    ("is_published applies no website, and is not the leaf this reads",
     ["return request.env['res.partner'].sudo().search([('is_published', '=', True)])"],
     "public", "True"),
    ("compared to a value rather than True: set_sequence_up's spelling",
     ["return request.env['res.partner'].sudo().search([('website_published', '=', post.get('p'))])"],
     "public", "True"),
    ("a route that is not a website page has no current website",
     ["return request.env['res.partner'].sudo().search([('website_published', '=', True)])"],
     "public", "False"),
    ("a user route is not a public page",
     ["return request.env['res.partner'].sudo().search([('website_published', '=', True)])"],
     "user", "True"),
    ("a write is not a read of what a page shows",
     ["return request.env['res.partner'].sudo().search([('website_published', '=', True)]).sudo().write({'x': 1})"],
     "public", "True"),
])
def test_sudo_published_not_on_a_public_page_stays_a_finding(why, body, auth, website):
    found = semantics.run_check("sudo_drops_record_rules",
                                _sudo_on_a_page(body, auth, website))
    assert found, why


# --------------------------------- a constraint reading a field it cannot name

def _seats(declaration, depends, constrains, compute_name="_compute_seats"):
    return ("from odoo import api, fields, models\n\n\n"
            "class Event(models.Model):\n"
            "    _name = 'my.event'\n\n"
            "    seats_max = fields.Integer()\n"
            "    seats_taken = fields.Integer()\n"
            "    seats_available = fields.Integer({0})\n\n"
            "    @api.depends({1})\n"
            "    def {3}(self):\n"
            "        for event in self:\n"
            "            event.seats_available = event.seats_max - event.seats_taken\n\n"
            "    @api.constrains({2})\n"
            "    def _check_seats(self):\n"
            "        for event in self:\n"
            "            if event.seats_available < 0:\n"
            "                raise ValidationError('sold out')\n").format(
                declaration, depends, constrains, compute_name)


def test_a_constraint_naming_every_input_of_an_unstored_field_is_covered():
    """Odoo never runs a constraint for a field that is neither stored nor
    inversible, and logs "@constrains parameter ... is not writeable" when one
    is named. A check reading seats_available that names what it is computed
    from runs whenever the value can change, so asking for seats_available was
    asking for a name that does nothing. core's event seats are two of the
    eight findings that had this shape (ARCHITECTURE 3.82)."""
    body = _seats("compute='_compute_seats'", "'seats_max', 'seats_taken'",
                  "'seats_max', 'seats_taken'")
    assert semantics.run_check("constrains_lists_every_field_read", body) == []


def test_a_constraint_missing_an_input_is_told_which_one():
    body = _seats("compute='_compute_seats'", "'seats_max', 'seats_taken'",
                  "'seats_max'")
    found = semantics.run_check("constrains_lists_every_field_read", body)
    assert len(found) == 1
    message = found[0][1]
    assert "not stored" in message and "writing 'seats_taken' alone" in message
    assert "writing 'seats_available'" not in message, "advice that cannot be taken"


@pytest.mark.parametrize("declaration", [
    "compute='_compute_seats', store=True",
    "compute='_compute_seats', inverse='_inverse_seats'",
])
def test_a_stored_or_inversible_field_is_still_asked_for(declaration):
    """Stored, a recompute validates it; inversible, a write of it runs the
    check. Naming it works either way, so the finding asks for it as before."""
    body = _seats(declaration, "'seats_max', 'seats_taken'",
                  "'seats_max', 'seats_taken'")
    found = semantics.run_check("constrains_lists_every_field_read", body)
    assert len(found) == 1 and "writing 'seats_available' alone" in found[0][1]


@pytest.mark.parametrize("extra, quiet", [
    ("", True),
    (", readonly=True", True),
    (", readonly=False", False),
])
def test_a_related_field_is_reached_through_its_first_field(extra, quiet):
    """A related field is readonly unless it says otherwise, and only then
    gets an inverse. Readonly, the relation it starts from is what a write
    can touch."""
    body = ("from odoo import api, fields, models\n\n\n"
            "class Line(models.Model):\n"
            "    _name = 'my.line'\n\n"
            "    partner_id = fields.Many2one('res.partner')\n"
            "    country_code = fields.Char(related='partner_id.country_id.code'"
            + extra + ")\n\n"
            "    @api.constrains('partner_id')\n"
            "    def _check_country(self):\n"
            "        for line in self:\n"
            "            if line.country_code == 'XX':\n"
            "                raise ValidationError('no')\n")
    found = semantics.run_check("constrains_lists_every_field_read", body)
    assert (found == []) is quiet, found


def test_an_unstored_input_is_followed_to_what_it_is_computed_from():
    body = _seats("compute='_compute_seats'", "'seats_max', 'seats_reserved'",
                  "'seats_max'").replace(
        "    seats_taken = fields.Integer()\n",
        "    seats_taken = fields.Integer()\n"
        "    seats_reserved = fields.Integer(compute='_compute_reserved')\n\n"
        "    @api.depends('registration_ids')\n"
        "    def _compute_reserved(self):\n"
        "        pass\n\n")
    found = semantics.run_check("constrains_lists_every_field_read", body)
    assert len(found) == 1
    assert "writing 'registration_ids' alone" in found[0][1]
    assert "'seats_reserved'" not in found[0][1].split("--")[1]


def test_an_unstored_field_whose_inputs_cannot_be_read_says_so():
    """The compute lives elsewhere, so what it reads is unknown. The finding
    still stands, and says the field itself cannot be named."""
    body = _seats("compute='_compute_elsewhere'", "'seats_max', 'seats_taken'",
                  "'seats_max'")
    found = semantics.run_check("constrains_lists_every_field_read", body)
    assert len(found) == 1
    assert "not stored" in found[0][1]
    assert "writing 'seats_available'" not in found[0][1]