import { describe, it, expect } from 'vitest';
import { validateVolumeMount, isAllowListedImage, isLocallyBuiltImage } from '../dockerManager.js';
import { SandboxViolationError } from '../../../lib/sandbox.js';

describe('Docker guardrails', () => {
  it('validates workspace-confined volume mounts', () => {
    const mount = validateVolumeMount('src:/app/src');
    expect(mount.target).toBe('/app/src');
    expect(mount.mode).toBe('rw');
  });

  it('rejects Docker socket mounts', () => {
    expect(() => validateVolumeMount('/var/run/docker.sock:/host/docker.sock')).toThrow(SandboxViolationError);
    expect(() => validateVolumeMount('\\.\\pipe\\docker_engine:/host/docker.sock')).toThrow(SandboxViolationError);
  });

  it('rejects malformed mounts', () => {
    expect(() => validateVolumeMount('/app')).toThrow();
    expect(() => validateVolumeMount(':/app')).toThrow();
  });

  it('allows listed base images', () => {
    expect(isAllowListedImage('node:20-alpine')).toBe(true);
    expect(isAllowListedImage('nginx:latest')).toBe(true);
    expect(isAllowListedImage('postgres:15')).toBe(true);
    expect(isAllowListedImage('php:8.2')).toBe(true);
  });

  it('rejects unlisted images', () => {
    expect(isAllowListedImage('evil/image')).toBe(false);
    expect(isAllowListedImage('ubuntu:latest')).toBe(false);
  });

  it('treats registry-prefixed images as not locally built', () => {
    expect(isLocallyBuiltImage('my-app')).toBe(true);
    expect(isLocallyBuiltImage('web-dev-mcp')).toBe(true);
    expect(isLocallyBuiltImage('registry.io/my-app')).toBe(false);
    expect(isLocallyBuiltImage('user/repo')).toBe(false);
  });
});
