import { describe, it, expect } from 'vitest';
import path from 'node:path';
import { resolveWorkspacePath, assertAllowedBinary, SandboxViolationError } from '../sandbox.js';

const ROOT = path.resolve('/workspace');

describe('resolveWorkspacePath', () => {
  it('resolves a simple relative path inside the root', () => {
    const result = resolveWorkspacePath(ROOT, 'src/index.ts');
    expect(result).toBe(path.join(ROOT, 'src', 'index.ts'));
  });

  it('resolves "." to the root itself', () => {
    const result = resolveWorkspacePath(ROOT, '.');
    expect(result).toBe(ROOT);
  });

  it('throws for a single .. escape attempt', () => {
    expect(() => resolveWorkspacePath(ROOT, '../etc/passwd')).toThrow(SandboxViolationError);
  });

  it('throws for nested .. escape attempts', () => {
    expect(() => resolveWorkspacePath(ROOT, 'a/b/../../../../etc/passwd')).toThrow(SandboxViolationError);
  });

  it('throws for an absolute path outside the root', () => {
    expect(() => resolveWorkspacePath(ROOT, '/etc/passwd')).toThrow(SandboxViolationError);
  });

  it('allows a path that walks up and back down inside the root', () => {
    const result = resolveWorkspacePath(ROOT, 'a/b/../c/d.ts');
    expect(result).toBe(path.join(ROOT, 'a', 'c', 'd.ts'));
  });
});

describe('assertAllowedBinary', () => {
  it('allows an explicitly listed binary', () => {
    expect(() => assertAllowedBinary('npm')).not.toThrow();
    expect(() => assertAllowedBinary('php')).not.toThrow();
    expect(() => assertAllowedBinary('docker')).not.toThrow();
  });

  it('allows listed binaries with common Windows extensions', () => {
    expect(() => assertAllowedBinary('npm.exe')).not.toThrow();
    expect(() => assertAllowedBinary('node.cmd')).not.toThrow();
    expect(() => assertAllowedBinary('composer.ps1')).not.toThrow();
  });

  it('allows a binary with a directory prefix', () => {
    expect(() => assertAllowedBinary('vendor/bin/phpunit')).not.toThrow();
  });

  it('rejects a binary not on the allow-list', () => {
    expect(() => assertAllowedBinary('rm')).toThrow(SandboxViolationError);
    expect(() => assertAllowedBinary('curl')).toThrow(SandboxViolationError);
  });

  it('rejects a path that would execute an arbitrary binary', () => {
    expect(() => assertAllowedBinary('/usr/bin/rm')).toThrow(SandboxViolationError);
  });
});