package registry

import "testing"

func TestVerificationPolicyMatchesPositionally(t *testing.T) {
	p := VerificationPolicy{Allowed: [][]string{
		{"go", "test", "./..."},
		{"go", "test", "./internal/..."},
		{"go", "vet", "./..."},
		{"npm", "test", "--", "*"},
		{"make", "*"},
	}}
	allowed := [][]string{
		{"go", "test", "./..."},
		{"go", "test", "./internal/store/..."},
		{"go", "vet", "./..."},
		{"npm", "test", "--", "unit"},
		// A trailing "*" covers the remaining elements, which is the only way
		// a pattern authorises a longer command. The operator writes that
		// deliberately when a runner takes free-form arguments.
		{"npm", "test", "--", "unit", "extra"},
		{"make", "check"},
		{"make", "check", "verbose"},
		// Narrower than an allowed pattern: ./other/... is a subset of ./...
		{"go", "test", "./other/..."},
	}
	for _, argv := range allowed {
		if ok, why := p.Allows(argv); !ok {
			t.Errorf("%v refused: %s", argv, why)
		}
	}
	refused := [][]string{
		// A shorter pattern must not authorise a longer command, or
		// ["go","test"] would cover ["go","test","-exec","curl"].
		{"go", "test", "./...", "-exec", "curl"},
		{"go", "test"},
		{"go", "build", "./..."},
		{"curl", "https://example.com"},
		{},
	}
	for _, argv := range refused {
		if ok, _ := p.Allows(argv); ok {
			t.Errorf("%v allowed, want a refusal", argv)
		}
	}
}

// Absence is a refusal. A project that declares no policy must not inherit the
// quality gate's operator-authored envelope, because a plan command is written
// by an agent.
func TestAbsentVerificationPolicyRefusesEverything(t *testing.T) {
	var p VerificationPolicy
	ok, why := p.Allows([]string{"go", "test", "./..."})
	if ok {
		t.Fatal("an empty policy allowed a command")
	}
	if why == "" {
		t.Fatal("a refusal with no reason sends the planner guessing")
	}
}

// The path prefix is a prefix of the path, not of the argument text. Tested
// against a policy that does not also allow ./..., which would cover
// everything and hide the distinction.
func TestPathPrefixDoesNotMatchASiblingWithTheSameLetters(t *testing.T) {
	p := VerificationPolicy{Allowed: [][]string{{"go", "test", "./internal/..."}}}
	for _, argv := range [][]string{
		{"go", "test", "./internalsecrets"},
		{"go", "test", "./internal-tools/..."},
		{"go", "test", "./..."},
	} {
		if ok, _ := p.Allows(argv); ok {
			t.Errorf("%v allowed, want a refusal", argv)
		}
	}
	for _, argv := range [][]string{
		{"go", "test", "./internal/..."},
		{"go", "test", "./internal/store/..."},
		{"go", "test", "./internal"},
	} {
		if ok, why := p.Allows(argv); !ok {
			t.Errorf("%v refused: %s", argv, why)
		}
	}
}