/**
 * git argument injection.
 *
 * Commands in src/git/repository.ts are arrays run through Bun.spawn, so there
 * is no shell involved and no shell injection. But git parses any leading-dash
 * argument as an option wherever it appears, and several commands take a
 * caller-supplied ref / sha / treeish positionally with no `--` separator.
 *
 * A ref of `--output=/app/src/index.ts` reaching `git log` makes git write its
 * output to that path — unauthenticated arbitrary file write as the app user,
 * reachable through ordinary public-repo URLs like /:owner/:repo/commits/:ref.
 *
 * exec() now refuses option-like arguments centrally. These lock that in and,
 * just as importantly, prove the guard does not reject the flags the module
 * legitimately passes.
 */

import { describe, expect, it } from "bun:test";
import { readFileSync } from "fs";

const SRC = readFileSync("src/git/repository.ts", "utf8");

// Mirror of the module-private predicate, kept in step by the coverage test
// at the bottom which asserts against the real source.
function isAllowedGitFlag(arg: string): boolean {
  const ALLOWED = new Set([
    "--bare", "--format", "--skip", "--verify", "--porcelain", "--max-count",
    "--full-tree", "--quiet", "--stdin", "--short", "--end-of-options", "--",
    "--sort", "--numstat", "--add", "--cacheinfo",
    "-",
    "-a", "-d", "-l", "-r", "-t", "-n", "-I", "-m", "-p", "-s", "-e", "-w", "-1",
  ]);
  if (!arg.startsWith("-")) return true;
  if (/^-\d+$/.test(arg)) return true;
  return ALLOWED.has(arg.split("=", 1)[0]);
}

describe("option-like arguments are refused", () => {
  const attacks = [
    "--output=/app/src/index.ts", // git log: arbitrary file write
    "--output=/tmp/pwned",
    "--upload-pack=/bin/sh",
    "--exec=/bin/sh",
    "-o/tmp/pwned",
    "--git-dir=/etc",
    "--work-tree=/",
  ];
  for (const a of attacks) {
    it(`rejects ${a}`, () => {
      expect(isAllowedGitFlag(a)).toBe(false);
    });
  }

  it("rejects a ref embedded in a rev:path argument", () => {
    // `git show ${ref}:${filePath}` — a dash-leading ref poisons the whole arg.
    expect(isAllowedGitFlag("--output=/tmp/x:README.md")).toBe(false);
  });
});

describe("legitimate arguments still pass", () => {
  const ok = [
    "main", "HEAD", "refs/heads/main", "v1.2.3",
    "abc123def456", "main:src/index.ts", "origin/main..HEAD",
    "--format=%H%x00%s", "--skip=20", "--max-count=50", "--sort=-creatordate",
    "--bare", "--porcelain", "--numstat", "--cacheinfo", "--full-tree", "--",
    "-500", "-30", "-1", "-I", "-w",
    // A branch legitimately containing a dash, just not leading.
    "feature/my-branch", "release-2.0",
  ];
  for (const a of ok) {
    it(`accepts ${a}`, () => {
      expect(isAllowedGitFlag(a)).toBe(true);
    });
  }
});

describe("guard is wired in", () => {
  it("exec() screens every argument after the binary", () => {
    expect(SRC).toContain("refusing option-like argument");
    expect(SRC).toMatch(/for \(let i = 1; i < cmd\.length; i\+\+\)/);
  });

  it("the streaming Bun.spawn paths are guarded too", () => {
    // Two call sites stream instead of buffering and therefore skip exec().
    const guards = SRC.match(/refused option-like git argument/g) ?? [];
    expect(guards.length).toBe(2);
  });

  it("every dash-argument the module actually uses is allowlisted", () => {
    // The real risk of a central guard is breaking legitimate git calls.
    const found = new Set<string>();
    for (const m of SRC.matchAll(/"(-[^"]*)"/g)) found.add(m[1]);
    for (const m of SRC.matchAll(/`(-[^`]*)`/g)) found.add(m[1]);
    const uncovered = [...found].filter((f) => {
      if (f.includes("${")) return false; // template — resolved at runtime
      if (f.startsWith("--output=")) return false; // appears only in a comment
      return !isAllowedGitFlag(f);
    });
    expect(uncovered).toEqual([]);
  });
});