/**
 * Private repositories must not be readable through the v2 REST API.
 *
 * Regression test for a live data leak found 2026-07-27: five git-content
 * endpoints under /api/v2/repos/:owner/:repo gated only on `repoExists()`,
 * which is a bare filesystem probe (Bun.file(<repoPath>/HEAD).exists()) and
 * never reads the repositories row — so it never sees isPrivate. Anonymous
 * callers could read branches, commit history (with author emails), the full
 * recursive tree, and raw file contents of any private repo, while the HTML
 * surface correctly returned 404.
 *
 * These are structural assertions rather than live HTTP calls: the leak was a
 * missing gate, and what must not regress is that the gate exists and is
 * mounted at the router rather than sprinkled per-handler.
 */

import { describe, expect, it } from "bun:test";
import { readFileSync } from "fs";

const SRC = readFileSync("src/routes/api-v2.ts", "utf8");

describe("api-v2 repo privacy gate", () => {
  it("is mounted on the whole /repos/:owner/:repo subtree", () => {
    expect(SRC).toContain('apiv2.use("/repos/:owner/:repo", repoPrivacyGate)');
    expect(SRC).toContain('apiv2.use("/repos/:owner/:repo/*", repoPrivacyGate)');
  });

  it("denies with 404, never 403 — a private repo must not confirm it exists", () => {
    const gate = SRC.slice(
      SRC.indexOf("async function repoPrivacyGate"),
      SRC.indexOf("// ─── Helper")
    );
    expect(gate).toContain('access === "none"');
    expect(gate).toContain('c.json({ error: "Not found" }, 404)');
    // No 403 as an actual returned status (the word appears in a comment
    // explaining why 404 is the right choice, hence matching the call shape).
    expect(gate).not.toMatch(/,\s*403\s*\)/);
  });

  it("uses resolveRepoAccess, not an ownerId comparison", () => {
    const gate = SRC.slice(
      SRC.indexOf("async function repoPrivacyGate"),
      SRC.indexOf("// ─── Helper")
    );
    // An ownerId equality check would wrongly deny collaborators and org
    // members — that was the flaw in the pre-existing inline checks.
    expect(gate).toContain("resolveRepoAccess");
    expect(gate).not.toMatch(/user\.id\s*!==\s*\w*[Oo]wner/);
  });

  it("runs after apiAuth so the viewer identity is populated", () => {
    // If the gate were registered before apiAuth, c.get("user") would always
    // be undefined and every private repo would 404 even for its owner.
    expect(SRC.indexOf('apiv2.use("*", apiAuth)')).toBeLessThan(
      SRC.indexOf('apiv2.use("/repos/:owner/:repo", repoPrivacyGate)')
    );
  });

  it("lets unknown repos fall through to each handler's own 404", () => {
    const gate = SRC.slice(
      SRC.indexOf("async function repoPrivacyGate"),
      SRC.indexOf("// ─── Helper")
    );
    expect(gate).toContain("if (!resolved) return next()");
  });
});

describe("repoExists is not a privacy check", () => {
  it("never consults the repositories table", () => {
    const repo = readFileSync("src/git/repository.ts", "utf8");
    const fn = repo.slice(
      repo.indexOf("export async function repoExists"),
      repo.indexOf("export async function repoExists") + 400
    );
    // Documents WHY the router gate is required: this helper cannot answer
    // "may this caller see it?", only "is there a directory on disk?".
    expect(fn).not.toContain("isPrivate");
    expect(fn).not.toContain("repositories");
  });
});

describe("GET /api/users/:username/repos does not leak private repos", () => {
  const SRC_API = readFileSync("src/routes/api.ts", "utf8");
  const handler = SRC_API.slice(
    SRC_API.indexOf('api.get("/users/:username/repos"'),
    SRC_API.indexOf('api.get("/repos/:owner/:name"')
  );

  it("filters each row through resolveRepoAccess", () => {
    expect(handler).toContain("resolveRepoAccess");
    expect(handler).toContain('access === "none"');
  });

  it("strips diskPath from the response", () => {
    // diskPath discloses the server's on-disk storage layout.
    expect(handler).toMatch(/diskPath: _diskPath, \.\.\.rest/);
  });

  it("does not return the raw rows", () => {
    expect(handler).not.toContain("return c.json(repos)");
  });
});