/**
 * Regression: the pre-receive secret scan must inspect ONLY what a push
 * actually introduces — not the entire repo tree.
 *
 * The bug: for a NEW branch (oldSha = zero-SHA), buildPreReceiveScript() used
 * LOG_RANGE="$NEW" and a `git diff <empty-tree> $NEW`, which reports every
 * file in the whole repo as "changed". So pushing a clean feature branch was
 * rejected because a PRE-EXISTING committed test fixture (crafted to look like
 * a real secret, to test the scanner itself) matched a pattern — even though
 * the branch never touched it. This broke the documented
 * "push a feature branch → open a PR" workflow for every new branch.
 *
 * These tests drive the ACTUAL generated hook via a real `git push` into a
 * bare repo (same as production), rather than re-implementing the range logic.
 */
import { describe, expect, it, beforeAll } from "bun:test";
import { mkdtempSync, writeFileSync } from "fs";
import { tmpdir } from "os";
import { join } from "path";
import { installPackInspectionHook } from "../lib/push-policy";

// A realistic-looking AWS key SHAPE used only to drive the scanner in the
// temp repo below. The `fake` marker on this line makes the push-time secret
// scanner's placeholder filter skip THIS source line, while the value still
// matches inside the generated fixture files (whose lines carry no marker).
const FIXTURE_SECRET = "AKIAABCDEFGH1234IJKL"; // fake test credential, not real

function git(cwd: string, args: string[], allowFail = false) {
  const proc = Bun.spawnSync(["git", ...args], {
    cwd,
    env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
  });
  const exitCode = proc.exitCode;
  const stderr = new TextDecoder().decode(proc.stderr);
  if (!allowFail && exitCode !== 0) {
    throw new Error(`git ${args.join(" ")} failed (${exitCode}):\n${stderr}`);
  }
  return { exitCode, stderr, stdout: new TextDecoder().decode(proc.stdout) };
}

const GIT_OK = (() => {
  try {
    return Bun.spawnSync(["git", "--version"]).exitCode === 0;
  } catch {
    return false;
  }
})();

describe.skipIf(!GIT_OK)("pre-receive scan only inspects pushed changes", () => {
  let bare: string;
  let work: string;

  beforeAll(async () => {
    const root = mkdtempSync(join(tmpdir(), "gc-newbranch-"));
    bare = join(root, "bare.git");
    work = join(root, "work");

    git(root, ["init", "--bare", "-b", "main", bare]);
    git(root, ["init", "-b", "main", work]);
    git(work, ["config", "user.email", "t@example.com"]);
    git(work, ["config", "user.name", "Test"]);
    git(work, ["config", "commit.gpgsign", "false"]);

    // Seed main with a pre-existing fixture that CONTAINS a secret pattern,
    // pushed BEFORE the hook is installed (so it lands, exactly like the real
    // fixtures that predate the scanner).
    writeFileSync(join(work, "fixture.ts"), `const K = '${FIXTURE_SECRET}';\n`);
    git(work, ["add", "."]);
    git(work, ["commit", "-m", "seed fixture (has a secret pattern)"]);
    git(work, ["remote", "add", "origin", bare]);
    git(work, ["push", "-u", "origin", "main"]);

    // Now arm the pre-receive hook on the bare repo.
    const hook = await installPackInspectionHook([], { secretScan: true });
    if (!hook) throw new Error("hook install returned null");
    git(bare, ["config", "core.hooksPath", hook.env.GIT_CONFIG_VALUE_0]);
  });

  it("accepts a new branch that only adds a clean file (does NOT rescan the pre-existing fixture)", () => {
    git(work, ["checkout", "-b", "clean-feature", "main"]);
    writeFileSync(join(work, "clean.ts"), "export const ok = 1;\n");
    git(work, ["add", "clean.ts"]);
    git(work, ["commit", "-m", "add a clean file"]);

    const res = git(work, ["push", "origin", "clean-feature"], true);
    // Before the fix this failed with "Secret scan: possible AWS Access Key
    // in fixture.ts" — a file the branch never touched.
    expect(res.stderr).not.toContain("Secret scan");
    expect(res.exitCode).toBe(0);
  });

  it("still blocks a new branch that itself introduces a real secret", () => {
    git(work, ["checkout", "-b", "leaky-feature", "main"]);
    writeFileSync(join(work, "leak.ts"), `const K = '${FIXTURE_SECRET}';\n`);
    git(work, ["add", "leak.ts"]);
    git(work, ["commit", "-m", "oops committed a secret"]);

    const res = git(work, ["push", "origin", "leaky-feature"], true);
    expect(res.exitCode).not.toBe(0);
    expect(res.stderr).toContain("Secret scan");
    expect(res.stderr).toContain("leak.ts");
    // And it must NOT also (falsely) flag the untouched fixture.
    expect(res.stderr).not.toContain("fixture.ts");
  });
});