/**
 * Private repositories must not be readable through the v2 REST API.
 *
 * Regression test for a live data leak found 2026-07-27: five git-content
 * endpoints under /api/v2/repos/:owner/:repo gated only on `repoExists()`,
 * which is a bare filesystem probe (Bun.file(<repoPath>/HEAD).exists()) and
 * never reads the repositories row — so it never sees isPrivate. Anonymous
 * callers could read branches, commit history (with author emails), the full
 * recursive tree, and raw file contents of any private repo, while the HTML
 * surface correctly returned 404.
 *
 * These are structural assertions rather than live HTTP calls: the leak was a
 * missing gate, and what must not regress is that the gate exists and is
 * mounted at the router rather than sprinkled per-handler.
 */

import { describe, expect, it } from "bun:test";
import { readFileSync } from "fs";

const SRC = readFileSync("src/routes/api-v2.ts", "utf8");

describe("api-v2 repo privacy gate", () => {
  it("is mounted on the whole /repos/:owner/:repo subtree", () => {
    expect(SRC).toContain('apiv2.use("/repos/:owner/:repo", repoPrivacyGate)');
    expect(SRC).toContain('apiv2.use("/repos/:owner/:repo/*", repoPrivacyGate)');
  });

  it("denies with 404, never 403 — a private repo must not confirm it exists", () => {
    const gate = SRC.slice(
      SRC.indexOf("async function repoPrivacyGate"),
      SRC.indexOf("// ─── Helper")
    );
    expect(gate).toContain('access === "none"');
    expect(gate).toContain('c.json({ error: "Not found" }, 404)');
    // No 403 as an actual returned status (the word appears in a comment
    // explaining why 404 is the right choice, hence matching the call shape).
    expect(gate).not.toMatch(/,\s*403\s*\)/);
  });

  it("uses resolveRepoAccess, not an ownerId comparison", () => {
    const gate = SRC.slice(
      SRC.indexOf("async function repoPrivacyGate"),
      SRC.indexOf("// ─── Helper")
    );
    // An ownerId equality check would wrongly deny collaborators and org
    // members — that was the flaw in the pre-existing inline checks.
    expect(gate).toContain("resolveRepoAccess");
    expect(gate).not.toMatch(/user\.id\s*!==\s*\w*[Oo]wner/);
  });

  it("runs after apiAuth so the viewer identity is populated", () => {
    // If the gate were registered before apiAuth, c.get("user") would always
    // be undefined and every private repo would 404 even for its owner.
    expect(SRC.indexOf('apiv2.use("*", apiAuth)')).toBeLessThan(
      SRC.indexOf('apiv2.use("/repos/:owner/:repo", repoPrivacyGate)')
    );
  });

  it("lets unknown repos fall through to each handler's own 404", () => {
    const gate = SRC.slice(
      SRC.indexOf("async function repoPrivacyGate"),
      SRC.indexOf("// ─── Helper")
    );
    expect(gate).toContain("if (!resolved) return next()");
  });
});

describe("repoExists is not a privacy check", () => {
  it("never consults the repositories table", () => {
    const repo = readFileSync("src/git/repository.ts", "utf8");
    const fn = repo.slice(
      repo.indexOf("export async function repoExists"),
      repo.indexOf("export async function repoExists") + 400
    );
    // Documents WHY the router gate is required: this helper cannot answer
    // "may this caller see it?", only "is there a directory on disk?".
    expect(fn).not.toContain("isPrivate");
    expect(fn).not.toContain("repositories");
  });
});