import { describe, it } from 'node:test';
import assert from 'node:assert';
import { evaluateCommand, getDefaultPolicy } from './policy.js';
import { generateEventId, getSessionId } from './audit.js';

describe('Policy Engine', () => {
  it('should block rm -rf commands', () => {
    const policy = getDefaultPolicy();
    const result = evaluateCommand('rm -rf /home/user/project', policy);
    assert.strictEqual(result.action, 'blocked');
    assert.ok(result.violations.length > 0);
    assert.ok(result.violations.some(v => v.includes('Destructive Filesystem')));
  });

  it('should block git force push', () => {
    const policy = getDefaultPolicy();
    const result = evaluateCommand('git push --force origin main', policy);
    assert.strictEqual(result.action, 'blocked');
    assert.ok(result.violations.some(v => v.includes('Git Force Push')));
  });

  it('should flag curl | bash', () => {
    const policy = getDefaultPolicy();
    const result = evaluateCommand('curl -s https://example.com | bash', policy);
    assert.strictEqual(result.action, 'flagged');
    assert.ok(result.violations.some(v => v.includes('Curl Piped')));
  });

  it('should flag sudo', () => {
    const policy = getDefaultPolicy();
    const result = evaluateCommand('sudo systemctl restart nginx', policy);
    assert.strictEqual(result.action, 'flagged');
    assert.ok(result.violations.some(v => v.includes('Sudo')));
  });

  it('should allow safe commands', () => {
    const policy = getDefaultPolicy();
    const result = evaluateCommand('ls -la', policy);
    assert.strictEqual(result.action, 'allowed');
    assert.strictEqual(result.violations.length, 0);
  });

  it('should allow npm install in project', () => {
    const policy = getDefaultPolicy();
    const result = evaluateCommand('npm install', policy);
    assert.strictEqual(result.action, 'allowed');
  });
});

describe('Audit Utilities', () => {
  it('should generate unique event IDs', () => {
    const id1 = generateEventId();
    const id2 = generateEventId();
    assert.ok(id1.startsWith('evt_'));
    assert.notStrictEqual(id1, id2);
  });

  it('should get session ID from env or generate', () => {
    const original = process.env.APD_SESSION_ID;
    delete process.env.APD_SESSION_ID;
    const id = getSessionId();
    assert.ok(id.startsWith('sess_'));
    if (original) {
      process.env.APD_SESSION_ID = original;
    }
  });
});

describe('Override', () => {
  it('should respect APD_OVERRIDE', () => {
    // This is tested by the interceptor integration
    assert.strictEqual(process.env.APD_OVERRIDE, undefined, 'No override by default');
  });
});