import assert from 'node:assert/strict';
import fs from 'node:fs';
import os from 'node:os';
import path from 'node:path';
import test from 'node:test';
import {
  checkGoosedProxyBoundary,
  GOOSED_DIRECT_ALLOWLIST,
  GOOSED_PROXY_ADAPTER_FILE,
  GOOSED_PROXY_GUARDED_FILES,
} from './goosed-proxy-boundary.mjs';

const repoRoot = path.resolve(new URL('.', import.meta.url).pathname, '.');

test('current repository passes goosed proxy boundary check', () => {
  const violations = checkGoosedProxyBoundary(repoRoot);
  assert.equal(
    violations.length,
    0,
    violations.map((item) => `${item.file}:${item.line} ${item.rule}`).join('\n'),
  );
});

test('guard detects createApiFetch outside allowlist', () => {
  const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'goosed-boundary-'));
  try {
    fs.writeFileSync(
      path.join(tempRoot, 'agent-run-gateway.mjs'),
      'export async function run() {}\n',
    );
    fs.writeFileSync(
      path.join(tempRoot, 'rogue-module.mjs'),
      'function createApiFetch() {}\nexport const apiFetch = createApiFetch("https://127.0.0.1:18006");\n',
    );
    const violations = checkGoosedProxyBoundary(tempRoot, {
      extraGuarded: [],
      scanRepo: true,
    });
    assert.ok(violations.some((item) => item.file === 'rogue-module.mjs' && item.rule === 'create-api-fetch'));
  } finally {
    fs.rmSync(tempRoot, { recursive: true, force: true });
  }
});

test('allowlist permits MindSpace direct adapters', () => {
  assert.ok(GOOSED_DIRECT_ALLOWLIST.includes('mindspace-agent-runner.mjs'));
  assert.ok(GOOSED_DIRECT_ALLOWLIST.includes('mindspace-page-edit-session.mjs'));
  assert.equal(GOOSED_PROXY_ADAPTER_FILE, 'tkmind-proxy.mjs');
  assert.ok(GOOSED_PROXY_GUARDED_FILES.includes('server.mjs'));
});

test('tkmind proxy keeps legacy reply path at 410 AGENT_RUNS_REQUIRED', () => {
  const content = fs.readFileSync(path.join(repoRoot, 'tkmind-proxy.mjs'), 'utf8');
  assert.match(content, /AGENT_RUNS_REQUIRED/);
  assert.match(content, /isReplyPath/);
});