import assert from 'node:assert/strict';
import test from 'node:test';

import {
  assertNonProductionTarget,
  assertSafeGateEnvironment,
  assertSafePortalBase,
  isProductionTarget,
} from './safety.mjs';

test('production IP, public domains, and production paths are refused', () => {
  for (const target of [
    '58.38.22.103',
    'ssh://58.38.22.103',
    'https://m.tkmind.cn',
    'https://plaza.tkmind.cn/page',
    '/Users/john/Project/Memind',
  ]) {
    assert.equal(isProductionTarget(target), true, target);
    assert.throws(() => assertNonProductionTarget(target), /refused production/);
  }
});

test('scenario Portal target must be loopback', () => {
  assert.equal(assertSafePortalBase('http://127.0.0.1:8081'), 'http://127.0.0.1:8081');
  assert.equal(assertSafePortalBase('http://localhost:9000/'), 'http://localhost:9000');
  assert.throws(() => assertSafePortalBase('http://192.168.1.9:8081'), /isolated loopback/);
  assert.throws(() => assertSafePortalBase('https://m.tkmind.cn'), /production/);
});

test('unsafe environment keys are reported without exposing values', () => {
  assert.throws(
    () => assertSafeGateEnvironment({
      env: {
        DATABASE_URL: 'postgres://secret@58.38.22.103/prod',
        STUDIO_HOST: '58.38.22.103',
      },
    }),
    (error) => {
      assert.match(error.message, /DATABASE_URL/);
      assert.match(error.message, /STUDIO_HOST/);
      assert.doesNotMatch(error.message, /secret/);
      return true;
    },
  );
});