import { describe, expect, it } from "vitest";

import { parseSafeDependencyCatalog, parseSafeRunUpdateList } from "./runtimeUpdates";

const digest = `sha256:${"a".repeat(64)}`;

describe("safe dependency and Run update projections", () => {
  it("accepts reviewable plans, safe evidence, checksums, and rollback phases", () => {
    const catalog = parseSafeDependencyCatalog({
      serverInstanceId: "server-1",
      pluginId: "game.runtime",
      pluginVersion: "1.0.0",
      profileKey: "local",
      targetOs: "linux",
      targetArch: "amd64",
      probes: [{ key: "java", kind: "java.version", required: true, state: "present", evidence: "OpenJDK 21", installPlanKey: "java-install" }],
      plans: [{ key: "java-install", title: "Install Java", targetOs: "linux", targetArch: "amd64", digest, steps: [{ type: "package", targetKey: "java", packageManager: "apt", packageName: "openjdk-21-jre" }] }],
      updatedAt: "2026-07-18T12:00:00Z"
    });
    expect(catalog.plans[0]).toMatchObject({ digest, targetOs: "linux" });

    const updates = parseSafeRunUpdateList({
      items: [{
        id: "update-1",
        serverInstanceId: "server-1",
        runEndpointId: "run-1",
        artifactId: "artifact-1",
        checksum: digest,
        targetOs: "linux",
        targetArch: "amd64",
        targetRelease: "release-2",
        previousVersion: "release-1",
        jobId: "job-1",
        status: "failed",
        phase: "rolled-back",
        message: "previous executable restored",
        rollback: true,
        createdAt: "2026-07-18T12:00:00Z",
        updatedAt: "2026-07-18T12:01:00Z"
      }],
      count: 1
    });
    expect(updates.items[0]).toMatchObject({ phase: "rolled-back", rollback: true, checksum: digest });
  });

  it.each(["leaseToken", "sessionToken", "secretRef", "hostPath", "socket", "credential", "pid", "payload", "bindings"])("rejects forbidden %s fields recursively", (field) => {
    expect(() => parseSafeDependencyCatalog({
      serverInstanceId: "server-1",
      pluginId: "game.runtime",
      pluginVersion: "1.0.0",
      profileKey: "local",
      targetOs: "linux",
      targetArch: "amd64",
      probes: [{ key: "java", kind: "java.version", required: true, state: "unknown", [field]: "private" }],
      plans: [],
      updatedAt: "2026-07-18T12:00:00Z"
    })).toThrow(/forbidden field/);
  });

  it("rejects raw host paths or credentials hidden in safe-looking evidence", () => {
    expect(() => parseSafeDependencyCatalog({
      serverInstanceId: "server-1",
      pluginId: "game.runtime",
      pluginVersion: "1.0.0",
      profileKey: "local",
      targetOs: "linux",
      targetArch: "amd64",
      probes: [{ key: "java", kind: "java.version", required: true, state: "present", evidence: "/Users/operator/private" }],
      plans: [],
      updatedAt: "2026-07-18T12:00:00Z"
    })).toThrow(/unsafe runtime details/);
  });
});