import test from 'node:test';
import assert from 'node:assert/strict';
import { execFile } from 'node:child_process';
import fs from 'node:fs/promises';
import os from 'node:os';
import path from 'node:path';
import { promisify } from 'node:util';

const execFileAsync = promisify(execFile);

test('Git askpass reads HTTPS credentials from protected files instead of process env', async () => {
  const authDir = await fs.mkdtemp(path.join(os.tmpdir(), 'sammo-git-auth-'));
  try {
    await fs.writeFile(path.join(authDir, 'https-username'), 'deploy-user', { mode: 0o600 });
    await fs.writeFile(path.join(authDir, 'https-token'), 'deploy-token', { mode: 0o600 });

    const username = await execFileAsync('./runtime/git-askpass.sh', ['Username'], {
      env: { SAMMO_GIT_AUTH_DIR: authDir },
    });
    const token = await execFileAsync('./runtime/git-askpass.sh', ['Password'], {
      env: { SAMMO_GIT_AUTH_DIR: authDir },
    });

    assert.equal(username.stdout, 'deploy-user');
    assert.equal(token.stdout, 'deploy-token');
  } finally {
    await fs.rm(authDir, { recursive: true });
  }
});

test('runtime entrypoint removes raw repository secrets before launching PM2', async () => {
  const entrypoint = await fs.readFile(new URL('../runtime/entrypoint.sh', import.meta.url), 'utf8');
  const pm2Start = entrypoint.indexOf('"$pm2_bin" start');
  const httpsUnset = entrypoint.indexOf('unset CORE_REPOSITORY_USERNAME CORE_REPOSITORY_TOKEN');
  const sshUnset = entrypoint.indexOf('unset CORE_SSH_PRIVATE_KEY_BASE64 CORE_SSH_KNOWN_HOSTS_BASE64');

  assert.ok(pm2Start > 0);
  assert.ok(httpsUnset > 0 && httpsUnset < pm2Start);
  assert.ok(sshUnset > 0 && sshUnset < pm2Start);
});

test('Caddy runtime logs remove the custom Gateway session header', async () => {
  const caddyfile = await fs.readFile(new URL('../caddy/Caddyfile', import.meta.url), 'utf8');

  assert.match(caddyfile, /log\s*\{[\s\S]*format filter\s*\{[\s\S]*request>headers>X-Session-Token delete/);
});