import assert from "node:assert/strict";
import path from "node:path";
import { fileURLToPath } from "node:url";
import { describe, it } from "vitest";
import { inspectSentryPin, verifyUpstreamSourcePins } from "./verify-upstream-source-pins.mjs";

const commit = "5c9794c9b1fda551f38515f85d56ec298371d060";
const validInstaller = [
  `UPSTREAM_COMMIT="${commit}"`,
  'git -C "${UPSTREAM_DIR}" fetch --depth 1 origin "${UPSTREAM_COMMIT}"',
  'git -C "${UPSTREAM_DIR}" checkout --quiet --detach "${UPSTREAM_COMMIT}"',
  'ACTUAL_COMMIT="$(git -C "${UPSTREAM_DIR}" rev-parse --verify HEAD)"',
  'if [[ "${ACTUAL_COMMIT}" != "${UPSTREAM_COMMIT}" ]]; then exit 1; fi',
].join("\n");

describe("upstream source pin verification", () => {
  it("accepts the repository Sentry pin contract", () => {
    const rootDir = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
    const result = verifyUpstreamSourcePins(rootDir);
    assert.deepEqual(result.failures, []);
  });

  it("rejects mutable tag execution and missing commit verification", () => {
    const result = inspectSentryPin(
      `UPSTREAM_TAG="25.12.1"\ngit clone --branch "\${UPSTREAM_TAG}" https://example.invalid/repo.git`,
      `Tag 25.12.1`,
    );
    assert.match(result.failures.join("\n"), /UPSTREAM_COMMIT must be a full 40-character commit/);
  });

  it("rejects a pin that is not documented", () => {
    const result = inspectSentryPin(validInstaller, "tag only");
    assert.match(result.failures.join("\n"), /must document/);
  });
});