/**
 * Tests for validatePrivilegedCapabilities — the allow-list gate that
 * rejects modules requiring framework-granted privileges (today: only
 * cross_module_read, allow-listed to celilo-mgmt).
 */

import { describe, expect, it } from 'bun:test';
import type { ModuleManifest } from './schema';
import { validatePrivilegedCapabilities } from './validate';

function buildManifest(overrides: Partial<ModuleManifest>): ModuleManifest {
  return {
    celilo_contract: '1.0',
    id: 'some-module',
    name: 'some module',
    version: '0.0.1',
    requires: { capabilities: [] },
    ...overrides,
  } as ModuleManifest;
}

describe('validatePrivilegedCapabilities', () => {
  it('accepts manifests with no privileged capabilities', () => {
    const result = validatePrivilegedCapabilities(
      buildManifest({
        id: 'homebridge',
        requires: { capabilities: [{ name: 'public_web', version: '^3.0' }] },
      }),
    );
    expect(result).toBeNull();
  });

  it('accepts celilo-mgmt requiring cross_module_read', () => {
    const result = validatePrivilegedCapabilities(
      buildManifest({
        id: 'celilo-mgmt',
        requires: { capabilities: [{ name: 'cross_module_read', version: '^1.0' }] },
      }),
    );
    expect(result).toBeNull();
  });

  it('rejects a non-allow-listed module requiring cross_module_read', () => {
    const result = validatePrivilegedCapabilities(
      buildManifest({
        id: 'homebridge',
        requires: { capabilities: [{ name: 'cross_module_read', version: '^1.0' }] },
      }),
    );
    expect(result).not.toBeNull();
    expect(result?.errors).toHaveLength(1);
    expect(result?.errors[0].path).toBe('requires.capabilities.cross_module_read');
    expect(result?.errors[0].message).toContain('framework-granted privilege');
    expect(result?.errors[0].message).toContain('celilo-mgmt');
    expect(result?.errors[0].message).toContain("'homebridge' is not on the allow-list");
  });

  it('also rejects when declared under optional.capabilities', () => {
    const result = validatePrivilegedCapabilities(
      buildManifest({
        id: 'sneaky-module',
        requires: { capabilities: [] },
        optional: {
          capabilities: [{ name: 'cross_module_read', version: '^1.0' }],
        },
      } as Partial<ModuleManifest>),
    );
    expect(result).not.toBeNull();
    expect(result?.errors[0].path).toBe('optional.capabilities.cross_module_read');
  });

  it('aggregates errors when a module both requires AND optionally declares the privilege', () => {
    const result = validatePrivilegedCapabilities(
      buildManifest({
        id: 'sneaky-module',
        requires: { capabilities: [{ name: 'cross_module_read', version: '^1.0' }] },
        optional: {
          capabilities: [{ name: 'cross_module_read', version: '^1.0' }],
        },
      } as Partial<ModuleManifest>),
    );
    expect(result?.errors).toHaveLength(2);
  });
});