/**
 * Tests for the `jail_exemptions` audit category (per-module-jail-policy
 * task 3.3/3.4).
 *
 * The severity contract is the point: an operator-recorded exemption is
 * `todo`, never `drift`, so `system update` never treats it as work. And the
 * negative half: a fleet with no exemptions contributes no findings.
 */

import { describe, expect, test } from 'bun:test';
import { auditJailExemptions } from './jail-exemptions';

const EXEMPT = { moduleId: 'caddy', policy: 'off' as const, systemPolicy: 'auto' as const };

describe('auditJailExemptions (per-module-jail-policy task 3.3)', () => {
  test('no exemptions produce no findings (the negative half of task 3.4)', async () => {
    expect(await auditJailExemptions({ exemptions: [] })).toEqual([]);
  });

  test('each exemption is one finding, severity todo, never drift', async () => {
    const findings = await auditJailExemptions({
      exemptions: [EXEMPT, { moduleId: 'vault', policy: 'auto', systemPolicy: 'required' }],
    });
    expect(findings).toHaveLength(2);
    for (const f of findings) {
      expect(f.category).toBe('jail_exemptions');
      expect(f.severity).toBe('todo');
      expect(f.severity).not.toBe('drift');
      expect(f.code).toBe('hook_jail_exemption');
      expect(f.actionable).toBe(false);
    }
  });

  test('the finding names the module and both policies', async () => {
    const [finding] = await auditJailExemptions({ exemptions: [EXEMPT] });
    expect(finding).toBeDefined();
    expect(finding?.subject).toBe('caddy');
    expect(finding?.message).toContain('caddy');
    expect(finding?.message).toContain("'off'");
    expect(finding?.message).toContain("'auto'");
  });
});