import { describe, expect, test } from 'bun:test';
import { readFileSync } from 'node:fs';
import { join } from 'node:path';

/**
 * The HTTPS probe must FAIL CLOSED when it cannot read curl's exit code.
 *
 * Its command ends in `echo "curl-exit=$?"`, so the shell always exits 0 — a
 * fallback to the exec's own exit code therefore scores "I could not read the
 * answer" as "the site is serving". Measured on run 7258: the probe printed
 * `pebble CA ready ✔ 0s` while celilo.computer served NO certificate at all
 * (empty `openssl s_client` chain, server aborting with `internal error
 * (592)`), and the real defect surfaced one step later as install.sh's
 * curl (35). A probe that cannot fail turned celilo#1365 into a green step.
 *
 * Same shape as the bin script's other gate: the explainer has no import
 * surface, so this reads the real source.
 */
describe('the bake HTTPS probe fails closed', () => {
  const src = readFileSync(join(import.meta.dir, '..', 'bin', 'e2e-bake-management'), 'utf-8');

  test('an unreadable probe does NOT fall back to the shell exit code', () => {
    expect(src).not.toContain('Number(code[1]) : probe.exitCode');
  });

  test('an unreadable probe is scored as not-ready', () => {
    expect(src).toContain('Number(code[1]) : PROBE_UNREADABLE');
  });

  test('the unreadable case has its own explanation, not the timeout headline', () => {
    const fn = /function explainProbeFailure\(curlExit: number\): string \{[\s\S]*?\n\}/.exec(src);
    expect(fn).not.toBeNull();
    expect(fn?.[0]).toContain('PROBE_UNREADABLE');
  });
});