import test from "node:test";
import assert from "node:assert/strict";
import { validateMapping, stripAccountWideTokens } from "../remediate.js";

test("fails closed on an unmapped resource", () => {
  const r = validateMapping(["gls-leads", "beagle-investors"], { "gls-leads": "acc-a" });
  assert.deepEqual(r, { ok: false, missing: ["beagle-investors"] });
});

test("passes when every resource is mapped", () => {
  assert.deepEqual(validateMapping(["gls-leads"], { "gls-leads": "acc-a" }), {
    ok: true,
    missing: [],
  });
});

test("strips only account-wide token lines, keeps the account id and scoped tokens", () => {
  const before =
    "CLOUDFLARE_ACCOUNT_ID=acc\nCLOUDFLARE_API_TOKEN=cfat_x\nCF_PAGES_D1_TOKEN=y\nCF_DNS_TOKEN=keep\n";
  assert.equal(stripAccountWideTokens(before), "CLOUDFLARE_ACCOUNT_ID=acc\nCF_DNS_TOKEN=keep\n");
});

// Task 1670 — the house-code data scopes reach the whole shared account, so a
// stray copy in a sub-account file is a cross-tenant leak and must be stripped.
test("strips the account-wide data scopes (storage, calendar-d1), keeps zone hosting tokens", () => {
  const before =
    "CLOUDFLARE_ACCOUNT_ID=acc\nCF_STORAGE_TOKEN=cfat_d1r2\nCF_CALENDAR_D1_TOKEN=cfat_d1\nCF_DNS_TOKEN=keep\n";
  assert.equal(stripAccountWideTokens(before), "CLOUDFLARE_ACCOUNT_ID=acc\nCF_DNS_TOKEN=keep\n");
});