/**
 * Gate: the removed vault driver id stays gone from the tracked tree.
 *
 * Mirrors {@link ../cli/doc-staleness.test.ts} — `git grep` must find zero
 * hits (this file splits the token so it never matches itself).
 */

import { describe, expect, test } from "bun:test";
import { join } from "node:path";

const ROOT = join(import.meta.dir, "../..");

/** Forbidden driver id, split so this file does not match itself. */
const FORBIDDEN_DRIVER = ["so", "ps"].join("");
/** Forbidden vault driver id, split so this file does not match itself. */
const FORBIDDEN_SECRETS_SAAS = ["infi", "sical"].join("");
/** Forbidden optional peer, split so this file does not match itself. */
const FORBIDDEN_AGE = ["age", "-", "encryption"].join("");
/** Forbidden external vault driver id, split so this file does not match itself. */
const FORBIDDEN_EXT_VAULT = ["open", "bao"].join("");
/** Forbidden vault-provider alias, split so this file does not match itself. */
const FORBIDDEN_VAULT_ALIAS = ["hashi", "corp"].join("");

/** Lockfiles regenerated by `bun install` — not source residue. */
const LOCKFILE_PREFIXES = [
  "bun.lock:",
  "packages/create-oke/templates/blank/bun.lock:",
  "packages/create-oke/templates/shorter/bun.lock:",
];

/**
 * Run `git grep -F` and assert zero matches outside allow-listed prefixes.
 *
 * @param pattern - Fixed-string pattern
 * @param ignorePrefixes - `path:line:` prefixes to ignore
 */
function assertZeroGitGrep(pattern: string, ignorePrefixes: readonly string[] = []): void {
  const proc = Bun.spawnSync(["git", "grep", "-F", "-i", "-n", "-e", pattern, "--"], {
    cwd: ROOT,
    stdout: "pipe",
    stderr: "pipe",
  });
  // git grep exits 1 when there are no matches.
  if (proc.exitCode === 1) {
    expect(proc.stdout.toString()).toBe("");
    return;
  }
  const hits = proc.stdout
    .toString()
    .trim()
    .split("\n")
    .filter((line) => line.length > 0)
    .filter((line) => !ignorePrefixes.some((prefix) => line.startsWith(prefix)));
  expect(hits.join("\n")).toBe("");
}

describe("removed vault driver gate", () => {
  test("tracked tree has zero matches for the removed driver id", () => {
    assertZeroGitGrep(FORBIDDEN_DRIVER);
  });

  test("tracked tree has zero matches for the removed secrets-saas driver id", () => {
    assertZeroGitGrep(FORBIDDEN_SECRETS_SAAS, ["changelog.md:"]);
  });

  test("tracked tree has zero matches for the removed age peer outside lockfiles", () => {
    assertZeroGitGrep(FORBIDDEN_AGE, LOCKFILE_PREFIXES);
  });

  test("tracked tree has zero matches for the removed external vault driver", () => {
    // Community-plugin notes in changelog / site docs may mention the name.
    assertZeroGitGrep(FORBIDDEN_EXT_VAULT, ["changelog.md:", "site/content/docs/"]);
  });

  test("tracked tree has zero matches for the removed vault alias outside docs notes", () => {
    assertZeroGitGrep(FORBIDDEN_VAULT_ALIAS, ["changelog.md:", "site/content/docs/"]);
  });
});