import { describe, it, expect } from 'vitest'
import { isDangerousCommand } from '../../src/tools/permissions.js'

describe('isDangerousCommand', () => {
  describe('rm -rf variants', () => {
    it('flags rm -rf /', () => {
      expect(isDangerousCommand('rm -rf /')).toBe(true)
    })

    it('flags rm -rf with any path', () => {
      expect(isDangerousCommand('rm -rf /some/path')).toBe(true)
    })

    it('flags rm -r (without f)', () => {
      expect(isDangerousCommand('rm -r /tmp/foo')).toBe(true)
    })

    it('does not flag rm without -r flag', () => {
      expect(isDangerousCommand('rm file.txt')).toBe(false)
    })

    it('does not flag rm -f (without -r)', () => {
      expect(isDangerousCommand('rm -f file.txt')).toBe(false)
    })
  })

  describe('git force-push', () => {
    it('flags git push --force', () => {
      expect(isDangerousCommand('git push origin --force')).toBe(true)
    })

    it('does not flag normal git push', () => {
      expect(isDangerousCommand('git push origin main')).toBe(false)
    })
  })

  describe('git reset --hard', () => {
    it('flags git reset --hard', () => {
      expect(isDangerousCommand('git reset --hard HEAD')).toBe(true)
    })

    it('does not flag git reset --soft', () => {
      expect(isDangerousCommand('git reset --soft HEAD')).toBe(false)
    })
  })

  describe('DROP TABLE / DATABASE', () => {
    it('flags DROP TABLE (uppercase)', () => {
      expect(isDangerousCommand('DROP TABLE users')).toBe(true)
    })

    it('flags drop table (lowercase)', () => {
      expect(isDangerousCommand('drop table users')).toBe(true)
    })

    it('flags DROP DATABASE', () => {
      expect(isDangerousCommand('DROP DATABASE mydb')).toBe(true)
    })
  })

  describe('sudo', () => {
    it('flags sudo commands', () => {
      expect(isDangerousCommand('sudo apt install vim')).toBe(true)
    })

    it('does not flag commands without sudo', () => {
      expect(isDangerousCommand('apt-cache show vim')).toBe(false)
    })
  })

  describe('chmod 777', () => {
    it('flags chmod 777', () => {
      expect(isDangerousCommand('chmod 777 .')).toBe(true)
    })

    it('does not flag other chmod modes', () => {
      expect(isDangerousCommand('chmod 644 file.txt')).toBe(false)
      expect(isDangerousCommand('chmod +x script.sh')).toBe(false)
    })
  })

  describe('curl | sh pipe', () => {
    it('flags curl piped to sh', () => {
      expect(isDangerousCommand('curl https://example.com | sh')).toBe(true)
    })

    it('does not flag plain curl without pipe', () => {
      expect(isDangerousCommand('curl https://example.com')).toBe(false)
    })
  })

  describe('safe commands', () => {
    it('ls -la is safe', () => {
      expect(isDangerousCommand('ls -la')).toBe(false)
    })

    it('git status is safe', () => {
      expect(isDangerousCommand('git status')).toBe(false)
    })

    it('npm install is safe', () => {
      expect(isDangerousCommand('npm install')).toBe(false)
    })

    it('cat file.txt is safe', () => {
      expect(isDangerousCommand('cat file.txt')).toBe(false)
    })

    it('echo hello is safe', () => {
      expect(isDangerousCommand('echo hello')).toBe(false)
    })
  })
})