import { afterEach, describe, expect, test } from "bun:test";
import { mkdir, rm, writeFile } from "node:fs/promises";
import { join } from "node:path";
import { tmpdir } from "node:os";
import { runSecurityCommand, securityAudit, securityHeaders } from "../src/security-command.ts";

const roots: string[] = [];
afterEach(async () =>
  Promise.all(roots.splice(0).map((root) => rm(root, { recursive: true, force: true }))),
);

async function fixture(config = "export default {};"): Promise<string> {
  const root = join(tmpdir(), `wrnexus-security-${crypto.randomUUID()}`);
  roots.push(root);
  await mkdir(root, { recursive: true });
  await writeFile(join(root, "wrnexus.config.ts"), config);
  return root;
}

describe("security command", () => {
  test("audits secure framework defaults against mapped ASVS controls", async () => {
    const report = await securityAudit(await fixture());
    expect(report.passed).toBe(true);
    expect(report.version).toBe("ASVS 5.0.0");
    expect(report.checks.every((check) => check.asvs.length > 0)).toBe(true);
  });

  test("reports deliberately disabled headers", async () => {
    const report = await securityAudit(
      await fixture("export default { security: { headers: false } };"),
    );
    expect(report.passed).toBe(false);
    expect(report.checks.find((check) => check.id === "SEC-HEADERS")?.passed).toBe(false);
  });

  test("prints the effective production headers", async () => {
    const headers = await securityHeaders(await fixture());
    expect(headers["content-security-policy"]).toContain("nonce-audit-nonce");
    expect(headers["strict-transport-security"]).toContain("max-age=");
    expect(headers["x-content-type-options"]).toBe("nosniff");
  });

  test("rejects credentialed wildcard CORS and unknown commands", async () => {
    const root = await fixture(
      'export default { security: { cors: { origin: "*", credentials: true } } };',
    );
    expect((await securityAudit(root)).passed).toBe(false);
    await expect(runSecurityCommand(root, "unknown")).rejects.toThrow("WRN-SECURITY-COMMAND");
  });
});