import { describe, it, expect } from 'vitest';
import { checkConsoleInput } from './console-deny-check.js';

describe('checkConsoleInput', () => {
  it('allows empty input', () => {
    const r = checkConsoleInput('', [], []);
    expect(r.ok).toBe(true);
  });

  it('allows safe single command', () => {
    const r = checkConsoleInput('uptime\n', [], []);
    expect(r.ok).toBe(true);
  });

  it('rejects on builtin deny (rm -rf /)', () => {
    const r = checkConsoleInput('rm -rf /\n', [], []);
    expect(r.ok).toBe(false);
    if (!r.ok) {
      expect(r.lineIndex).toBe(0);
      expect(r.reason).toBe('builtin_deny');
    }
  });

  it('rejects multi-line input where ANY line fails', () => {
    const r = checkConsoleInput('uptime\nrm -rf /\nls\n', [], []);
    expect(r.ok).toBe(false);
    if (!r.ok) expect(r.lineIndex).toBe(1);
  });

  it('respects custom deny pattern from connection', () => {
    // Use a command NOT caught by builtin deny (e.g., reboot is built-in)
    // so we exercise the custom_deny code path specifically.
    const r = checkConsoleInput('npm publish\n', ['^npm\\s+publish'], []);
    expect(r.ok).toBe(false);
    if (!r.ok) expect(r.reason).toBe('custom_deny');
  });

  it('respects custom allow override', () => {
    const r = checkConsoleInput('rm -rf /tmp/foo\n', [], ['^rm -rf /tmp/']);
    expect(r.ok).toBe(true);
  });

  it('skips empty lines', () => {
    const r = checkConsoleInput('\n\n\n', [], []);
    expect(r.ok).toBe(true);
  });
});
