/**
 * Unit tests for check-audit.mjs filter logic.
 *
 * Tests the four behavioral cases without spawning pnpm:
 *  1. Unwaived High advisory → blocking (filter returns it)
 *  2. Waived High advisory (GHSA in allowlist) → not blocking
 *  3. Only moderate/low advisories → not blocking (advisory-only)
 *  4. No advisories → not blocking
 */

import assert from 'node:assert/strict';
import { test } from 'node:test';
import { selectBlocking, partitionAdvisories, isWaived } from '../check-audit.mjs';

// Fixture: a High advisory not in the allowlist
const highUnwaived = {
  '1': {
    severity: 'high',
    github_advisory_id: 'GHSA-test-unwaived-high',
    module_name: 'some-package',
    title: 'Some high vulnerability',
  },
};

// Fixture: a High advisory that IS in the allowlist
const highWaived = {
  '2': {
    severity: 'high',
    github_advisory_id: 'GHSA-gv7w-rqvm-qjhr',
    module_name: 'esbuild',
    title: 'esbuild integrity-check advisory',
  },
};

// Fixture: only moderate/low advisories
const moderateLow = {
  '3': {
    severity: 'moderate',
    github_advisory_id: 'GHSA-mod-erate-test',
    module_name: 'another-package',
    title: 'Moderate vulnerability',
  },
  '4': {
    severity: 'low',
    github_advisory_id: 'GHSA-low-test-only',
    module_name: 'yet-another',
    title: 'Low vulnerability',
  },
};

// Fixture: allowlist with the esbuild waiver
const allowlist = {
  'GHSA-gv7w-rqvm-qjhr': {
    reason: 'esbuild dev transitive — not in production runtime',
    reviewer: 'luc',
    expires: '2026-09-01',
  },
};

const emptyAllowlist = {};

// Fixture: allowlist whose esbuild waiver has already expired (CR-01).
const expiredAllowlist = {
  'GHSA-gv7w-rqvm-qjhr': {
    reason: 'esbuild dev transitive — not in production runtime',
    reviewer: 'luc',
    expires: '2000-01-01',
  },
};

// Fixture: allowlist with no expiry field (waives indefinitely).
const noExpiryAllowlist = {
  'GHSA-gv7w-rqvm-qjhr': {
    reason: 'esbuild dev transitive — not in production runtime',
    reviewer: 'luc',
  },
};

// Fixture: allowlist whose expiry date is malformed (typo). Must fail CLOSED —
// a bad date can never grant an indefinite waiver.
const malformedExpiryAllowlist = {
  'GHSA-gv7w-rqvm-qjhr': {
    reason: 'esbuild dev transitive — not in production runtime',
    reviewer: 'luc',
    expires: '2026-13-99',
  },
};

test('unwaived High advisory is blocking', () => {
  const blocking = selectBlocking(highUnwaived, emptyAllowlist);
  assert.equal(blocking.length, 1);
  assert.equal(blocking[0].github_advisory_id, 'GHSA-test-unwaived-high');
});

test('waived High advisory is NOT blocking', () => {
  const blocking = selectBlocking(highWaived, allowlist);
  assert.equal(blocking.length, 0);
});

test('only moderate/low advisories → not blocking', () => {
  const blocking = selectBlocking(moderateLow, emptyAllowlist);
  assert.equal(blocking.length, 0);
});

test('no advisories → not blocking', () => {
  const blocking = selectBlocking({}, emptyAllowlist);
  assert.equal(blocking.length, 0);
});

test('partitionAdvisories splits blocking and advisory correctly', () => {
  const mixed = { ...highUnwaived, ...moderateLow };
  const { blocking, advisory } = partitionAdvisories(mixed, emptyAllowlist);
  assert.equal(blocking.length, 1);
  assert.equal(advisory.length, 2);
});

test('expired waiver is treated as absent — High advisory re-blocks (selectBlocking)', () => {
  const blocking = selectBlocking(highWaived, expiredAllowlist);
  assert.equal(blocking.length, 1);
  assert.equal(blocking[0].github_advisory_id, 'GHSA-gv7w-rqvm-qjhr');
});

test('expired waiver is treated as absent — High advisory re-blocks (partitionAdvisories)', () => {
  const { blocking, advisory } = partitionAdvisories(highWaived, expiredAllowlist);
  assert.equal(blocking.length, 1);
  assert.equal(advisory.length, 0);
  assert.equal(blocking[0].github_advisory_id, 'GHSA-gv7w-rqvm-qjhr');
});

test('isWaived: future expiry waives, past expiry does not, missing entry does not', () => {
  const adv = { severity: 'high', github_advisory_id: 'GHSA-gv7w-rqvm-qjhr' };
  assert.equal(isWaived(adv, allowlist), true); // future expiry (2026-09-01)
  assert.equal(isWaived(adv, expiredAllowlist), false); // past expiry
  assert.equal(isWaived(adv, noExpiryAllowlist), true); // no expiry → indefinite waive
  assert.equal(isWaived(adv, emptyAllowlist), false); // not listed
  assert.equal(isWaived(adv, malformedExpiryAllowlist), false); // unparseable expiry → fail closed
});

test('malformed expiry fails closed — High advisory re-blocks', () => {
  const blocking = selectBlocking(highWaived, malformedExpiryAllowlist);
  assert.equal(blocking.length, 1);
  assert.equal(blocking[0].github_advisory_id, 'GHSA-gv7w-rqvm-qjhr');
});