package validation

import (
	"context"
	"os"
	"path/filepath"
	"strings"
	"testing"
)

func TestForbiddenFilesUsesCapturedRepositoryPaths(t *testing.T) {
	repository := newTreeRepository(t)
	writeTreeFile(t, repository, "go.mod", []byte("module example.com/root\n"))
	writeTreeFile(t, repository, "nested/go.mod", []byte("module example.com/nested\n"))
	writeTreeFile(t, repository, "nested/token", []byte("fixture-secret\n"))
	writeTreeFile(t, repository, ".gitignore", []byte(".releasekit/\n"))
	gitTree(t, repository, "add", ".")
	gitTree(t, repository, "commit", "-m", "capture a committed credential path")
	commit := strings.TrimSpace(gitTree(t, repository, "rev-parse", "HEAD"))
	writeTreeFile(t, repository, ".releasekit/token", []byte("local-secret\n"))
	if err := os.Remove(filepath.Join(repository, "nested/token")); err != nil {
		t.Fatal(err)
	}

	installGoShim(t, "", false)
	request := Request{RepositoryDir: repository, Commit: commit}
	if err := Run(context.Background(), request); err != nil {
		t.Fatal(err)
	}
	request.Settings.ForbiddenFiles = []string{".releasekit/token", "absent-token"}
	if err := Run(context.Background(), request); err != nil {
		t.Fatal(err)
	}
	request.Settings.ForbiddenFiles = []string{"nested/./token"}
	err := Run(context.Background(), request)
	failure, ok := err.(*Failure)
	if !ok || failure.Check != ForbiddenFiles || len(failure.Findings) != 1 || failure.Findings[0].Path != "nested/token" {
		t.Fatalf("forbidden-files error = %v, want committed nested path despite worktree deletion", err)
	}
	if strings.Contains(err.Error(), "fixture-secret") {
		t.Fatal("validation exposed committed token bytes")
	}
	for _, invalid := range []string{"", "../token", "/token"} {
		request.Settings.ForbiddenFiles = []string{invalid}
		if err := Run(context.Background(), request); err == nil {
			t.Fatalf("invalid path %q was accepted", invalid)
		}
	}
}