/**
 * @file fake-sudo.js
 * @description Test helper for the S3 suites: an `execImpl` for
 * `run-as.__setExecImpl` that plays `sudo -n -u <login> [VAR=v…] <bin> …`
 * without root — it records the argv (so a test can assert nothing secret
 * crossed sudo) and runs the real `scripts/server/write-as.sh` for
 * `/opt/agenthub/libexec/write-as`, as this account.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */

const path = require("node:path");
const { execFileSync } = require("node:child_process");

const WRITE_AS = path.join(__dirname, "..", "..", "..", "scripts", "server", "write-as.sh");

/** `{ exec, calls }`: pass `exec` to `runAs.__setExecImpl`; `calls` = every sudo argv. */
function fakeSudo() {
  const calls = [];
  const exec = (cmd, argv, opts = {}) => {
    calls.push([cmd, ...argv]);
    if (cmd !== "sudo") return execFileSync(cmd, argv, opts);
    let i = argv.indexOf("-u") + 2; // past the login
    while (/^[A-Z_][A-Z0-9_]*=/.test(argv[i])) i++;
    const [bin, ...rest] = argv.slice(i);
    if (bin === "/opt/agenthub/libexec/write-as")
      return execFileSync("sh", [WRITE_AS, ...rest], opts);
    return execFileSync(bin, rest, opts);
  };
  return { exec, calls };
}

module.exports = { fakeSudo };