/**
 * @file drop-caps.test.js
 * @description S3 review fix F5: with ambient capabilities (faked here), every
 * child goes through setpriv and still behaves the same — argv, shell
 * commands, sync and async forms — and a browser terminal's `tmux attach`,
 * which node-pty forks natively (outside child_process), goes through
 * setpriv too. Runs in a child node process so the patch never touches this
 * test runner's child_process.
 * @author Nguyễn Ngọc Trí Vĩ <vinnt@smartgift.vn>
 */

const { describe, it } = require("node:test");
const assert = require("node:assert/strict");
const path = require("node:path");
const { execFileSync } = require("node:child_process");

const MOD = path.join(__dirname, "..", "lib", "drop-caps.js");

describe("drop-caps", () => {
  it("reads CapAmb", () => {
    const { hasAmbientCaps } = require(MOD);
    assert.equal(hasAmbientCaps("CapAmb:\t0000000000000004\n"), true);
    assert.equal(hasAmbientCaps("CapAmb:\t0000000000000000\n"), false);
  });

  it(
    "wraps every form and keeps what each one does",
    { skip: process.platform !== "linux" },
    () => {
      const script = `
      const cp = require("node:child_process");
      const ok = require(${JSON.stringify(MOD)}).install(cp, "CapAmb:\\t0000000000000004\\n");
      const out = [ok];
      out.push(cp.execFileSync("printf", ["%s|", "a b", "$HOME"]).toString());
      out.push(cp.execSync("echo $((1+2)) | tr 3 x").toString().trim());
      out.push(cp.spawnSync("printf", ["%s", "z"]).stdout.toString());
      out.push(cp.execFileSync("printf", ["%s", "s"], { shell: true }).toString());
      cp.execFile("printf", ["%s", "async"], (e, so) => {
        out.push(so);
        cp.exec("echo shell | tr a-z A-Z", (e2, so2) => {
          out.push(so2.trim());
          process.stdout.write(JSON.stringify(out));
        });
      });`;
      const got = JSON.parse(execFileSync(process.execPath, ["-e", script]).toString());
      assert.deepEqual(got, [true, "a b|$HOME|", "x", "z", "s", "async", "SHELL"]);
    }
  );

  it(
    "starts a browser terminal's tmux attach through setpriv (node-pty bypasses child_process)",
    { skip: process.platform !== "linux" },
    () => {
      const ATTACH = path.join(__dirname, "..", "lib", "pty-attach.js");
      const TMUX = path.join(__dirname, "..", "lib", "tmux.js");
      const script = `
        const dc = require(${JSON.stringify(MOD)});
        const before = dc.ptyArgv("tmux", ["a"]);
        dc.install(require("node:child_process"), "CapAmb:\\t0000000000000004\\n");
        const tmux = require(${JSON.stringify(TMUX)});
        tmux.__setExecImpl(() => "");
        tmux.__setAccountImpl(() => null);
        const pa = require(${JSON.stringify(ATTACH)});
        let got;
        pa.__setSpawnImpl((file, args) => {
          got = [file, args];
          return { onData() {}, onExit() {}, write() {}, resize() {}, kill() {} };
        });
        pa.attach({ on() {}, send() {} }, "agenthub-lane-7", { cols: 80, rows: 24 });
        process.stdout.write(JSON.stringify({ before, got }));`;
      const { before, got } = JSON.parse(execFileSync(process.execPath, ["-e", script]).toString());
      assert.deepEqual(before, ["tmux", ["a"]]);
      assert.equal(got[0], "/usr/bin/setpriv");
      assert.deepEqual(got[1].slice(0, 3), ["--inh-caps=-all", "--ambient-caps=-all", "--"]);
      assert.deepEqual(got[1].slice(-3), ["attach-session", "-t", "=agenthub-lane-7"]);
    }
  );
});