#!/usr/bin/env bats
#
# Tests for languages/typescript/githooks/pre-commit — the secret scan plus
# syntax/lint gate that runs on staged TS/JS files.
#
# The secret scan is the security-critical half and is language-independent, so
# it gets the same coverage here as in the bash bundle: a real key blocks, a
# clean diff passes, and the case-sensitivity split that keeps base64 blobs from
# false-positiving is exercised directly.
#
# Each test builds a throwaway git repo, stages content, and runs the hook from
# inside it — the hook reads `git diff --cached`, so a real index is required.

HOOK="$(cd "$(dirname "$BATS_TEST_FILENAME")/.." && pwd)/githooks/pre-commit"

setup() {
  TEST_DIR="$(mktemp -d -t pre-commit-ts-bats.XXXXXX)"
  cd "$TEST_DIR" || exit 1
  git init -q .
  git config user.email t@example.com
  git config user.name Test
  # A base commit so `git diff --cached` has a parent to diff against.
  echo "seed" > seed.txt
  git add seed.txt
  git commit -qm seed
}

teardown() {
  cd / || true
  rm -rf "$TEST_DIR"
}

# ---- Normal ----------------------------------------------------------

@test "pre-commit(ts): a clean staged JS file passes (exit 0)" {
  printf 'export const f = (x) => x + 1;\n' > ok.js
  git add ok.js
  run bash "$HOOK"
  [ "$status" -eq 0 ]
}

@test "pre-commit(ts): an empty staging area passes (exit 0)" {
  run bash "$HOOK"
  [ "$status" -eq 0 ]
}

# ---- Error: the secret scan ------------------------------------------

@test "pre-commit(ts): an AWS key in a staged file blocks (exit 1)" {
  printf 'const KEY = "AKIAIOSFODNN7EXAMPLE";\n' > conf.ts
  git add conf.ts
  run bash "$HOOK"
  [ "$status" -eq 1 ]
  [[ "$output" == *"potential secret"* ]]
}

@test "pre-commit(ts): an sk- style token blocks (exit 1)" {
  printf 'const TOKEN = "sk-abcdefghijklmnopqrstuvwxyz0123";\n' > conf.ts
  git add conf.ts
  run bash "$HOOK"
  [ "$status" -eq 1 ]
}

@test "pre-commit(ts): a quoted api_key assignment blocks (exit 1)" {
  printf 'const api_key = "abcdefghijklmnopqrstuvwxyz";\n' > conf.ts
  git add conf.ts
  run bash "$HOOK"
  [ "$status" -eq 1 ]
}

@test "pre-commit(ts): a private-key header blocks (exit 1)" {
  printf 'const PEM = "-----BEGIN RSA PRIVATE KEY-----";\n' > conf.ts
  git add conf.ts
  run bash "$HOOK"
  [ "$status" -eq 1 ]
}

# ---- Boundary: the case-sensitivity split ----------------------------

@test "pre-commit(ts): a mixed-case base64 blob does NOT false-positive" {
  # The AWS pattern is uppercase-only by design. Under -i it would match any
  # 20-char mixed-case run, which random base64 hits often enough to block
  # real commits. This is the regression test for that split.
  printf 'const BLOB = "AKIAbcdefGHIJklmnOPqr0123456789abcdefGHIJ";\n' > data.ts
  git add data.ts
  run bash "$HOOK"
  [ "$status" -eq 0 ]
}

@test "pre-commit(ts): a short quoted password value does NOT block" {
  # The keyword patterns require 16+ chars, so a placeholder stays quiet.
  printf 'const password = "short";\n' > conf.ts
  git add conf.ts
  run bash "$HOOK"
  [ "$status" -eq 0 ]
}

@test "pre-commit(ts): a secret only in a REMOVED line does not block" {
  printf 'const KEY = "AKIAIOSFODNN7EXAMPLE";\n' > conf.ts
  git add conf.ts
  git commit -qm "add key"
  rm conf.ts
  git add -A
  run bash "$HOOK"
  [ "$status" -eq 0 ]
}

# ---- Error: the syntax gate ------------------------------------------

@test "pre-commit(ts): a staged JS syntax error blocks (exit 1)" {
  command -v node >/dev/null 2>&1 || skip "node not installed"
  printf 'const x = ;\n' > bad.js
  git add bad.js
  run bash "$HOOK"
  [ "$status" -eq 1 ]
  [[ "$output" == *"syntax"* ]]
}

@test "pre-commit(ts): a staged TS syntax error blocks (exit 1)" {
  command -v tsc >/dev/null 2>&1 || skip "tsc not installed"
  printf 'export function f( {\n  return 1;\n}\n' > bad.ts
  git add bad.ts
  run bash "$HOOK"
  [ "$status" -eq 1 ]
}

@test "pre-commit(ts): valid TS-only syntax is NOT read as broken JS" {
  command -v tsc >/dev/null 2>&1 || skip "tsc not installed"
  # The regression guard for the node --check trap: `node --check` rejects
  # valid TypeScript, so using it on .ts would block every real commit.
  printf 'interface P { a: string }\nexport const p: P = { a: "x" };\n' > types.ts
  git add types.ts
  run bash "$HOOK"
  [ "$status" -eq 0 ]
}

@test "pre-commit(ts): a TYPE error that parses does not block (out of scope)" {
  command -v tsc >/dev/null 2>&1 || skip "tsc not installed"
  printf 'const n: number = "nope";\nexport { n };\n' > typeerr.ts
  git add typeerr.ts
  run bash "$HOOK"
  [ "$status" -eq 0 ]
}

@test "pre-commit(ts): a broken NON-TS/JS file does not trip the syntax gate" {
  printf 'this is (((not javascript\n' > notes.txt
  git add notes.txt
  run bash "$HOOK"
  [ "$status" -eq 0 ]
}