import assert from "node:assert/strict";
import test from "node:test";
import {
  currentCodeChannelRepositories,
  normalizeCodeChannelRepository,
  publishLeaseResource,
} from "./code-channel-policy.mjs";

test("HTTPS, .git and repo forms resolve to one repository identity", () => {
  const expected =
    "repo://guanghulab.com/code/bingshuo/guanghu-ice-heart";
  assert.equal(
    normalizeCodeChannelRepository(
      "https://guanghulab.com/code/bingshuo/guanghu-ice-heart.git",
    ),
    expected,
  );
  assert.equal(normalizeCodeChannelRepository(expected), expected);
  assert.equal(publishLeaseResource(expected), `${expected}#main`);
});

test("only the three current repositories are allowed", () => {
  assert.equal(currentCodeChannelRepositories.length, 3);
  assert.equal(
    normalizeCodeChannelRepository(
      "https://guanghulab.com/code/bingshuo/grok-build-upstream-mirror.git",
    ),
    "repo://guanghulab.com/code/bingshuo/grok-build-upstream-mirror",
  );
  for (const invalid of [
    "https://guanghulab.com/fifth-domain/bingshuo/fifth-domain.git",
    "https://guanghubingshuo.com/code/bingshuo/guanghulab.git",
    "repo://guanghulab.com/code/bingshuo/unknown",
  ]) {
    assert.throws(() => normalizeCodeChannelRepository(invalid));
  }
});

test("credential-bearing remotes are rejected", () => {
  assert.throws(
    () =>
      normalizeCodeChannelRepository(
        "https://user:secret@guanghulab.com/code/bingshuo/guanghu-ice-heart.git",
      ),
    /CREDENTIALS_FORBIDDEN/u,
  );
});