import fs from "node:fs/promises";
import path from "node:path";
import { describe, expect, it } from "vitest";
import { resolveStateDir } from "../config/paths.js";
import { assertLocalMediaAllowed, LocalMediaAccessError } from "./local-media-access.js";

describe("assertLocalMediaAllowed", () => {
  it("allows managed inbound media paths before explicit root checks", async () => {
    const stateDir = resolveStateDir();
    const id = `managed-local-${Date.now()}-${Math.random().toString(36).slice(2)}.png`;
    const filePath = path.join(stateDir, "media", "inbound", id);
    await fs.mkdir(path.dirname(filePath), { recursive: true });
    await fs.writeFile(filePath, Buffer.from("png"));

    try {
      await expect(assertLocalMediaAllowed(filePath, [])).resolves.toBeUndefined();
    } finally {
      await fs.rm(filePath, { force: true });
    }
  });

  it("does not allow nested inbound paths as managed media", async () => {
    const stateDir = resolveStateDir();
    const filePath = path.join(stateDir, "media", "inbound", "nested", "hidden.png");
    await fs.mkdir(path.dirname(filePath), { recursive: true });
    await fs.writeFile(filePath, Buffer.from("png"));

    try {
      let accessError: unknown;
      try {
        await assertLocalMediaAllowed(filePath, []);
      } catch (error) {
        accessError = error;
      }
      expect(accessError).toBeInstanceOf(LocalMediaAccessError);
      if (!(accessError instanceof LocalMediaAccessError)) {
        throw new Error("expected LocalMediaAccessError");
      }
      expect(accessError.name).toBe("LocalMediaAccessError");
      expect(accessError.code).toBe("path-not-allowed");
      expect(accessError.message).toBe(
        `Local media path is not under an allowed directory: ${filePath}`,
      );
    } finally {
      await fs.rm(path.dirname(filePath), { recursive: true, force: true });
    }
  });
});
