import { describe, it } from 'node:test';
import assert from 'node:assert/strict';
import {
  parseRule,
  paramMatches,
  dominates,
  rulesIntersect,
} from '../../scanners/lib/permission-rules.mjs';

describe('permission-rules — parseRule', () => {
  it('bare tool → param null', () => {
    assert.deepEqual(parseRule('Bash'), { tool: 'Bash', param: null });
  });

  it('param-qualified tool → tool + param', () => {
    assert.deepEqual(parseRule('Bash(npm:*)'), { tool: 'Bash', param: 'npm:*' });
  });

  it('domain rule → tool + param', () => {
    assert.deepEqual(parseRule('WebFetch(domain:example.com)'), {
      tool: 'WebFetch',
      param: 'domain:example.com',
    });
  });

  it('non-string → tool null', () => {
    assert.equal(parseRule(null).tool, null);
  });
});

describe('permission-rules — paramMatches (glob)', () => {
  it('wildcard matches any suffix', () => {
    assert.equal(paramMatches('domain:*', 'domain:good.com'), true);
    assert.equal(paramMatches('npm:*', 'npm:install'), true);
  });

  it('exact literal matches', () => {
    assert.equal(paramMatches('domain:good.com', 'domain:good.com'), true);
  });

  it('distinct literals do not match', () => {
    assert.equal(paramMatches('domain:evil.com', 'domain:good.com'), false);
    assert.equal(paramMatches('model:opus', 'model:sonnet'), false);
  });

  it('literal pattern does not match a wildcard value', () => {
    assert.equal(paramMatches('domain:good.com', 'domain:*'), false);
  });
});

describe('permission-rules — dominates (deny fully covers allow → dead allow)', () => {
  it('bare deny covers any param-qualified allow', () => {
    assert.equal(dominates('Bash', 'Bash(npm:*)'), true);
  });

  it('exact param deny covers identical allow', () => {
    assert.equal(dominates('Agent(model:opus)', 'Agent(model:opus)'), true);
  });

  it('wildcard deny covers matching literal allow', () => {
    assert.equal(dominates('WebFetch(domain:*)', 'WebFetch(domain:example.com)'), true);
  });

  it('distinct param deny does NOT cover a different param allow (the false positive)', () => {
    assert.equal(dominates('Agent(model:opus)', 'Agent(model:sonnet)'), false);
    assert.equal(dominates('WebFetch(domain:evil.com)', 'WebFetch(domain:good.com)'), false);
  });

  it('specific deny does NOT cover a bare allow (sonnet still allowed)', () => {
    assert.equal(dominates('Agent(model:opus)', 'Agent'), false);
  });

  it('different tools never dominate', () => {
    assert.equal(dominates('Bash', 'Read'), false);
  });
});

describe('permission-rules — rulesIntersect (cross-scope conflict)', () => {
  it('exact same rule intersects', () => {
    assert.equal(rulesIntersect('Bash(npm run *)', 'Bash(npm run *)'), true);
  });

  it('bare tool intersects any param of same tool', () => {
    assert.equal(rulesIntersect('Bash', 'Bash(npm:*)'), true);
    assert.equal(rulesIntersect('Agent(model:opus)', 'Agent'), true);
  });

  it('wildcard intersects matching literal (currently a false negative)', () => {
    assert.equal(rulesIntersect('WebFetch(domain:*)', 'WebFetch(domain:good.com)'), true);
    assert.equal(rulesIntersect('WebFetch(domain:good.com)', 'WebFetch(domain:*)'), true);
  });

  it('distinct literal params are disjoint (no conflict)', () => {
    assert.equal(rulesIntersect('Agent(model:opus)', 'Agent(model:sonnet)'), false);
  });

  it('different tools never intersect', () => {
    assert.equal(rulesIntersect('Read', 'Write'), false);
  });
});