import assert from 'node:assert/strict';
import fs from 'node:fs';
import os from 'node:os';
import path from 'node:path';
import { spawnSync } from 'node:child_process';

const repoRoot = process.cwd();
const scriptPath = path.join(repoRoot, 'scripts', 'repo-security-scan.js');

function run(cwd) {
  return spawnSync(process.execPath, [scriptPath, '--json'], {
    cwd,
    encoding: 'utf8',
    env: {
      PATH: process.env.PATH || '',
      Path: process.env.Path || '',
      SystemRoot: process.env.SystemRoot || '',
      ComSpec: process.env.ComSpec || '',
      TEMP: process.env.TEMP || os.tmpdir(),
      TMP: process.env.TMP || os.tmpdir(),
    },
  });
}

const clean = run(repoRoot);
assert.equal(clean.status, 0, `current repository should pass security scan: ${clean.stdout} ${clean.stderr}`);
const cleanPayload = JSON.parse(clean.stdout);
assert.equal(cleanPayload.summary.critical, 0);
assert.equal(cleanPayload.summary.high, 0);

const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'tiku-security-scan-'));
try {
  fs.mkdirSync(path.join(tempDir, 'apps', 'taro', 'src'), { recursive: true });
  fs.writeFileSync(
    path.join(tempDir, 'apps', 'taro', 'src', 'unsafe.ts'),
    "export const headers = { 'x-user-id': '123' };\n",
    'utf8',
  );
  fs.writeFileSync(
    path.join(tempDir, 'secret.env'),
    [
      'DATABASE_URL=postgresql://postgres:real-password@db.example.com:5432/postgres',
      'SUPABASE_SERVICE_ROLE_KEY=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.fake-service-role-token-that-should-not-ship',
      '',
    ].join('\n'),
    'utf8',
  );

  const unsafe = run(tempDir);
  assert.notEqual(unsafe.status, 0, 'unsafe fixture should fail security scan');
  const payload = JSON.parse(unsafe.stdout);
  assert.ok(payload.findings.some(item => item.id === 'frontend-legacy-user-header'), 'x-user-id should be detected');
  assert.ok(payload.findings.some(item => item.id === 'postgres-url'), 'database URL should be detected');
  assert.ok(payload.findings.some(item => item.id === 'supabase-service-role'), 'service role key should be detected');
} finally {
  fs.rmSync(tempDir, { recursive: true, force: true });
}

console.log('[PASS] repository security scan');