const path = require("node:path");
const { pathToFileURL } = require("node:url");

const ROOT_DIR = path.resolve(__dirname, "../../../..");
let scanner;

describe("current fact-source sensitive content gate", () => {
  beforeAll(async () => {
    const scriptPath = path.join(ROOT_DIR, "scripts/qa/check-sensitive-content.mjs");
    scanner = await import(pathToFileURL(scriptPath).href);
  });

  it("reports only redacted metadata for secret, account, path and infrastructure matches", () => {
    const source = [
      "SERVICE_PASSWORD=do-not-disclose-value",
      "contact=person@example.invalid",
      "phone=13800000000",
      "workspace=/home/developer/private/project",
      "server=203.0.113.10",
    ].join("\n");

    const findings = scanner.scanSensitiveText(source, "fixture.md");

    expect(findings.map((item) => item.category)).toEqual(expect.arrayContaining([
      "assigned_secret",
      "email_account",
      "phone_account",
      "personal_workspace_path",
      "public_ipv4",
    ]));
    expect(JSON.stringify(findings)).not.toMatch(/do-not-disclose|person@|13800000000|203\.0\.113\.10/);
  });

  it("allows explicit placeholders, environment interpolation and loopback addresses", () => {
    const source = [
      "SERVICE_PASSWORD=<managed-secret>",
      "DATABASE_URL=${LOCAL_DATABASE_URL}",
      "admin=<admin-email>",
      "workspace=<repo-root>/server",
      "server=127.0.0.1",
    ].join("\n");

    expect(scanner.scanSensitiveText(source, "fixture.md")).toEqual([]);
  });

  it("derives current docs from the status matrix without pulling historical issue rows", () => {
    const matrix = [
      "| ID | Contract | Type | Purpose | Status |",
      "| --- | --- | --- | --- | --- |",
      "| `CURRENT-DOC` | `docs/current.md` | fact | current | `CURRENT` |",
      "| `HISTORY-DOC` | `docs/history.md` | evidence | old | `EVIDENCE` |",
      "| `CURRENT-ISSUE` | `issues/current.csv` | `CURRENT` | issue only |",
    ].join("\n");

    expect(scanner.extractCurrentDocumentFiles(matrix)).toEqual(["docs/current.md"]);
  });

  it("includes every CURRENT docs contract in the default scan set", () => {
    const files = scanner.resolveDefaultScanFiles(ROOT_DIR);

    expect(files).toEqual(expect.arrayContaining([
      "docs/测试规约与回归门禁.md",
      "docs/需求-资产管理规约.md",
      "docs/管理员手册.md",
      "docs/员工快速上手.md",
    ]));
  });

  it("passes the registered current fact sources and deployment entrypoints", () => {
    expect(scanner.scanSensitiveContent({ rootDir: ROOT_DIR })).toMatchObject({
      status: "PASS",
      findingCount: 0,
      filesScanned: expect.any(Number),
      findings: [],
    });
  });
});