package artifacts

import (
	"os"
	"path/filepath"
	"testing"
)

func TestEnsureLayoutForRejectsUnsafeIdentityBeforeFilesystemAccess(t *testing.T) {
	workspace := t.TempDir()
	store := NewLocalStore(workspace)
	for _, identity := range []struct {
		name     string
		campaign string
		session  string
	}{
		{name: "campaign traversal", campaign: "../outside", session: "session"},
		{name: "session separator", campaign: "campaign", session: `session\other`},
		{name: "session drive", campaign: "campaign", session: `C:\outside`},
		{name: "unicode", campaign: "café", session: "session"},
	} {
		t.Run(identity.name, func(t *testing.T) {
			if _, err := store.EnsureLayoutFor(identity.campaign, identity.session); err == nil {
				t.Fatal("EnsureLayoutFor() error = nil, want unsafe identity rejection")
			}
			if _, err := os.Stat(filepath.Join(workspace, "work")); !os.IsNotExist(err) {
				t.Fatalf("workspace path was created for rejected identity, stat err = %v", err)
			}
		})
	}
}

func TestSessionPreviousArtifactPathRejectsEscapingRelativePath(t *testing.T) {
	paths := buildSessionPaths(t.TempDir(), "campaign", "session")
	for _, relative := range []string{"../escape.json", "/absolute.json", `C:\escape.json`} {
		if _, err := SessionPreviousArtifactPath(paths, relative); err == nil {
			t.Fatalf("SessionPreviousArtifactPath(%q) error = nil, want confinement failure", relative)
		}
	}
}