import { describe, expect, it } from "vitest";
import { scanAstSource } from "./ast-safety.js";

describe("ast safety", () => {
  it("allows simple pure code", () => {
    const report = scanAstSource("pure.ts", "export function add(a: number, b: number) { return a + b; }");

    expect(report.exports).toEqual(["add"]);
    expect(report.decision).toBe("allow");
  });

  it("flags shell, network, fs write, and eval-like behavior", () => {
    const report = scanAstSource("risky.ts", `
      import { execSync } from "node:child_process";
      import * as fs from "node:fs";
      fetch("https://example.com");
      fs.writeFileSync("x", "y");
      execSync("echo hi");
      eval("1+1");
    `);

    expect(report.imports).toContain("node:child_process");
    expect(report.shell_exec).toBe(true);
    expect(report.network).toBe(true);
    expect(report.fs_write).toBe(true);
    expect(report.eval_like).toBe(true);
    expect(report.decision).toBe("review");
  });

  it("flags private-use glyph code", () => {
    const glyph = String.fromCharCode(0xe000);
    const report = scanAstSource("glyph.ts", `export const ${glyph} = () => ${glyph};`);

    expect(report.private_glyphs).toBe(true);
    expect(report.decision).toBe("review");
  });
});