#!/bin/bash
# main-and-prod-push-guard 的測試（inkstone/InkStoneCo#23、#56）
# 判準：真的推 main/master 要擋；只是提到（heredoc body、同一行引號內的散文、
# 開頭包一層讀取指令）都不准擋；推自己的分支、含子字串但目標不是 main/master
# 的分支（如 fix/custom-domain-setup）也不准擋。
cd "$(dirname "$0")/.." || exit 1
H=hooks/main-and-prod-push-guard.sh
PASS=0; FAIL=0
run(){ # $1=want $2=cmd
  printf '%s' "{\"tool_name\":\"Bash\",\"tool_input\":{\"command\":$(python3 -c 'import json,sys;print(json.dumps(sys.argv[1]))' "$2")}}" \
    | bash "$H" >/dev/null 2>&1
  got=$?
  if [ "$got" = "$1" ]; then PASS=$((PASS+1)); printf '  ✅ '; else FAIL=$((FAIL+1)); printf '  ❌ '; fi
  printf 'want=%s got=%s  %.72s\n' "$1" "$got" "$2"
}

echo "── 該擋：真的在推 main／master，且沒有戳記 ──"
run 2 'git push gitea HEAD:main'
run 2 'git push origin master'
run 2 'echo start && git push gitea HEAD:main'
run 2 'ls && git push gitea HEAD:main'

echo "── 不該擋：只是提到、heredoc body、目標不是 main/master ──"
run 0 'git push gitea HEAD:fix/custom-domain-setup'
run 0 'git push gitea HEAD:fix/mainline-cleanup-later'
run 0 'git commit -m "docs: explain that the old gate would mis-flag push mentions"'
run 0 "$(printf 'cat > docs/TESTING.md <<%sEOF%s\nexample: git push https://github.com/example/example.git HEAD:main\nEOF\n' "'" "'")"
run 0 'python3 -c "requests.post(url, json={\"body\": \"this quotes: the gate cannot see a real git push done via a node subprocess, but it will block git push origin main mentioned as prose\"})"'
run 0 'grep -n "git push" hooks/main-and-prod-push-guard.sh'

echo "── 真違規不能因為這次改動而漏擋：戳記過期／戳記綁錯 repo 一樣要擋 ──"
run 2 'git push gitea HEAD:main'  # 沒有任何戳記檔時

echo
echo "$PASS/$((PASS+FAIL)) 通過"
[ "$FAIL" -eq 0 ]