#!/bin/bash
# github-contact-guard 的測試（inkstone/InkStoneCo#23）
# 判準：真的寫 GitHub（gh CLI 高頻 API、git push/remote add 指向 github.com）要擋；
# 只是提到（heredoc body、同一行引號內的散文、commit message）不准擋；
# 讀取（clone/fetch/pull/curl 抓檔）一律放行，不管有沒有帶認證。
cd "$(dirname "$0")/.." || exit 1
H=hooks/github-contact-guard.sh
PASS=0; FAIL=0
run(){ # $1=want $2=cmd
  printf '%s' "{\"tool_name\":\"Bash\",\"tool_input\":{\"command\":$(python3 -c 'import json,sys;print(json.dumps(sys.argv[1]))' "$2")}}" \
    | bash "$H" >/dev/null 2>&1
  got=$?
  if [ "$got" = "$1" ]; then PASS=$((PASS+1)); printf '  ✅ '; else FAIL=$((FAIL+1)); printf '  ❌ '; fi
  printf 'want=%s got=%s  %.72s\n' "$1" "$got" "$2"
}

echo "── 該擋：真的在寫 GitHub ──"
run 2 'gh issue create --title x --body y'
run 2 'gh pr create --title x'
run 2 'git push https://github.com/example/example.git HEAD:main'
run 2 'git remote add github https://github.com/example/example.git'
run 2 'echo start && gh api repos/example/example/issues'

echo "── 不該擋：讀取一律放行 ──"
run 0 'git clone https://github.com/example/example.git'
run 0 'git fetch github'
run 0 'curl -sL https://github.com/example/example/releases/latest'
run 0 'gh --version'

echo "── 不該擋：只是提到、heredoc body、同一行引號內的散文 ──"
run 0 "$(printf 'cat > docs/TESTING.md <<%sEOF%s\nexample: git push https://github.com/example/example.git HEAD:main\nEOF\n' "'" "'")"
run 0 'git commit -m "docs: explain why gh api calls used to be mis-flagged"'
run 0 'python3 -c "requests.post(url, json={\"body\": \"quoting: git push origin main to github.com was mis-flagged as a real push\"})"'
run 0 'grep -n "gh api" hooks/github-contact-guard.sh'
run 0 'grep -rn "git push" installer/scripts/line-source-repo.mjs'

echo
echo "$PASS/$((PASS+FAIL)) 通過"
[ "$FAIL" -eq 0 ]