#!/bin/bash
# main-and-prod-push-guard 的測試（inkstone/InkStoneCo#23、#56）
# 判準：真的推 main/master 要擋；只是提到（heredoc body、同一行引號內的散文、
# 開頭包一層讀取指令）都不准擋；推自己的分支、含子字串但目標不是 main/master
# 的分支（如 fix/custom-domain-setup）也不准擋。
cd "$(dirname "$0")/.." || exit 1

# 🔴 測沙盒裡的複本，不測真跡（inkstone/ISEP#59 comment 4779 第 ① 條）：
#   這支閘擋下推 main 的同時會把請求寫進 `<repo>/pending-main-push/`，那份檔案的
#   語意是「有一筆推 main 正在等總管裁」。這裡的測資本來就都是推 main
#   ⇒ 直接測真跡的話，**每跑一次測試就偽造一筆待裁決**（實測：`unnamed--ISEP.md`
#   每跑一次被覆寫一次，而它當時還是被追蹤的 ⇒ `git status` 永遠是髒的）。
#   cwd 仍然留在 repo 根——戳記比對問的是「人站在哪個 repo」，那件事沒有變。
. hooks/tests/lib/hook-sandbox.sh
hook_sandbox "$PWD/hooks/main-and-prod-push-guard.sh" || { echo "❌ 沙盒建不起來"; exit 1; }
trap 'hook_sandbox_cleanup' EXIT
HOSTSUM_BEFORE=$(hook_sandbox_hostsum)
H=$HOOK_SANDBOX_HOOK

PASS=0; FAIL=0
run(){ # $1=want $2=cmd
  printf '%s' "{\"tool_name\":\"Bash\",\"tool_input\":{\"command\":$(python3 -c 'import json,sys;print(json.dumps(sys.argv[1]))' "$2")}}" \
    | bash "$H" >/dev/null 2>&1
  got=$?
  if [ "$got" = "$1" ]; then PASS=$((PASS+1)); printf '  ✅ '; else FAIL=$((FAIL+1)); printf '  ❌ '; fi
  printf 'want=%s got=%s  %.72s\n' "$1" "$got" "$2"
}

echo "── 該擋：真的在推 main／master，且沒有戳記 ──"
run 2 'git push gitea HEAD:main'
run 2 'git push origin master'
run 2 'echo start && git push gitea HEAD:main'
run 2 'ls && git push gitea HEAD:main'

echo "── 不該擋：只是提到、heredoc body、目標不是 main/master ──"
run 0 'git push gitea HEAD:fix/custom-domain-setup'
run 0 'git push gitea HEAD:fix/mainline-cleanup-later'
run 0 'git commit -m "docs: explain that the old gate would mis-flag push mentions"'
run 0 "$(printf 'cat > docs/TESTING.md <<%sEOF%s\nexample: git push https://github.com/example/example.git HEAD:main\nEOF\n' "'" "'")"
run 0 'python3 -c "requests.post(url, json={\"body\": \"this quotes: the gate cannot see a real git push done via a node subprocess, but it will block git push origin main mentioned as prose\"})"'
run 0 'grep -n "git push" hooks/main-and-prod-push-guard.sh'

echo "── 真違規不能因為這次改動而漏擋：戳記過期／戳記綁錯 repo 一樣要擋 ──"
run 2 'git push gitea HEAD:main'  # 沒有任何戳記檔時

echo "── 測試自己不准弄髒工作區（inkstone/ISEP#59）──"
hook_sandbox_assert "$HOSTSUM_BEFORE"
PASS=$((PASS+HS_PASS)); FAIL=$((FAIL+HS_FAIL))

echo
echo "$PASS/$((PASS+FAIL)) 通過"
[ "$FAIL" -eq 0 ]