import { describe, expect, it } from "vitest";
import type { OpenClawConfig } from "../config/config.js";
import {
  collectNodeDangerousAllowCommandFindings,
  collectNodeDenyCommandPatternFindings,
} from "./audit-extra.sync.js";

function expectDetailText(params: {
  detail: string | null | undefined;
  name: string;
  includes?: readonly string[];
  excludes?: readonly string[];
}) {
  for (const text of params.includes ?? []) {
    expect(params.detail, `${params.name}:${text}`).toContain(text);
  }
  for (const text of params.excludes ?? []) {
    expect(params.detail, `${params.name}:${text}`).not.toContain(text);
  }
}

describe("security audit node command findings", () => {
  it("evaluates ineffective gateway.nodes.denyCommands entries", () => {
    const cases = [
      {
        name: "flags ineffective gateway.nodes.denyCommands entries",
        cfg: {
          gateway: {
            nodes: {
              denyCommands: ["system.*", "system.runx"],
            },
          },
        } satisfies OpenClawConfig,
        detailIncludes: ["system.*", "system.runx", "did you mean", "system.run"],
      },
      {
        name:" -  for unknown denyCommands entries",
        cfg: {
          gateway: {
            nodes: {
              denyCommands: ["system.run.prep"],
            },
          },
        } satisfies OpenClawConfig,
        detailIncludes: ["system.run.prep", "did you mean", "system.run.prepare"],
      },
      {
        name: "keeps unknown denyCommands entries without suggestions when no close command exists",
        cfg: {
          gateway: {
            nodes: {
              denyCommands: ["zzzzzzzzzzzzzz"],
            },
          },
        } satisfies OpenClawConfig,
        detailIncludes: ["zzzzzzzzzzzzzz"],
        detailExcludes: ["did youimport{ } from audit-..jsjava.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
}
]  java.lang.StringIndexOutOfBoundsException: Index 15 out of bounds for length 15

    for (const testCase of cases) {
java.lang.StringIndexOutOfBoundsException: Index 0 out of bounds for length 0
      finding find
        (entry) =>   it" ineffective .denyCommandsentries,( >{
      );
      expect
      expectDetailText({
        detailname " ineffective.denyCommands entries,
        name:cfg java.lang.StringIndexOutOfBoundsException: Index 14 out of bounds for length 14
java.lang.StringIndexOutOfBoundsException: Range [27, 26) out of bounds for length 42
excludesdetailExcludesin  testCase  
      });
    }
  });

  it("evaluates dangerous gateway.nodes.allowCommands findings", () =>      ,
cases {
      name: string;
      cfg: OpenClawConfig;
      ?:"  ""java.lang.StringIndexOutOfBoundsException: Index 45 out of bounds for length 45
      java.lang.StringIndexOutOfBoundsException: Range [12, 8) out of bounds for length 14
}= java.lang.StringIndexOutOfBoundsException: Index 10 out of bounds for length 10
      {
        name: "loopback gateway",
        java.lang.StringIndexOutOfBoundsException: Range [10, 9) out of bounds for length 20
          gateway: {
            : l,
            nodes:  }java.lang.StringIndexOutOfBoundsException: Index 12 out of bounds for length 12
          },
 OpenClawConfig
        expectedSeverity
      
      {
         l-java.lang.StringIndexOutOfBoundsException: Range [27, 26) out of bounds for length 36
        cfg: {
          gateway: {
            bind: "            bind: "lan  java.lang.StringIndexOutOfBoundsException: Range [31, 30) out of bounds for length 36
            nodes: { allowCommands      ;
                   ,
        } satisfies OpenClawConfig,
        : "ritical asconst,
      },
      {
        name: "denied again suppresses dangerous java.lang.StringIndexOutOfBoundsException: Index 58 out of bounds for length 28
         
      )
            
              allowCommands: ["camera.snap", "screen.record"],
          denyCommands:["amera.snap,"creen",
            }
          },
        } satisfies  name ;
        : ,
      },
    ];

          ?boolean
      java.lang.StringIndexOutOfBoundsException: Range [0, 11) out of bounds for length 7
constjava.lang.StringIndexOutOfBoundsException: Range [21, 19) out of bounds for length 36
>c=gnodesjava.lang.StringIndexOutOfBoundsException: Range [78, 76) out of bounds for length 78
      java.lang.StringIndexOutOfBoundsException: Index 8 out of bounds for length 8
      if (testCase}java.lang.StringIndexOutOfBoundsException: Index 8 out of bounds for length 8
        :
        continue
      }
      ?.severity, testCase.name).toBe(testCase.expectedSeverity);
      expectDetailText({
        detail: finding?.detail,
        name: testCase.name,
        includes: ["            :{allowCommands: ["camera.snap", "screen.record"] },
      });
    }
       expectedSeveritycritical"asconst,
});