#!/usr/bin/env bats

setup() {
    REPO_ROOT="$(cd "$BATS_TEST_DIRNAME/../../../../../" && pwd)"
    load "$REPO_ROOT/tests/test_helper/bats-support/load"
    load "$REPO_ROOT/tests/test_helper/bats-assert/load"

    SCRIPT="$(cd "$BATS_TEST_DIRNAME/../scripts" && pwd)/validate-secrets.sh"
    TMPDIR="$(mktemp -d)"
}

teardown() {
    rm -rf "$TMPDIR"
}

@test "passes on AGENTS.md with no secrets, only placeholders" {
    cat > "$TMPDIR/AGENTS.md" <<'EOF'
# AGENTS.md

## Setup
- Set `export API_KEY=$API_KEY`
- Token: <your-token-here>
- DB: postgres://user:changeme@localhost/db
EOF
    run bash "$SCRIPT" "$TMPDIR"
    assert_success
    assert_output ""
}

@test "fails on a real-looking AWS access key" {
    cat > "$TMPDIR/AGENTS.md" <<'EOF'
# AGENTS.md

## Setup
- AWS_ACCESS_KEY_ID=AKIAABCDEFGHIJKLMNOP # gitleaks:allow (synthetic fixture — this test verifies validate-secrets.sh catches exactly this pattern)
EOF
    run bash "$SCRIPT" "$TMPDIR"
    assert_failure
    assert_output --partial "AWS access key ID"
    assert_output --partial "AGENTS.md:4"
}

@test "fails on a credential-bearing connection string" {
    cat > "$TMPDIR/AGENTS.md" <<'EOF'
# AGENTS.md

## Setup
- DB: postgres://svc_user:h8x2Klm9pQrT@db.internal:5432/prod
EOF
    run bash "$SCRIPT" "$TMPDIR"
    assert_failure
    assert_output --partial "connection string"
}

@test "detects secrets in a nested AGENTS.md, not just root" {
    mkdir -p "$TMPDIR/packages/api"
    cat > "$TMPDIR/AGENTS.md" <<'EOF'
# AGENTS.md
Clean root file.
EOF
    cat > "$TMPDIR/packages/api/AGENTS.md" <<'EOF'
# API package
- token: ghp_1234567890abcdefghijklmnopqrstuvwxyz01 # gitleaks:allow (synthetic fixture)
EOF
    run bash "$SCRIPT" "$TMPDIR"
    assert_failure
    assert_output --partial "packages/api/AGENTS.md"
}