import { describe, expect, it } from "vitest";
import {
  assertNoDevBypassInProduction,
  getDevBypassViolations,
  isE2eBypassActive,
} from "../runtime-security.js";

describe("runtime-security — dev-bypass fail-fast", () => {
  it("returns no violations when E2E_TEST_MODE unset", () => {
    expect(getDevBypassViolations({ NODE_ENV: "production" })).toEqual([]);
  });

  it("returns no violations in non-production env even with E2E_TEST_MODE=true", () => {
    expect(getDevBypassViolations({ NODE_ENV: "development", E2E_TEST_MODE: "true" })).toEqual([]);
  });

  it("flags a violation for E2E_TEST_MODE=true + NODE_ENV=production", () => {
    const violations = getDevBypassViolations({
      NODE_ENV: "production",
      E2E_TEST_MODE: "true",
    });
    expect(violations.length).toBe(1);
    expect(violations[0]).toMatch(/E2E_TEST_MODE/);
  });

  it("assertNoDevBypassInProduction throws on prod+E2E", () => {
    expect(() =>
      assertNoDevBypassInProduction({ NODE_ENV: "production", E2E_TEST_MODE: "true" }),
    ).toThrow(/E2E_TEST_MODE/);
  });

  it("assertNoDevBypassInProduction is a no-op when E2E disabled in prod", () => {
    expect(() => assertNoDevBypassInProduction({ NODE_ENV: "production" })).not.toThrow();
  });

  it("isE2eBypassActive only true in non-production", () => {
    expect(isE2eBypassActive({ NODE_ENV: "development", E2E_TEST_MODE: "true" })).toBe(true);
    expect(isE2eBypassActive({ NODE_ENV: "production", E2E_TEST_MODE: "true" })).toBe(false);
    expect(isE2eBypassActive({ NODE_ENV: "development" })).toBe(false);
  });
});
