package apply

// Defends novox/hq ADR 0266 §7: no archive is unpacked and no file is written into below the home of an account
// the declaration says never becomes root; a whole file there still passes.

import (
	"testing"

	"github.com/novox/mesh-host/internal/declaration"
)

func TestNothingIsUnpackedOrWrittenIntoBelowAnAgentsHome(t *testing.T) {
	was := accountsOfHomes
	accountsOfHomes = func() map[string]homeAccount {
		return map[string]homeAccount{"/home/agent": {"agent", 1001}, "/home/operator": {"operator", 1000}}
	}
	t.Cleanup(func() { accountsOfHomes = was })
	agent := []string{"/home/agent"}
	if err := refuseUnderAgentHome(&declaration.Archive{ID: "a.x", Type: declaration.TypeArchive, Path: "/home/agent/.local/x", Owner: "agent"}, agent); err == nil {
		t.Error("an archive below an agent's home is refused")
	}
	if err := refuseUnderAgentHome(&declaration.File{ID: "a.f", Type: declaration.TypeFile, Path: "/home/agent/.claude.json", Owner: "agent", Into: "json", Content: "{}"}, agent); err == nil {
		t.Error("a file written into below an agent's home is refused")
	}
	if err := refuseUnderAgentHome(&declaration.File{ID: "a.f", Type: declaration.TypeFile, Path: "/home/agent/x", Owner: "agent", Content: "x"}, agent); err != nil {
		t.Errorf("a whole file there passes: %v", err)
	}
	if err := refuseUnderAgentHome(&declaration.Archive{ID: "a.x", Type: declaration.TypeArchive, Path: "/home/operator/x", Owner: "operator"}, agent); err != nil {
		t.Errorf("an archive in a home whose account may become root is placement_guard.go's to judge, not this: %v", err)
	}
	d := parse(t, `{"declaration":1,"resources":[{"id":"c.agent","type":"user","name":"agent","root":"never"},`+
		`{"id":"c.op","type":"user","name":"operator"}]}`)
	if got := rootNeverHomes(d); len(got) != 1 || got[0] != "/home/agent" {
		t.Errorf("the agent's home is known by the user database: %v", got)
	}
}