import { describe, expect, it } from "vitest";
import { inboxPath, sanitizeName, teamDir } from "./paths";

describe("Security Audit - Path Traversal (Prevention Check)", () => {
	it("should throw an error for path traversal via teamName", () => {
		const maliciousTeamName = "../../etc";
		expect(() => teamDir(maliciousTeamName)).toThrow();
	});

	it("should throw an error for path traversal via agentName", () => {
		const teamName = "audit-team";
		const maliciousAgentName = "../../../.ssh/id_rsa";
		expect(() => inboxPath(teamName, maliciousAgentName)).toThrow();
	});

	it("should throw an error for path traversal via taskId", () => {
		const maliciousTaskId = "../../../etc/passwd";
		// We need to import readTask/updateTask or just sanitizeName directly if we want to test the logic
		// But since we already tested sanitizeName via other paths, this is just for completeness.
		expect(() => sanitizeName(maliciousTaskId)).toThrow();
	});
});

describe("Security Audit - Command Injection (Fixed)", () => {
	it("should not be vulnerable to command injection in spawn_teammate (via parameters)", () => {
		const maliciousCwd = "; rm -rf / ;";
		const name = "attacker";
		const team_name = "audit-team";
		const piBinary = "pi";
		const cmd = `PI_TEAM_NAME=${team_name} PI_AGENT_NAME=${name} ${piBinary}`;

		// Simulating what happens in spawn_teammate (extensions/index.ts)
		const itermCmd = `cd '${maliciousCwd}' && ${cmd}`;

		// The command becomes: cd '; rm -rf / ;' && PI_TEAM_NAME=audit-team PI_AGENT_NAME=attacker pi
		expect(itermCmd).toContain("cd '; rm -rf / ;' &&");
		expect(itermCmd).not.toContain("cd ; rm -rf / ; &&");
	});
});
