import { evaluateGitShellPolicy } from "@rakazo/core";
import { describe, expect, it, vi } from "vitest";
import { githubIntegrationEnvironmentForRun } from "./deployment-github-token.js";

describe("home Chief GitHub broker integration", () => {
  it("exposes broker env without raw GitHub tokens when integration is set", () => {
    vi.stubEnv("SANDBOX_SUPERVISOR_TOKEN", "test-supervisor-token-test-32chars");
    vi.stubEnv("SANDBOX_GITHUB_BROKER_URL", "http://supervisor:7091/internal/github-broker");
    const env = githubIntegrationEnvironmentForRun({
      runId: "run-home",
      githubToken: "ghp_integration_only",
    });
    expect(env.GITHUB_TOKEN).toBeUndefined();
    expect(env.GH_TOKEN).toBeUndefined();
    expect(env.RAKAZO_GITHUB_BROKER_RUN_TOKEN).toMatch(/^rgb1\./);
    vi.unstubAllEnvs();
  });

  it("refuses push to the default branch even when approval was granted", () => {
    const decision = evaluateGitShellPolicy({
      command: "git push origin main",
      defaultBranch: "main",
      gitPushApprovedThisRun: true,
    });
    expect(decision.action).toBe("block");
  });

  it("requires approval before the first push in a run", () => {
    const decision = evaluateGitShellPolicy({
      command: "git push origin feature/login",
      defaultBranch: "main",
      gitPushApprovedThisRun: false,
    });
    expect(decision.action).toBe("require_approval");
  });
});