import assert from "node:assert/strict";
import test from "node:test";
import { mkdtemp, mkdir, rm, symlink, writeFile } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { secureExistingPath, secureFuturePath } from "../src/paths";

test("canonical path guard rejects traversal and symlink escapes", async () => {
  const parent = await mkdtemp(join(tmpdir(), "pom-paths-"));
  const root = join(parent, "project");
  const outside = join(parent, "outside.txt");
  await mkdir(root);
  await writeFile(join(root, "inside.txt"), "safe");
  await writeFile(outside, "secret");
  await symlink(outside, join(root, "escape.txt"));
  try {
    assert.equal(await secureExistingPath(root, "inside.txt"), join(root, "inside.txt"));
    await assert.rejects(secureExistingPath(root, "../outside.txt"), /escapes project root/);
    await assert.rejects(secureExistingPath(root, "escape.txt"), /Symbolic links/);
    await assert.rejects(secureFuturePath(root, "../future.txt"), /escapes project root/);
  } finally {
    await rm(parent, { recursive: true, force: true });
  }
});