#!/usr/bin/env bash
# tests/unit/02_config.sh -- config files, allowlists and precedence.
source "$TESTS/lib.sh"

CFG="$WORK/cfg"
REPO="$WORK/repo"
mkdir -p "$CFG" "$REPO/.ai-sandbox"
export AISB_CONFIG_DIR="$CFG"

cd "$REPO" || exit 1

t_name "allow files are merged"
cat > "$CFG/allow" <<'EOF'
# user-wide allowlist
api.openai.com

registry.npmjs.org   # trailing comment
EOF
cat > "$REPO/.ai-sandbox/allow" <<'EOF'
pypi.org
EOF
sb --print-policy --net allow
assert_rc 0 "print-policy runs"
assert_contains "api.openai.com"   "user allowlist entry present"
assert_contains "registry.npmjs.org" "user entry with trailing comment present"
assert_contains "pypi.org"          "repo allowlist entry present"

t_name "dedup"
sb --print-policy --net allow --allow pypi.org --allow pypi.org
ALLOW_LINE="$(printf '%s' "$OUT" | grep '^allow=')"
N="$(printf '%s' "$ALLOW_LINE" | grep -o 'pypi.org' | wc -l | tr -d ' ')"
assert_eq "1" "$N" "duplicate allow entries collapse into one"

t_name "key = value config"
cat > "$CFG/config" <<'EOF'
net = none
harness = none
cpus = 7
memory = 1536m
pids = 77
selinux = :Z
EOF
sb --print-policy
assert_contains "net=none"      "config file sets net"
assert_contains "harness=none"  "config file sets harness"
assert_contains "cpus:7"        "config file sets cpus"
assert_contains "memory:1536m"  "config file sets memory"
assert_contains "pids:77"       "config file sets pids"
assert_contains "selinux=:Z"    "config file sets selinux"

t_name "precedence: flag > env > config file"
sb --print-policy --net allow
assert_contains "net=allow" "flag beats config file"
sb_env AISB_NET=full --print-policy
assert_contains "net=full" "AISB_* env beats config file"
sb_env AISB_NET=full --print-policy --net none
assert_contains "net=none" "flag beats AISB_* env"

t_name "AISB_ALLOW / AISB_ENV lists"
sb_env AISB_ALLOW=a.example.com,b.example.com:8443 --print-policy --net none
assert_contains "a.example.com"      "AISB_ALLOW entry 1"
assert_contains "b.example.com:8443" "AISB_ALLOW entry 2 with port"
sb_env AISB_ENV=HOME_X,TMPDIR --print-policy --net none
assert_contains "env_names=HOME_X TMPDIR" "AISB_ENV populates env names"
assert_contains "env_missing=HOME_X" "unset names are reported by --print-policy"

t_name "repo config wins per-directory"
cat > "$REPO/.ai-sandbox/config" <<'EOF'
pids = 42
EOF
sb --print-policy --net none
assert_contains "pids:42" "repo config overrides user config"

t_name "unknown keys warn but do not break"
echo 'bogus_key = 1' >> "$CFG/config"
sb --print-policy --net none
assert_contains "unknown key: bogus_key" "unknown key warns"
assert_rc 0 "unknown key is not fatal"