/**
 * Validates that `crypto.randomUUID` and `crypto.subtle` are only used in
 * approved files and that no other disallowed globals appear in the source.
 */

import { readdirSync, readFileSync, statSync } from "node:fs";
import { relative, resolve } from "node:path";
import { describe, expect, it } from "@suaveplan/testing/runner";

const SRC_ROOT = resolve(import.meta.dirname, "../src");

// Files approved to use globalThis.crypto.randomUUID / crypto.subtle
const CRYPTO_APPROVED_FILES = new Set(["key/key-generator.ts"]);

function walkFiles(dir: string): string[] {
    const results: string[] = [];
    for (const entry of readdirSync(dir)) {
        const full = resolve(dir, entry);
        const stat = statSync(full);
        if (stat.isDirectory()) {
            results.push(...walkFiles(full));
        } else if (
            entry.endsWith(".ts") &&
            !entry.endsWith(".test.ts") &&
            !entry.endsWith(".bench.ts")
        ) {
            results.push(full);
        }
    }
    return results;
}

describe("no-disallowed globals", () => {
    it("crypto.randomUUID only used in approved files", {
        timeout: 5000,
    }, () => {
        const files = walkFiles(SRC_ROOT);
        const violations: string[] = [];
        for (const file of files) {
            const rel = relative(SRC_ROOT, file);
            const content = readFileSync(file, "utf-8");
            if (
                content.includes("randomUUID") &&
                !CRYPTO_APPROVED_FILES.has(rel)
            ) {
                violations.push(rel);
            }
        }
        expect(violations).toEqual([]);
    });

    it("crypto.subtle only used in approved files", { timeout: 5000 }, () => {
        const files = walkFiles(SRC_ROOT);
        const violations: string[] = [];
        for (const file of files) {
            const rel = relative(SRC_ROOT, file);
            const content = readFileSync(file, "utf-8");
            if (
                (content.includes("crypto.subtle") ||
                    content.includes("crypto.subtle")) &&
                !CRYPTO_APPROVED_FILES.has(rel)
            ) {
                violations.push(rel);
            }
        }
        expect(violations).toEqual([]);
    });

    it("key-generator.ts is in the approved set", { timeout: 5000 }, () => {
        expect(CRYPTO_APPROVED_FILES.has("key/key-generator.ts")).toBe(true);
    });
});