import { readdirSync, readFileSync, statSync } from "node:fs";
import { join } from "node:path";
import { describe, expect, it } from "@suaveplan/testing/runner";

const SRC = join(__dirname, "..", "src");
const APPROVED_RANDOM = join(
    SRC,
    "primitives",
    "random-bytes",
    "random-bytes.ts"
);

const BANNED_GLOBAL: ReadonlyArray<RegExp> = [
    /\bnode:fs\b/,
    /\bnode:path\b/,
    /\bnode:url\b/,
    /\bprocess\./,
    /\bBuffer\b/,
    /\bdocument\.[a-z]/,
    /\bwindow\.[a-z]/,
];

const BANNED_OUTSIDE_APPROVED: ReadonlyArray<RegExp> = [
    /\bMath\.random\b/,
    /\bDate\.now\b/,
    /\bcrypto\.getRandomValues\b/,
];

function* walk(dir: string): Generator<string> {
    for (const entry of readdirSync(dir)) {
        const full = join(dir, entry);
        const st = statSync(full);
        if (st.isDirectory()) yield* walk(full);
        else if (full.endsWith(".ts") && !full.endsWith(".test.ts")) yield full;
    }
}

describe("no-disallowed", () => {
    it("src/ avoids Node + browser built-ins", { timeout: 5000 }, () => {
        const hits: string[] = [];
        for (const file of walk(SRC)) {
            const content = readFileSync(file, "utf8");
            for (const pattern of BANNED_GLOBAL) {
                if (pattern.test(content)) hits.push(`${file} ${pattern}`);
            }
        }
        expect(hits).toEqual([]);
    });

    it("random sources live only in the approved file", {
        timeout: 5000,
    }, () => {
        const hits: string[] = [];
        for (const file of walk(SRC)) {
            if (file === APPROVED_RANDOM) continue;
            const content = readFileSync(file, "utf8");
            for (const pattern of BANNED_OUTSIDE_APPROVED) {
                if (pattern.test(content)) hits.push(`${file} ${pattern}`);
            }
        }
        expect(hits).toEqual([]);
    });
});