import { spawnSync } from "node:child_process";
import { readFile } from "node:fs/promises";

type Document = Record<string, unknown>;

function record(value: unknown, label: string): Document {
  if (!value || typeof value !== "object" || Array.isArray(value)) {
    throw new TypeError(`${label} must be an object`);
  }
  return value as Document;
}

const artifact = "artifacts/security/scan-fixture.sarif";
const scan = spawnSync(
  "node",
  [
    "scripts/security-scan.ts",
    "--policy",
    "tests/fixtures/security/secret-detection/forbidden-policy.json",
    "--artifact",
    artifact,
  ],
  { encoding: "utf8" },
);
if (scan.error || scan.signal || scan.status !== 1) {
  throw new Error(
    `forbidden security fixture did not fail exactly: ${scan.error?.message ?? scan.stderr}`,
  );
}

const sarif = record(
  JSON.parse(await readFile(artifact, "utf8")),
  "security fixture SARIF",
);
const runs = Array.isArray(sarif.runs) ? sarif.runs : [];
const run = record(runs[0], "security fixture SARIF run");
const results = Array.isArray(run.results) ? run.results : [];
const actual = results
  .map((rawResult) => {
    const result = record(rawResult, "security fixture result");
    const locations = Array.isArray(result.locations) ? result.locations : [];
    const location = record(locations[0], "security fixture location");
    const physical = record(
      location.physicalLocation,
      "security fixture physical location",
    );
    const artifactLocation = record(
      physical.artifactLocation,
      "security fixture artifact location",
    );
    return `${String(artifactLocation.uri)}:${String(result.ruleId)}`;
  })
  .sort();
const root = "tests/fixtures/security/secret-detection/forbidden";
const expected = [
  `${root}/config.json:assigned-secret`,
  `${root}/dist.ts:assigned-secret`,
  `${root}/source.ts:aws-access-key`,
].sort();
if (JSON.stringify(actual) !== JSON.stringify(expected)) {
  throw new Error(
    `security fixture findings mismatch: expected ${expected.join(", ")}; received ${actual.join(", ")}`,
  );
}
process.stdout.write("Security fixtures: 3 forbidden files detected\n");