import { readdir } from "node:fs/promises";
import { spawnSync } from "node:child_process";

function requiredPnpmCli(): string {
  const executable = process.env.npm_execpath;
  if (!executable) {
    throw new Error("check:browser-security must run through the pnpm script");
  }
  return executable;
}

const pnpmCli = requiredPnpmCli();

function runPnpm(arguments_: string[]) {
  return spawnSync(process.execPath, [pnpmCli, ...arguments_], {
    encoding: "utf8",
  });
}

const allowed = runPnpm([
  "exec",
  "eslint",
  "tests/fixtures/security/allowed",
  "--no-ignore",
  "--max-warnings=0",
]);
const forbidden = runPnpm([
  "exec",
  "eslint",
  "tests/fixtures/security/forbidden",
  "--no-ignore",
  "--max-warnings=0",
]);

const distFiles = await readdir("dist", { recursive: true });
const publicSourceMaps = distFiles.filter((file) => String(file).endsWith(".map"));

if (allowed.status !== 0 || forbidden.status === 0 || publicSourceMaps.length > 0) {
  process.stderr.write(allowed.stderr || allowed.stdout);
  process.stderr.write(forbidden.stderr || forbidden.stdout);
  if (publicSourceMaps.length > 0) {
    process.stderr.write(`Public source maps found: ${publicSourceMaps.join(", ")}\n`);
  }
  process.exit(1);
}

process.stdout.write(
  "Browser security fixtures: injection rejected, public source maps absent\n",
);