// Run with `bun test`.
import assert from "node:assert/strict";
import { test } from "node:test";
import { isPrivateAddress, signature } from "./webhook-rules";
import { parseWorkflow, triggerMatches, WorkflowError } from "./workflows";

const jobs = "jobs:\n  test:\n    runs-on: self-hosted\n    steps:\n      - run: echo hi\n";

test("workflows can run on pull requests, issues, comments and reviews", () => {
  const w = parseWorkflow(`on:\n  pull_request:\n    branches: [main]\n    paths: ["src/**"]\n  issues:\n    types: [opened, labeled]\n  issue_comment:\n  pull_request_review:\n${jobs}`, "ci.yml");
  assert.deepEqual(w.events.pull_request?.types, ["opened", "synchronize", "reopened"]);
  assert.deepEqual(w.events.pull_request?.branches.include, ["main"]);
  assert.deepEqual(w.events.issues?.types, ["opened", "labeled"]);
  assert.equal(w.events.issue_comment?.types, null);
  assert.equal(w.push, null);
  assert.equal(triggerMatches(w.events.pull_request!, "synchronize"), true);
  assert.equal(triggerMatches(w.events.pull_request!, "closed"), false);
  assert.equal(triggerMatches(w.events.issue_comment!, "created"), true);
  assert.equal(triggerMatches({ types: ["closed"], branches: { include: null, ignore: null }, paths: { include: null, ignore: null } }, "merged"), true);
  assert.deepEqual(parseWorkflow(`on: [push, pull_request]\n${jobs}`, "ci.yml").events.pull_request?.types, ["opened", "synchronize", "reopened"]);
});

test("unknown event types and options are refused", () => {
  assert.throws(() => parseWorkflow(`on:\n  issues:\n    types: [exploded]\n${jobs}`, "ci.yml"), WorkflowError);
  assert.throws(() => parseWorkflow(`on:\n  issues:\n    branches: [main]\n${jobs}`, "ci.yml"), WorkflowError);
  assert.throws(() => parseWorkflow(`on: schedule\n${jobs}`, "ci.yml"), /isn't supported/);
});

test("webhooks don't reach into private networks", () => {
  for (const ip of ["127.0.0.1", "10.1.2.3", "172.16.0.1", "172.31.255.255", "192.168.1.1", "169.254.169.254", "100.64.0.1", "0.0.0.0", "::1", "::", "fd00::1", "fe80::1", "::ffff:127.0.0.1", "224.0.0.1"]) {
    assert.equal(isPrivateAddress(ip), true, ip);
  }
  for (const ip of ["1.1.1.1", "172.32.0.1", "8.8.8.8", "2606:4700::1111", "100.128.0.1"]) assert.equal(isPrivateAddress(ip), false, ip);
});

test("deliveries are signed like GitHub's", () => {
  // From GitHub's documentation on validating webhook deliveries.
  assert.equal(signature("It's a Secret to Everybody", "Hello, World!"), "sha256=757107ea0eb2509fc211221cce984b8a37570b6d7586c22c46f4379c8b043e17");
});