#!/usr/bin/env bats

load test_helper

# sandbox/agent runs a fake agent through a fake srt, which sets NO_PROXY the
# way the real one does, saves the settings it was given and runs the command.

setup() {
  common_setup
  SANDBOX="$HOME/.local/share/coredesktop/sandbox"
  mkdir -p "$SANDBOX/bin" "$SANDBOX/config" "$BATS_TEST_TMPDIR/project"
  cp "$REPO/sandbox/config/base.json" "$SANDBOX/config/"
  ln -s "$REPO/sandbox/agent" "$SANDBOX/bin/fakeagent"
  export XDG_RUNTIME_DIR="$BATS_TEST_TMPDIR/run"
  mkdir -p "$XDG_RUNTIME_DIR"
  export SETTINGS_COPY="$BATS_TEST_TMPDIR/settings.json"

  stub srt 'cp "$2" "$SETTINGS_COPY"
while [ "$1" != "--" ]; do shift; done
shift
export NO_PROXY=localhost,127.0.0.1,::1,10.0.0.0/8,192.168.0.0/16 no_proxy=localhost,192.168.0.0/16
exec "$@"'
  stub fakeagent 'echo "NO_PROXY=$NO_PROXY no_proxy=$no_proxy args=$*"'
  cd "$BATS_TEST_TMPDIR/project"
}

@test "an agent connects directly only to loopback, so allowed LAN addresses go through the proxy" {
  run "$SANDBOX/bin/fakeagent" one "two words"
  [ "$status" -eq 0 ]
  [ "$output" = "NO_PROXY=localhost,127.0.0.1,::1 no_proxy=localhost,127.0.0.1,::1 args=one two words" ]
}

@test "a server allowed in your own base.json is in the agent's settings" {
  mkdir -p "$HOME/.config/coredesktop/sandbox"
  echo '{"network": {"allowedDomains": ["llm.local:11434"]}}' > "$HOME/.config/coredesktop/sandbox/base.json"
  run "$SANDBOX/bin/fakeagent"
  [ "$status" -eq 0 ]
  jq -e '.network.allowedDomains | index("llm.local:11434") and index("github.com")' "$SETTINGS_COPY"
}

# --- configure sandbox ----------------------------------------------------------------

setup_configure() {
  export COREDESKTOP="$REPO"
  confirm() { return 0; }
  source "$REPO/configure.d/65-sandbox.sh"
}

@test "the sandbox hides WinBoat's settings by default" {
  jq -e '.filesystem.denyRead | index("~/.winboat")' "$REPO/sandbox/config/base.json"
  run "$SANDBOX/bin/fakeagent"
  [ "$status" -eq 0 ]
  jq -e '.filesystem.denyRead | index("~/.winboat")' "$SETTINGS_COPY"
  run jq -e '.filesystem.allowRead | index("~/.winboat")' "$SETTINGS_COPY"
  [ "$status" -ne 0 ]
}

@test "configure sandbox lets agents read WinBoat's settings, and hides them again" {
  setup_configure
  mkdir -p "$HOME/.config/coredesktop/sandbox"
  echo '{"network": {"allowedDomains": ["llm.local:11434"]}}' > "$SANDBOX_CONF"

  run run_configure <<< $'1\nq'
  [ "$status" -eq 0 ]
  [[ "$output" == *"Agents can read ~/.winboat."* ]]
  [ "$(jq -c '.filesystem.allowRead' "$SANDBOX_CONF")" = '["~/.winboat"]' ]
  [ "$(jq -c '.network.allowedDomains' "$SANDBOX_CONF")" = '["llm.local:11434"]' ]

  # What the agent gets: still denied, but re-allowed, which srt lets win
  run "$SANDBOX/bin/fakeagent"
  jq -e '(.filesystem.denyRead | index("~/.winboat")) and (.filesystem.allowRead | index("~/.winboat"))' "$SETTINGS_COPY"

  run run_configure <<< $'1\nq'
  [ "$status" -eq 0 ]
  [[ "$output" == *"~/.winboat is hidden from agents again."* ]]
  [ "$(jq -c '.filesystem.allowRead' "$SANDBOX_CONF")" = '[]' ]
}

@test "configure sandbox is offered only where WinBoat is set up, and is never to do" {
  setup_configure
  run is_installed
  [ "$status" -ne 0 ]
  mkdir -p "$HOME/.winboat"
  is_installed
  is_configured
}