package api

import (
	"os"
	"path/filepath"
	"testing"

	"chfs-ng/internal/auth"
	"chfs-ng/internal/storage"
)

func TestCheckDeleteTreeRejectsDeniedDescendant(t *testing.T) {
	root := t.TempDir()
	if err := os.MkdirAll(filepath.Join(root, "public", "private"), 0o755); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(filepath.Join(root, "public", "private", "secret.txt"), []byte("x"), 0o644); err != nil {
		t.Fatal(err)
	}
	store := storage.Local{Root: root}
	account := &auth.Account{Mask: auth.Delete, Rules: []auth.PathRule{{Dir: "public/private", Mask: auth.None}}}
	if err := checkDeleteTree(store, account, "public"); err == nil {
		t.Fatal("expected denied descendant to block recursive deletion")
	}
}

func TestUnsafePath(t *testing.T) {
	cases := map[string]bool{
		"../secret":     true,
		"a/../secret":   true,
		`..\\secret`:    true,
		"%2e%2e/secret": false,
		"secret":        false,
		"a//b":          false,
		"":              false,
	}
	for p, want := range cases {
		if got := unsafePath(p); got != want {
			t.Fatalf("unsafePath(%q)=%v, want %v", p, got, want)
		}
	}
}