/**
 * C6 regression: PathClassifier missing credential_store/unknown categories
 * Bug: 8 categories didn't match spec's 9 categories.
 * Fix: project, project_air_shared, project_air_local, project_build,
 *      project_git, project_outside_user, system_sensitive, credential_store, unknown.
 */

import { describe, it, expect } from 'bun:test'
import { readFileSync } from 'fs'
import { join } from 'path'

describe('C6: PathClassifier categories', () => {
  const src = readFileSync(
    join(import.meta.dir, '..', '..', 'src', 'security', 'PathClassifier.ts'),
    'utf-8'
  )

  it('PathCategory type has exactly 9 values', () => {
    const type_match = src.match(/export type PathCategory\s*=\s*\n([\s\S]*?)(?=\n\n|\nconst)/)
    expect(type_match).not.toBeNull()
    const values = type_match![1].match(/'([^']+)'/g)
    expect(values).not.toBeNull()
    expect(values!.length).toBe(9)
  })

  it('includes credential_store category', () => {
    expect(src).toContain("'credential_store'")
  })

  it('includes unknown category', () => {
    expect(src).toContain("'unknown'")
  })

  it('includes project_air_shared category', () => {
    expect(src).toContain("'project_air_shared'")
  })

  it('includes project_air_local category', () => {
    expect(src).toContain("'project_air_local'")
  })

  it('includes project_git category', () => {
    expect(src).toContain("'project_git'")
  })

  it('includes system_sensitive category', () => {
    expect(src).toContain("'system_sensitive'")
  })

  it('does not include legacy categories', () => {
    const type_match = src.match(/export type PathCategory\s*=\s*((?:\s*\|\s*'[^']+')+)/s)
    const values = type_match![1]
    expect(values).not.toContain("'project_source'")
    expect(values).not.toContain("'project_config'")
    expect(values).not.toContain("'project_internal'")
    expect(values).not.toContain("'user_home'")
    expect(values).not.toContain("'temp'")
    expect(values).not.toContain("'external'")
  })

  it('has CREDENTIAL_PATTERNS for credential detection', () => {
    expect(src).toContain('CREDENTIAL_PATTERNS')
    expect(src).toContain('.ssh')
    expect(src).toContain('.gnupg')
    expect(src).toContain('.env')
  })

  it('default fallback for in-project files is project', () => {
    expect(src).toMatch(/category:\s*'project'/)
  })

  it('unknown is defined as a type for unclassifiable paths', () => {
    expect(src).toContain("'unknown'")
  })
})
