package session

import (
	"os"
	"path/filepath"
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

// session_log passed the caller's session_id straight into
// filepath.Join(sessionsDir, id+".jsonl") and opened it O_CREATE|O_APPEND:
// path segments in the id created or appended files anywhere the pod could
// write. The id is now a plain name, and the open does not follow a final
// symlink.
func TestAppendRefusesSessionIDsThatAreNotPlainNames(t *testing.T) {
	root := t.TempDir()
	dir := filepath.Join(root, "sessions")
	for _, id := range []string{"../x", "a/b", "/abs", ".", "..", ".hidden", "", "a\\b", "a\x00b"} {
		assert.Error(t, Append(dir, id, Entry{SessionID: id}), "%q", id)
	}
	ents, _ := os.ReadDir(root)
	for _, e := range ents {
		assert.Equal(t, "sessions", e.Name(), "nothing created beside the sessions dir")
	}
	for _, id := range []string{"1557b2e1-bf0d-5c4f-bbe3-0754d087e356", "_routing", "2026-05-05-infra.plan", "0"} {
		require.NoError(t, Append(dir, id, Entry{SessionID: id}), "positive control: %q", id)
	}
}

func TestAppendDoesNotWriteThroughASymlinkedLog(t *testing.T) {
	root := t.TempDir()
	dir := filepath.Join(root, "sessions")
	require.NoError(t, os.MkdirAll(dir, 0o755))
	victim := filepath.Join(root, "victim.md")
	require.NoError(t, os.WriteFile(victim, []byte("untouched\n"), 0o644))
	require.NoError(t, os.Symlink(filepath.Join("..", "victim.md"), filepath.Join(dir, "s.jsonl")))
	assert.Error(t, Append(dir, "s", Entry{SessionID: "s"}))
	got, _ := os.ReadFile(victim)
	assert.Equal(t, "untouched\n", string(got))
}

func TestReadRefusesSessionIDsThatAreNotPlainNames(t *testing.T) {
	root := t.TempDir()
	require.NoError(t, os.WriteFile(filepath.Join(root, "x.jsonl"), []byte(`{"session_id":"x"}`+"\n"), 0o644))
	_, err := Read(filepath.Join(root, "sessions"), "../x")
	assert.Error(t, err)
}