/**
 * Shell exec-line / redirect policy helpers (env-driven denylists).
 */

/**
 * Boot policy v4: comma list in `BARE_OS_BOOT_POLICY_DENY_EXEC_LINE_BUILTINS`.
 * @param {string} name
 * @param {Record<string, string | undefined> | null | undefined} env
 */
export function isExecLineBuiltinDenied(name, env) {
  const raw = env && env.BARE_OS_BOOT_POLICY_DENY_EXEC_LINE_BUILTINS
  if (raw == null || String(raw).trim() === '') return false
  const set = new Set(
    String(raw)
      .split(',')
      .map((s) => s.trim())
      .filter(Boolean)
  )
  return set.has(name)
}

/**
 * @param {string} key
 * @param {Record<string, string | undefined> | null | undefined} env
 */
export function shellCsvSetFromEnv(key, env) {
  const raw = env && env[key]
  if (raw == null || String(raw).trim() === '') return new Set()
  return new Set(
    String(raw)
      .split(',')
      .map((s) => s.trim())
      .filter(Boolean)
  )
}

/**
 * @param {string} name
 * @param {Record<string, string | undefined> | null | undefined} env
 */
export function shellCommandDeniedByPolicy(name, env) {
  const cmd = String(name || '').trim()
  if (!cmd) return false
  const deny = shellCsvSetFromEnv('BARE_OS_SHELL_DENY_COMMANDS', env)
  if (deny.has(cmd)) return true
  const allow = shellCsvSetFromEnv('BARE_OS_SHELL_ALLOW_COMMANDS', env)
  if (allow.size > 0 && !allow.has(cmd)) return true
  return false
}

/**
 * @param {string} path
 * @param {Record<string, string | undefined> | null | undefined} env
 */
export function shellUnsafeRedirectPath(path, env) {
  const guardOn =
    env &&
    (env.BARE_OS_SHELL_REDIRECT_GUARD === '1' ||
      env.BARE_OS_SHELL_REDIRECT_GUARD === 'true')
  if (!guardOn) return false
  const p = String(path || '').trim()
  if (!p) return false
  if (p.includes('/../') || p.startsWith('../') || p.endsWith('/..')) return true
  if (p.startsWith('/proc/') || p.startsWith('/sys/') || p.startsWith('/dev/'))
    return true
  return false
}