import test from 'brittle'
import b4a from 'b4a'
import Hyperdrive from 'hyperdrive'
import Corestore from 'corestore'
import { rmSync } from 'node:fs'
import { createVfs } from './lib/vfs.js'

function testCorestoreDir(name) {
  return `/tmp/bare-os-booter-${name}-${Date.now()}-${Math.random().toString(16).slice(2)}`
}

test('guest denies /.bare sensitive operations (readdir/read/write/unlink)', async (t) => {
  const dir = testCorestoreDir('vfs-bare-guest-deny')
  const store = new Corestore(dir)
  const sys = new Hyperdrive(store)
  const personal = new Hyperdrive(store.namespace('pv-bare-deny'))
  await sys.ready()
  await personal.ready()
  await personal.put('/.bare/account', b4a.from('acct'))

  const vfs = createVfs(sys, personal, {
    HOME: '/home/guest',
    PWD: '/home/guest',
    PATH: '/bin',
    USER: 'guest'
  })
  vfs.bareOsIdentitySession = 'guest'

  let e1 = null
  try {
    await vfs.readdir('/.bare/account')
  } catch (e) {
    e1 = e
  }
  t.ok(e1)
  let e2 = null
  try {
    await vfs.readFile('/.bare/account')
  } catch (e) {
    e2 = e
  }
  t.ok(e2)
  let e3 = null
  try {
    await vfs.writeFile('/.bare/account', b4a.from('x'))
  } catch (e) {
    e3 = e
  }
  t.ok(e3)
  let e4 = null
  try {
    await vfs.unlink('/.bare/account')
  } catch (e) {
    e4 = e
  }
  t.ok(e4)

  await store.close()
  rmSync(dir, { recursive: true, force: true })
})