// P3: catches the named OAuth-leak mutant and reuse of another session's key.
import test from 'node:test';
import assert from 'node:assert/strict';
import { ENV_ALLOW, sessionEnv } from '../src/session.mjs';

const instance = {
  HOME: '/fixture-home', USER: 'fixture', PATH: '/usr/bin', LANG: 'C',
  CLAUDE_CODE_OAUTH_TOKEN: 'fx332-oauth', ANTHROPIC_API_KEY: 'fx332-anthropic',
  ANTHROPIC_AUTH_TOKEN: 'fx332-auth', ANTHROPIC_BASE_URL: 'http://upstream.invalid',
  OPENAI_API_KEY: 'fx332-openai', OPENROUTER_API_KEY: 'fx332-router', ZAI_API_KEY: 'fx332-zai',
  MOSAIC_CLAUDE_BIN: '/fixture/claude', GITEA_TOKEN: 'fx332-gitea',
};
const forbidden = ['CLAUDE_CODE_OAUTH_TOKEN', 'ANTHROPIC_API_KEY', 'ANTHROPIC_AUTH_TOKEN',
  'ANTHROPIC_BASE_URL', 'OPENAI_API_KEY', 'OPENROUTER_API_KEY', 'ZAI_API_KEY'];

test('P3 proxy sessionEnv removes every instance provider credential without widening ENV_ALLOW', () => {
  const original = [...ENV_ALLOW];
  const env = sessionEnv(instance, 'r332a', { baseUrl: 'http://127.0.0.1:12345', key: 'fx332-agent-a' });
  for (const name of forbidden) assert.equal(Object.hasOwn(env, name), false, name);
  assert.equal(env.USER, 'fixture');
  assert.equal(env.MOSAIC_CLAUDE_BIN, '/fixture/claude');
  assert.equal(Object.hasOwn(env, 'GITEA_TOKEN'), false);
  assert.equal(env.MOSAIC_RUN_ID, 'r332a');
  assert.deepEqual([...ENV_ALLOW], original);
});

test('P3 no proxy retains the full existing allowlist and run environment', () => {
  const env = sessionEnv(instance, 'r332b');
  assert.deepEqual(env, {
    HOME: '/fixture-home', USER: 'fixture', LANG: 'C',
    CLAUDE_CODE_OAUTH_TOKEN: 'fx332-oauth', ANTHROPIC_API_KEY: 'fx332-anthropic',
    ANTHROPIC_AUTH_TOKEN: 'fx332-auth', ANTHROPIC_BASE_URL: 'http://upstream.invalid',
    OPENAI_API_KEY: 'fx332-openai', OPENROUTER_API_KEY: 'fx332-router', ZAI_API_KEY: 'fx332-zai',
    MOSAIC_CLAUDE_BIN: '/fixture/claude', PATH: env.PATH, MOSAIC_RUN_ID: 'r332b',
  });
  assert.ok(env.PATH.endsWith('node_modules/.bin:/usr/bin'));
});