use super::{Directory, fixture};
use dever::compiler::{build, project::Project};

#[test]
fn native_crypto_sinks_and_blocking_workers_keep_their_contracts() {
    let directory = Directory::new();
    let project = Project::load(&fixture().with_file_name("crypto.dever")).unwrap();
    let program = project.check().unwrap();
    for entry in ["verify", "asyncVerify", "phcVerify"] {
        let binary =
            build::build(&program, &project.sources, entry, &directory.0.join(entry)).unwrap();
        let result = std::process::Command::new(binary).output().unwrap();
        assert!(
            result.status.success(),
            "{entry}: {}",
            String::from_utf8_lossy(&result.stderr)
        );
        assert_eq!(result.stdout, b"true\n", "{entry}");
    }
}

#[test]
fn crypto_failures_keep_source_identity_and_sensitive_entry_results_are_rejected() {
    let directory = Directory::new();
    let project = Project::load(&fixture().with_file_name("crypto.dever")).unwrap();
    let program = project.check().unwrap();
    for entry in ["leak", "leakList"] {
        let output = directory.0.join(entry);
        let error = build::build(&program, &project.sources, entry, &output).unwrap_err();
        assert!(
            error.contains("Secret") && error.contains("rendered"),
            "{error}"
        );
        assert!(!output.exists());
    }
    let binary = build::build(
        &program,
        &project.sources,
        "invalid",
        &directory.0.join("invalid"),
    )
    .unwrap();
    let result = std::process::Command::new(binary).output().unwrap();
    assert!(!result.status.success());
    let error = String::from_utf8(result.stderr).unwrap();
    assert!(
        error.contains("TokenResult.Failed") && error.contains("lib/dever/crypto.dever:"),
        "{error}"
    );
}