import { describe, expect, it } from "bun:test";
import { readFile } from "node:fs/promises";

describe("internal OpenCode permissions", () => {
  it("keeps protected paths denied in every approval mode", async () => {
    const config = JSON.parse(await readFile("opencode.json", "utf8")) as {
      permission?: Record<string, string | Record<string, string>>;
    };
    const permission = config.permission ?? {};
    const bash = permission.bash as Record<string, string> | undefined;
    const edit = permission.edit as Record<string, string> | undefined;
    const read = permission.read as Record<string, string> | undefined;

    expect(permission["*"]).toBe("ask");
    expect(permission.external_directory).toBe("deny");
    expect(permission.question).toBe("allow");
    expect(permission.todowrite).toBe("allow");
    expect(read?.["*"]).toBe("allow");
    expect(read?.["data/**"]).toBe("deny");
    expect(read?.["**/logs/**"]).toBe("deny");
    expect(edit?.["*"]).toBe("ask");
    expect(edit?.["data/**"]).toBe("deny");
    expect(edit?.["**/logs/**"]).toBe("deny");
    expect(bash?.["*"]).toBe("ask");
    expect(bash?.["*.env*"]).toBe("deny");
    expect(bash?.["*data/*"]).toBe("deny");
    expect(bash?.["*logs/*"]).toBe("deny");
  });
});