import { describe, it, expect } from 'vitest';
import { execSync } from 'child_process';

describe('FreeBSD Jail Configuration', () => {
  it('should not have Linux emulation enabled', () => {
    const linuxEnabled = (() => {
      try {
        const result = execSync('sysrc -n linux_enable', {
          stdio: 'pipe',
          encoding: 'utf-8',
        });
        return result.trim() === 'YES';
      } catch {
        return false;
      }
    })();

    expect(linuxEnabled).toBe(false);
  });

  it('should detect jail environment', () => {
    const inJail = (() => {
      try {
        const result = execSync('sysctl -n security.jail.jailed', {
          stdio: 'pipe',
          encoding: 'utf-8',
        });
        return result.trim() === '1';
      } catch {
        return false;
      }
    })();

    expect(inJail).toBe(true);
  });

  it('should have jail configuration', () => {
    const hasJailConf = (() => {
      try {
        execSync('test -f /etc/jail.conf', { stdio: 'pipe' });
        return true;
      } catch {
        return false;
      }
    })();

    expect(hasJailConf).toBe(true);
  });

  it('should have control-plane jail configured', () => {
    const hasControlPlaneJail = (() => {
      try {
        const result = execSync('jls -n', {
          stdio: 'pipe',
          encoding: 'utf-8',
        });
        return result.includes('controlplane');
      } catch {
        return false;
      }
    })();

    expect(hasControlPlaneJail).toBe(true);
  });

  it('should use jail for process isolation', () => {
    const jailPath =
      process.env.JAIL_PATH || '/usr/local/bastille/jails/controlplane/root';

    const jailExists = (() => {
      try {
        execSync(`test -d ${jailPath}`, { stdio: 'pipe' });
        return true;
      } catch {
        return false;
      }
    })();

    expect(jailExists).toBe(true);
  });
});

describe('Jail Security', () => {
  it('should have devfs mounted in jail', () => {
    const devfsMounted = (() => {
      try {
        const result = execSync('mount -p | grep devfs', {
          stdio: 'pipe',
          encoding: 'utf-8',
        });
        return result.includes('/dev');
      } catch {
        return false;
      }
    })();

    expect(devfsMounted).toBe(true);
  });

  it('should have proper jail IP configuration', () => {
    const jailIP = process.env.JAIL_IP || '192.168.100.100';

    const hasIP = (() => {
      try {
        const result = execSync('ifconfig', {
          stdio: 'pipe',
          encoding: 'utf-8',
        });
        return result.includes(jailIP);
      } catch {
        return false;
      }
    })();

    expect(hasIP).toBe(true);
  });

  it('should not have access to host filesystem outside jail', () => {
    const inJail = (() => {
      try {
        const result = execSync('sysctl -n security.jail.jailed', {
          stdio: 'pipe',
          encoding: 'utf-8',
        });
        return result.trim() === '1';
      } catch {
        return false;
      }
    })();

    if (inJail) {
      const canAccessHost = (() => {
        try {
          execSync('test -d /home/clawdie', { stdio: 'pipe' });
          return true;
        } catch {
          return false;
        }
      })();

      expect(canAccessHost).toBe(false);
    }
  });
});

describe('Jail Performance', () => {
  it('should not have Linux emulation overhead', () => {
    const linuxModulesLoaded = (() => {
      try {
        const result = execSync('kldstat | grep linux', {
          stdio: 'pipe',
          encoding: 'utf-8',
        });
        return result.length > 0;
      } catch {
        return false;
      }
    })();

    expect(linuxModulesLoaded).toBe(false);
  });

  it('should use native FreeBSD syscalls', () => {
    const syscallMode = process.env.SYSCALL_MODE || 'native';
    expect(syscallMode).toBe('native');
  });
});
