import { describe, expect, it } from "vitest";
import { isolatedCodexLoginEnvironment } from "../../apps/control-plane/src/account-login.js";

describe("isolated Codex account login environment", () => {
  it("inherits only process mechanics and never ambient AWP/provider/database authority", () => {
    const environment = isolatedCodexLoginEnvironment(
      {
        PATH: "/usr/local/bin:/usr/bin",
        LANG: "C.UTF-8",
        HTTPS_PROXY: "http://proxy.example:8080",
        DATABASE_URL: "postgres://awp:secret@127.0.0.1/awp",
        AWP_SUBROUTER_ADMIN_TOKEN_FILE: "/secret/subrouter-admin",
        AWP_SUBROUTER_ACCOUNT_IMPORT_TOKEN_FILE: "/secret/subrouter-import",
        AWP_GITHUB_PUBLICATION_TOKEN_FILE: "/secret/github",
        AWP_MODEL_GATEWAY_SIGNING_SECRET_FILE: "/secret/model-gateway",
        AWP_EXECUTION_CALLBACK_SECRET: "callback-secret",
        OPENAI_API_KEY: "sk-openai-secret",
        CODEX_API_KEY: "sk-codex-secret",
        ANTHROPIC_API_KEY: "anthropic-secret",
        CLAUDE_API_KEY: "claude-secret",
      },
      "/tmp/awp-codex-login-test",
    );

    expect(environment).toMatchObject({
      PATH: "/usr/local/bin:/usr/bin",
      LANG: "C.UTF-8",
      HTTPS_PROXY: "http://proxy.example:8080",
      HOME: "/tmp/awp-codex-login-test",
      CODEX_HOME: "/tmp/awp-codex-login-test",
      XDG_CONFIG_HOME: "/tmp/awp-codex-login-test/.config",
      XDG_DATA_HOME: "/tmp/awp-codex-login-test/.local/share",
      XDG_STATE_HOME: "/tmp/awp-codex-login-test/.local/state",
      NO_BROWSER: "1",
    });
    for (const key of [
      "DATABASE_URL",
      "AWP_SUBROUTER_ADMIN_TOKEN_FILE",
      "AWP_SUBROUTER_ACCOUNT_IMPORT_TOKEN_FILE",
      "AWP_GITHUB_PUBLICATION_TOKEN_FILE",
      "AWP_MODEL_GATEWAY_SIGNING_SECRET_FILE",
      "AWP_EXECUTION_CALLBACK_SECRET",
      "OPENAI_API_KEY",
      "CODEX_API_KEY",
      "ANTHROPIC_API_KEY",
      "CLAUDE_API_KEY",
    ]) {
      expect(environment[key]).toBeUndefined();
    }
  });
});