package execsafe_test

import (
	"errors"
	"os/exec"
	"path/filepath"
	"testing"

	"proxyctl/internal/execsafe"
)

func TestLookPathUsesOnlyTrustedSystemDirectories(t *testing.T) {
	path, err := execsafe.LookPath("sh")
	if err != nil {
		t.Fatal(err)
	}
	if !filepath.IsAbs(path) || filepath.Base(path) != "sh" {
		t.Fatalf("resolved path = %q", path)
	}
}

func TestLookPathRejectsPathsAndMissingCommands(t *testing.T) {
	for _, name := range []string{"../systemctl", "/tmp/systemctl", "dir/systemctl", ""} {
		if _, err := execsafe.LookPath(name); err == nil {
			t.Fatalf("unsafe name %q was accepted", name)
		}
	}
	if _, err := execsafe.LookPath("proxyctl-command-that-does-not-exist"); !errors.Is(err, exec.ErrNotFound) {
		t.Fatalf("missing command error = %v", err)
	}
}