gitfor/platform

import { describe, expect, mock, test } from "bun:test";

const fakeEnv: Record<string, string | undefined> = {
  PUBLIC_URL: "https://gitfor.example.com",
  INTEGRATIONS_ALLOW_LOOPBACK: "false",
  SECRETS_KEY: "test-master-key",
  WEBHOOKS_ALLOW_HTTP: undefined,
};
const dbCalls: Array<{ sql: string; params: unknown[] }> = [];
mock.module("cloudflare:workers", () => ({
  env: fakeEnv,
  waitUntil: () => undefined,
  WorkflowEntrypoint: class {},
  DurableObject: class {},
  WorkerEntrypoint: class {},
}));
mock.module("../db", () => ({
  run: async (sql: string, ...params: unknown[]) => {
    dbCalls.push({ sql, params });
    return { meta: { changes: 1 } };
  },
  first: async () => null,
  all: async () => [],
  stmt: () => ({}),
  batch: async () => [],
  placeholders: (count: number) => Array.from({ length: count }, () => "?").join(", "),
  MAX_IN_LIST: 90,
  chunks: <T>(items: T[]) => [items],
}));

const { collaboratorCanPush, mirrorPushConfigured } = await import("./github-sync");
const { assertOutboundUrl } = await import("./outbound");
const { assertWebhookUrl, isSealedSecret, openWebhookSecret, sealWebhookSecret, replayableBody } =
  await import("../webhooks/legacy");

describe("INT-A1 push mirror gate", () => {
  const base = { githubLogin: "alice", githubInstallationId: 42, githubRepo: "Org/Private" };

  test("requires the installer to have recorded push on the selected repo", () => {
    expect(mirrorPushConfigured({ ...base, githubPushRepos: ["org/private"] })).toMatchObject({ ok: true });