gitfor/platform

import { describe, expect, mock, test } from "bun:test";
import type { BranchProtection } from "./protection";

mock.module("cloudflare:workers", () => ({
  env: {},
  waitUntil: () => undefined,
  WorkflowEntrypoint: class {},
  DurableObject: class {},
  WorkerEntrypoint: class {},
}));

const { tagUpdateViolation } = await import("./protection");
const { protectionVerdicts } = await import("./git/proxy");
const ZERO = "0".repeat(40);
const A = "a".repeat(40);
const B = "b".repeat(40);

function rule(overrides: Partial<BranchProtection> = {}): BranchProtection {
  return {
    id: "r1",
    pattern: "refs/tags/v*",
    requirePullRequest: false,
    requiredApprovals: 0,
    requiredChecks: [],
    dismissStaleReviews: false,
    allowDeletions: false,
    allowForcePushes: false,
    enforceAdmins: false,
    requireCodeOwnerReview: false,
    ...overrides,
  };
}

describe("tagUpdateViolation (GIT-A3 / GIT-A6)", () => {
  test("no rule means no restriction", () => {
    expect(tagUpdateViolation(null, "write", "create")).toBeNull();
    expect(tagUpdateViolation(null, "write", "delete")).toBeNull();
  });

  test("writers cannot create, move or delete tags under a strict rule", () => {