gitfor/platform

import { describe, expect, mock, test } from "bun:test";
import type { BranchProtection } from "./protection";
import type { Permission, RepoRow } from "~/lib/types";
import type { RequestCredential, TokenPermissions } from "./token-scope";

mock.module("cloudflare:workers", () => ({
  env: {},
  waitUntil: () => undefined,
  WorkflowEntrypoint: class {},
  DurableObject: class {},
  WorkerEntrypoint: class {},
}));

/** The user's real permission per repo id; tokens can only narrow it. */
const realPermission = new Map<string, Permission>();
const actualRepos = await import("./repos");
mock.module("./repos", () => ({
  ...actualRepos,
  repoPermission: async (repo: RepoRow) => realPermission.get(repo.id) ?? "none",
}));

const { scopedRepoPermission } = await import("./token-scope");
const { bypassesProtection } = await import("./protection");

const rule: BranchProtection = {
  id: "r1",
  pattern: "main",
  requirePullRequest: true,
  requiredApprovals: 1,
  requiredChecks: [],
  dismissStaleReviews: false,
  allowDeletions: false,
  allowForcePushes: false,
  enforceAdmins: false,
  requireCodeOwnerReview: false,
};

function repo(id: string): RepoRow {
  return { id, visibility: "private", artifacts_name: `r-${id}` } as RepoRow;
}