package store_test

import (
	"os"
	"testing"

	"github.com/yourusername/caldav-server/internal/store"
)

func TestStoreRoundTrip(t *testing.T) {
	dir := t.TempDir()
	st, err := store.NewStore(dir)
	if err != nil {
		t.Fatalf("NewStore: %v", err)
	}

	const (
		user     = "alice"
		col      = "cal-personal"
		objectID = "event-001.ics"
	)

	data := []byte("BEGIN:VCALENDAR\r\nEND:VCALENDAR\r\n")

	// Write
	if err := st.PutObject(user, col, objectID, data); err != nil {
		t.Fatalf("PutObject: %v", err)
	}

	// Read
	got, err := st.GetObject(user, col, objectID)
	if err != nil {
		t.Fatalf("GetObject: %v", err)
	}
	if string(got) != string(data) {
		t.Errorf("data mismatch: got %q, want %q", got, data)
	}

	// List
	ids, err := st.ListObjects(user, col)
	if err != nil {
		t.Fatalf("ListObjects: %v", err)
	}
	if len(ids) != 1 || ids[0] != objectID {
		t.Errorf("unexpected ids: %v", ids)
	}

	// Delete
	if err := st.DeleteObject(user, col, objectID); err != nil {
		t.Fatalf("DeleteObject: %v", err)
	}

	// Not found
	_, err = st.GetObject(user, col, objectID)
	if err != store.ErrNotFound {
		t.Errorf("expected ErrNotFound, got %v", err)
	}
}

func TestSanitizePath(t *testing.T) {
	dir := t.TempDir()
	st, err := store.NewStore(dir)
	if err != nil {
		t.Fatalf("NewStore: %v", err)
	}

	// Traversal attempts should not escape rootDir
	dangerous := "../../../etc/passwd"
	data := []byte("test")
	if err := st.PutObject("user", "col", dangerous, data); err != nil {
		t.Fatalf("PutObject with dangerous ID: %v", err)
	}

	// Verify file was NOT written outside rootDir
	_, err = os.Stat("/etc/passwd.tmp")
	if err == nil {
		t.Fatal("path traversal succeeded — security issue!")
	}
}