package api
import (
"os"
"path/filepath"
"strings"
"testing"
"craftdesign.group/quarry/internal/oltp"
"craftdesign.group/quarry/internal/uv"
)
// A sync token ceilinged to y (RFC 0021) signs a stock fossil client's
// unversioned push, and the same token signing a check-in is refused
// whole: the login card resolves to y without i, and the gate moved to
// the cards.
func TestAYOnlyTokenPushesUnversionedButNotCheckIns(t *testing.T) {
g := newUVFossilRig(t, 1<<20)
// The forge's own credential store behind the front, in place of the
// rig's password fake.
g.db.SyncProjectCode = func(string) (string, bool) { return g.code, true }
if err := g.db.AddAccount("pub", "pw-pub-unused", false); err != nil {
t.Fatal(err)
}
if err := g.db.SetCaps("pub", "test", "oiy"); err != nil {
t.Fatal(err)
}
token, _, err := g.db.MintToken("pub", oltp.TokenSpec{Name: "release", Scopes: []string{oltp.ScopeSync}, Ceiling: "y"})
if err != nil {
t.Fatal(err)
}
g.front.SetAuth(g.db)
withToken := strings.Replace(g.base, "http://", "http://pub:"+token+"@", 1)
a := g.clone("a")
g.uvAdd(a, "release.tar", "bytes\n", "2026-01-01 00:00:00")
out, err := g.fossil(filepath.Dir(a), "sync", "-u", withToken, "-R", a)
o, inBucket := g.objects.has(uv.Key("test", "release.tar"))
check(t, err == nil && inBucket && string(o.body) == "bytes\n",
"a y-only token publishes an unversioned file",
"uv push with a y-only token: err %v, in bucket %v\n%s", err, inBucket, out)
co := t.TempDir()
g.must(co, "settings", "autosync", "off", "-R", a)
g.must(co, "open", a, "--nosync")
if err := os.WriteFile(filepath.Join(co, "NEW.md"), []byte("by a uv token\n"), 0o644); err != nil {
t.Fatal(err)
}
g.must(co, "add", "NEW.md")
g.fossil(co, "commit", "-m", "by a uv token", "--no-warnings")
out, _ = g.fossil(co, "push", withToken, "--once")
check(t, !strings.Contains(g.timeline(), "by a uv token") && strings.Contains(out, "unversioned files only"),
"the same token pushing a check-in is refused whole",
"check-in push with a y-only token:\n%s", out)
}