const WORKSPACE: &str = include_str!("../../../Cargo.toml");
const STORAGE_MANIFEST: &str = include_str!("../Cargo.toml");
const APPLE_MANIFEST: &str = include_str!("../../apple/Cargo.toml");
const CLI_MANIFEST: &str = include_str!("../../../apps/cli/Cargo.toml");
const TUI_MANIFEST: &str = include_str!("../../../apps/tui/Cargo.toml");
const DESKTOP_MANIFEST: &str = include_str!("../../../apps/desktop/Cargo.toml");
const SSH_SOURCE: &str = include_str!("../src/ssh.rs");
const GIT_SOURCE: &str = include_str!("../src/git.rs");
const AUDIT: &str = include_str!("../../../docs/ssh-transport-audit.md");
const AUDIT_WORKFLOW: &str = include_str!("../../../.gitea/workflows/security-audit.yml");

#[test]
fn release_feature_and_advisory_boundaries_stay_explicit() {
    assert!(WORKSPACE.contains(
        "russh = { version = \"=0.63.1\", default-features = false, features = [\"ring\", \"rsa\"] }"
    ));
    assert!(STORAGE_MANIFEST.contains("ssh = [\"dep:russh\", \"dep:tokio\"]"));
    for manifest in [CLI_MANIFEST, TUI_MANIFEST, DESKTOP_MANIFEST] {
        assert!(manifest.contains("features = [\"ssh\"]"));
    }
    assert!(APPLE_MANIFEST.contains("default-features = false, features = [\"full\"]"));
    assert!(!APPLE_MANIFEST.contains("features = [\"ssh\"]"));
    assert!(AUDIT_WORKFLOW.contains("cargo-audit --locked --version 0.22.2"));
    assert!(AUDIT_WORKFLOW.contains("cargo audit --ignore RUSTSEC-2023-0071"));
    assert!(AUDIT.contains("RUSTSEC-2023-0071"));
}

#[test]
fn production_ssh_transport_has_no_process_unsafe_or_proxy_escape_hatch() {
    let process_command = ["process", "::Command"].concat();
    let command_constructor = ["Command", "::new("].concat();
    let unsafe_block = ["unsafe", " {"].concat();
    for (name, source) in [("ssh.rs", SSH_SOURCE), ("git.rs", GIT_SOURCE)] {
        let production = source.split("#[cfg(test)]").next().unwrap_or(source);
        for forbidden in [
            process_command.as_str(),
            command_constructor.as_str(),
            unsafe_block.as_str(),
            "ProxyCommand",
            "proxy_command",
            "russh_config",
        ] {
            assert!(
                !production.contains(forbidden),
                "{name} contains forbidden production token {forbidden}"
            );
        }
    }
    assert!(SSH_SOURCE.contains("check_server_key"));
    assert!(SSH_SOURCE.contains("verify_known_host"));
    assert!(SSH_SOURCE.contains("MAX_SSH_DIAGNOSTIC_BYTES"));
    assert!(SSH_SOURCE.contains("MAX_CHANNEL_CHUNK"));
}