"""Tag-name validation in the Gitea release provider.

Whitelist regex protects the URL we broadcast to clients from any path
traversal or character-set abuse in a hostile (or MITM'd) upstream response.
"""

from __future__ import annotations

from media_server.services.gitea_release_provider import _TAG_RE


def test_accepts_plain_semver():
    assert _TAG_RE.match("1.0.0")
    assert _TAG_RE.match("v1.0.0")
    assert _TAG_RE.match("0.3.7")


def test_accepts_pre_release_suffix():
    assert _TAG_RE.match("v1.0.0-alpha.1")
    assert _TAG_RE.match("v2.3.4-rc.10")
    assert _TAG_RE.match("v0.2.7+build.42")


def test_rejects_path_traversal():
    assert not _TAG_RE.match("../etc/passwd")
    assert not _TAG_RE.match("v1.0.0/../../evil")
    assert not _TAG_RE.match("v1.0.0/secret")


def test_rejects_url_injection():
    assert not _TAG_RE.match("v1.0.0?evil=1")
    assert not _TAG_RE.match("v1.0.0#frag")
    assert not _TAG_RE.match("v1.0.0 OR 1=1")
    assert not _TAG_RE.match("https://evil.example/")


def test_rejects_empty_and_garbage():
    assert not _TAG_RE.match("")
    assert not _TAG_RE.match("not-a-version")
    assert not _TAG_RE.match("v")


def test_rejects_excessively_long_suffix():
    long_suffix = "x" * 40
    assert not _TAG_RE.match(f"v1.0.0-{long_suffix}")
