//! Invariant: path validation must reject symlink escapes outside CWD.
#![cfg(unix)]

use std::os::unix::fs::symlink;

#[test]
fn rejects_symlink_to_etc_passwd_inside_cwd() {
    let temp = tempfile::tempdir().expect("tempdir");
    let prev = std::env::current_dir().expect("current_dir");
    std::env::set_current_dir(temp.path()).expect("set_current_dir");

    let link_name = "inside-link";
    symlink("/etc/passwd", temp.path().join(link_name)).expect("create symlink");

    let result = envseal_mcp::tools::common::validate_path_within_cwd(link_name, "file");

    std::env::set_current_dir(prev).expect("restore cwd");

    let err = result.expect_err("symlink escape must be rejected");
    assert!(
        err.contains("must not escape the working directory"),
        "unexpected error: {err}"
    );
}
