import test from 'node:test';
import assert from 'node:assert/strict';
import { readFile } from 'node:fs/promises';

test('private pilot Compose stack is loopback-bound, isolated, and mock-only', async () => {
  const compose = (await readFile(new URL('../compose.custody-pilot.yaml', import.meta.url), 'utf8')).replaceAll('\r\n', '\n');
  assert.match(compose, /WIKIDECK_NETWORK: pilot/);
  assert.match(compose, /WIKIDECK_PILOT_MODE: private-mock-only/);
  assert.match(compose, /WIKIDECK_PAYMENT_MODE: mock/);
  assert.match(compose, /WIKIDECK_CUSTODY_STORAGE: postgres/);
  assert.match(compose, /WIKIDECK_CUSTODY_MODE: sandbox/);
  assert.match(compose, /WIKIDECK_LOCAL_PG_BOOTSTRAP: sandbox-only/);
  assert.match(compose, /127\.0\.0\.1:\$\{WIKIDECK_PILOT_PORT:-3423\}:3001/);
  assert.match(compose, /financial: \{internal: true\}/);
  assert.match(compose, /pg-runtime:\/secrets\/runtime:ro/);
  assert.doesNotMatch(compose, /POSTGRES_PASSWORD:\s|5432:5432/i);
  assert.doesNotMatch(compose, /^\s+(?:monero|wallet-rpc):/im);
  assert.match(compose, /daemon-check:\n\s+image: wikideck:private-pilot/);
  assert.match(compose, /profiles: \["monero-check"\]/);
  assert.match(compose, /scripts\/monero-daemon-check\.ts/);
  assert.match(compose, /target: \/run\/monero\/daemon\.json\n\s+read_only: true/);
  assert.match(compose, /pilot-observer:\n\s+image: wikideck:private-pilot\n\s+profiles: \["pilot-observer"\]/);
  assert.match(compose, /scripts\/pilot-monero-observe-once\.ts/);
  const observer = compose.split('  pilot-observer:')[1].split('\nnetworks:')[0];
  assert.doesNotMatch(observer, /ports:|depends_on:|pg-runtime:|pg-admin:|pg-owner:/);
  assert.match(observer, /pilot-observation-only-no-credit/);
  assert.match(observer, /target: \/run\/secrets\/pilot-observer-db-url\n\s+read_only: true/);
  assert.match(observer, /target: \/run\/secrets\/observer-client\.key\n\s+read_only: true/);
  assert.match(observer, /networks: \[observer-egress\]/);
  assert.match(observer, /restart: "no"/);
  const database = compose.split('  database:')[1].split('  migrate:')[0];
  assert.doesNotMatch(database, /ports:/);
  const app = compose.split('  wikideck:')[1].split('networks:\n  financial:')[0];
  assert.doesNotMatch(app, /pg-admin:|pg-owner:|pg-tls:/);
});