import test from 'node:test';
import assert from 'node:assert/strict';
import { mkdtemp, writeFile, chmod, rm } from 'node:fs/promises';
import { join } from 'node:path';
import { tmpdir } from 'node:os';
import { postgresConfig } from '../server/market/postgres-config.ts';

test('PostgreSQL verified TLS remains the default and cannot be downgraded through URL options', async t => {
  const dir = await mkdtemp(join(tmpdir(), 'wikideck-transport-'));
  t.after(() => rm(dir, { recursive: true, force: true }));
  const file = join(dir, 'connection');
  // Synthetic configuration fixture, never sent to a database.
  await writeFile(file, 'postgresql://fixture:fixture-only@database.cluster.example/custody', { mode: 0o600 });
  const env = { WIKIDECK_CUSTODY_PG_URL_FILE: file };
  const config = await postgresConfig(env);
  assert.equal((config.ssl as { rejectUnauthorized: boolean }).rejectUnauthorized, true);
  assert.deepEqual(config.ssl, (await postgresConfig({ ...env, WIKIDECK_CUSTODY_PG_TRANSPORT: 'tls' })).ssl);
  for (const mode of ['', 'off', 'disable', 'false', 'mesh', 'TLS']) {
    await assert.rejects(postgresConfig({ ...env, WIKIDECK_CUSTODY_PG_TRANSPORT: mode }), /configuration/);
  }
  if (process.platform !== 'win32') {
    await chmod(file, 0o644);
    await assert.rejects(postgresConfig(env), /configuration/);
    await chmod(file, 0o600);
  }
  await writeFile(file, 'postgresql://fixture:fixture-only@database.cluster.example/custody?sslmode=disable');
  await assert.rejects(postgresConfig(env), /configuration/);
});

test('infrastructure-managed transport requires exact opt-in and rejects mixed TLS/test configuration', async t => {
  const dir = await mkdtemp(join(tmpdir(), 'wikideck-infrastructure-'));
  t.after(() => rm(dir, { recursive: true, force: true }));
  const file = join(dir, 'connection');
  await writeFile(file, 'postgresql://fixture:fixture-only@database.cluster.example/custody', { mode: 0o600 });
  const env = { WIKIDECK_CUSTODY_PG_URL_FILE: file, WIKIDECK_CUSTODY_PG_TRANSPORT: 'infrastructure' };
  await assert.rejects(postgresConfig(env), /configuration/);
  for (const ack of ['', 'true', 'firewall', 'encrypted-authenticated-path-enforced ']) {
    await assert.rejects(postgresConfig({ ...env, WIKIDECK_CUSTODY_PG_INFRASTRUCTURE_ACK: ack }), /configuration/);
  }
  const approved = { ...env, WIKIDECK_CUSTODY_PG_INFRASTRUCTURE_ACK: 'encrypted-authenticated-path-enforced' };
  assert.equal((await postgresConfig(approved)).ssl, false);
  for (const conflict of [{ WIKIDECK_CUSTODY_PG_CA_FILE: file }, { WIKIDECK_CUSTODY_PG_LOCAL_TEST: '1' }]) {
    await assert.rejects(postgresConfig({ ...approved, ...conflict }), /configuration/);
  }
  await assert.rejects(postgresConfig({ ...approved, WIKIDECK_CUSTODY_PG_TRANSPORT: 'tls' }), /configuration/);
  await writeFile(file, 'postgresql://fixture@database.cluster.example/custody');
  await assert.rejects(postgresConfig(approved), /configuration/); // Password auth remains mandatory.
  await writeFile(file, 'postgresql://fixture:fixture-only@database.cluster.example/custody?sslmode=require');
  await assert.rejects(postgresConfig(approved), /configuration/);
});