import assert from "node:assert/strict";
import { readFile } from "node:fs/promises";
import test from "node:test";

const schemaUrl = new URL(
  "../migrations/008_device_sensitive_references.sql",
  import.meta.url,
);
const commandsUrl = new URL(
  "../migrations/009_device_sensitive_reference_commands.sql",
  import.meta.url,
);
const repositoryUrl = new URL("../src/postgres-repository.mjs", import.meta.url);

test("sensitive reference schema stores only digest, mask and canonical refs", async () => {
  const sql = await readFile(schemaUrl, "utf8");

  assert.match(sql, /create table if not exists device_restricted_identifiers/);
  assert.match(sql, /identifier_digest text not null/);
  assert.match(sql, /identifier_masked text not null/);
  assert.match(sql, /device_restricted_identifiers_active_identity_idx/);
  assert.match(sql, /device_restricted_identifiers_primary_idx/);
  assert.match(sql, /device_identifier_ownership_mismatch/);
  assert.match(sql, /device_active_identifier_ownership_mismatch/);
  assert.match(sql, /deferrable initially deferred/);
  assert.match(sql, /create table if not exists device_credential_bindings/);
  assert.match(sql, /credential_owner = 'ndc_l2_credentials'/);
  assert.match(sql, /\^ndc-credref:/);
  assert.match(sql, /device_credential_binding_ownership_mismatch/);
  assert.match(sql, /device_transfer_active_credential_binding/);
  assert.match(sql, /owner_scope_id is null or credential_ref is null/);
  assert.doesNotMatch(sql, /imei\s+text|serial\s+text|password\s+text|token\s+text/i);
  assert.doesNotMatch(sql, /insert\s+into/i);
});

test("credential commands extend durable receipts after their schema", async () => {
  const commands = await readFile(commandsUrl, "utf8");
  const repository = await readFile(repositoryUrl, "utf8");

  assert.match(commands, /'device_credential_binding\.upsert'/);
  assert.match(commands, /'device_credential_binding\.revoke'/);
  const schemaIndex = repository.indexOf("008_device_sensitive_references.sql");
  const commandsIndex = repository.indexOf(
    "009_device_sensitive_reference_commands.sql",
  );
  assert.notEqual(schemaIndex, -1);
  assert.notEqual(commandsIndex, -1);
  assert.ok(schemaIndex < commandsIndex);
});