import assert from "node:assert/strict";
import { readFile } from "node:fs/promises";
import test from "node:test";

const migrationUrl = new URL(
  "../migrations/003_device_management_commands.sql",
  import.meta.url,
);
const repositoryUrl = new URL("../src/postgres-repository.mjs", import.meta.url);

test("management migration pins idempotency, audit and owner invariants", async () => {
  const sql = await readFile(migrationUrl, "utf8");

  assert.match(sql, /device_project_grants_owner_user_only/);
  assert.match(sql, /project_role <> 'owner' or principal_kind = 'user'/);
  assert.match(sql, /add column if not exists project_id uuid references device_projects\(id\)/);
  assert.match(sql, /create table if not exists device_management_command_receipts/);
  assert.match(sql, /unique \(actor_ref, command_kind, idempotency_key\)/);
  assert.match(sql, /request_digest ~ '\^sha256:\[a-f0-9\]\{64\}\$'/);
  assert.match(sql, /lifecycle_state in \('pending', 'completed'\)/);
});

test("management migration stores no tenant, device or credential seed", async () => {
  const sql = await readFile(migrationUrl, "utf8");

  assert.doesNotMatch(sql, /insert\s+into/i);
  assert.doesNotMatch(sql, /dcctouch|arusnavi|b2|imei/i);
  assert.doesNotMatch(sql, /password|secret|credential_ref/i);
});

test("repository applies management migration after project access", async () => {
  const source = await readFile(repositoryUrl, "utf8");
  const projectAccessIndex = source.indexOf("002_device_project_access.sql");
  const managementIndex = source.indexOf("003_device_management_commands.sql");

  assert.notEqual(projectAccessIndex, -1);
  assert.notEqual(managementIndex, -1);
  assert.ok(projectAccessIndex < managementIndex);
});