import assert from "node:assert/strict";
import { readFile } from "node:fs/promises";
import test from "node:test";

const migrationUrl = new URL(
  "../migrations/001_device_plane_foundation.sql",
  import.meta.url,
);

test("foundation migration keeps restricted identifiers hashed and DB private", async () => {
  const sql = await readFile(migrationUrl, "utf8");
  assert.match(sql, /identifier_digest text not null/);
  assert.match(sql, /identifier_masked text not null/);
  assert.doesNotMatch(sql, /imei\s+text/i);
  assert.doesNotMatch(sql, /password\s+text/i);
  assert.doesNotMatch(sql, /raw_packet/i);
});

test("foundation migration has quarantine, contour, binding and audit tables", async () => {
  const sql = await readFile(migrationUrl, "utf8");
  for (const table of [
    "device_model_profiles",
    "device_contours",
    "device_discoveries",
    "device_instances",
    "device_bindings",
    "device_audit_events",
  ]) {
    assert.match(sql, new RegExp(`create table if not exists ${table}`));
  }
  assert.match(sql, /default 'quarantine'/);
});