import { describe, expect, it } from "vitest";
import {
  assertSafeTestDatabaseUrl,
  assertSeedDatabaseAllowed,
} from "../../prisma/database-safety";

describe("test database safety guard", () => {
  it.each([
    "postgresql://drift:secret@db.example.com/app_test",
    "postgresql://drift:secret@127.0.0.1/production",
    "not a url",
  ])("rejects unsafe DATABASE_URL without exposing it: %s", (url) => {
    expect(() => assertSafeTestDatabaseUrl(url)).toThrowError(
      "Refusing database operation: DATABASE_URL must target localhost or 127.0.0.1 and a database ending in _test.",
    );
    try {
      assertSafeTestDatabaseUrl(url);
    } catch (error) {
      expect(String(error)).not.toContain(url);
      expect(String(error)).not.toContain("secret");
    }
  });

  it.each([
    "postgresql://drift:secret@localhost:55432/drift_bottle_test?schema=public",
    "postgresql://drift:secret@127.0.0.1:55432/drift_bottle_test",
  ])("accepts an isolated local test database: %s", (url) => {
    expect(() => assertSafeTestDatabaseUrl(url)).not.toThrow();
  });

  it("requires explicit authorization before seeding a non-test database", () => {
    const productionUrl = "postgresql://drift:secret@db.example.com/production";
    expect(() => assertSeedDatabaseAllowed(productionUrl, {})).toThrow();
    expect(() =>
      assertSeedDatabaseAllowed(productionUrl, {
        ALLOW_SEED_NON_TEST_DATABASE: "true",
      }),
    ).not.toThrow();
  });
});