package database

import (
	"context"
	"testing"
	"time"

	"go.uber.org/zap"
)

func TestRunMigrationsRequiresDedicatedConfiguration(t *testing.T) {
	t.Parallel()

	options := MigrationOptions{
		RuntimeRole:  "ariadne_runtime",
		IdentityRole: "ariadne_identity",
		LockTimeout:  time.Second,
	}
	if err := RunMigrations(context.Background(), options, zap.NewNop()); err == nil {
		t.Fatal("RunMigrations() expected a migration URL error")
	}
	options.DatabaseURL = "postgres://unused"
	options.RuntimeRole = ""
	if err := RunMigrations(context.Background(), options, zap.NewNop()); err == nil {
		t.Fatal("RunMigrations() expected a runtime role error")
	}
}

func TestRuntimeTablePermissionsProtectHistory(t *testing.T) {
	t.Parallel()

	tests := []struct {
		table string
		want  string
	}{
		{table: "audit_events", want: permissionAppend},
		{table: "error_occurrences", want: permissionAppend},
		{table: "remediation_approvals", want: permissionAppend},
		{table: "remediation_executions", want: permissionMutate},
		{table: "organization_memberships", want: permissionMutate},
		{table: "projects", want: permissionMutate},
		{
			table: "analysis_target_rule_runtime_environments",
			want:  permissionFullAccess,
		},
	}

	for _, test := range tests {
		test := test
		t.Run(test.table, func(t *testing.T) {
			t.Parallel()
			got, exists := runtimeTablePermissions(test.table)
			if !exists {
				t.Fatalf("runtimeTablePermissions(%q) is not registered", test.table)
			}
			if got != test.want {
				t.Fatalf("runtimeTablePermissions(%q) = %q, want %q", test.table, got, test.want)
			}
		})
	}
}

func TestRuntimeTablePermissionsRejectUnknownTable(t *testing.T) {
	t.Parallel()

	if _, exists := runtimeTablePermissions("unregistered_tenant_table"); exists {
		t.Fatal("runtimeTablePermissions() unexpectedly registered unknown table")
	}
}