import assert from 'node:assert/strict';
import fs from 'node:fs';
import {
  parseBackendRuntimeRoleBootstrapOptions,
} from './bootstrap-backend-runtime-roles.js';

const sql = fs.readFileSync('scripts/deploy/sql/bootstrap-backend-runtime-roles.sql', 'utf8');
const migration = fs.readFileSync('supabase/migrations/202607120013_backend_runtime_roles.sql', 'utf8');

assert.deepEqual(
  parseBackendRuntimeRoleBootstrapOptions([], {}),
  { apply: false, adminUrl: '', confirmation: '', json: false },
);
assert.throws(
  () => parseBackendRuntimeRoleBootstrapOptions(['--apply'], {}),
  /DATABASE_ADMIN_URL is required/,
);
assert.throws(
  () => parseBackendRuntimeRoleBootstrapOptions(['--apply'], {
    DATABASE_ADMIN_URL: ['postgresql:', '//admin:secret@db.test/postgres'].join(''),
  }),
  /BOOTSTRAP_BACKEND_RUNTIME_ROLES/,
);
assert.match(sql, /alter role tiku_api[\s\S]*bypassrls/i);
assert.match(sql, /alter role tiku_worker[\s\S]*bypassrls/i);
for (const extensionName of ['pgcrypto', 'citext', 'ltree', 'pg_trgm']) {
  assert.ok(sql.includes(`'${extensionName}'::name`), `${extensionName} must be managed by the privileged bootstrap`);
}
assert.match(
  sql,
  /if not found then[\s\S]*create extension %I with schema extensions/i,
  'privileged bootstrap must install extensions before normal migrations can create them with unsafe defaults',
);
assert.match(sql, /alter extension %I set schema extensions/i);
assert.match(sql, /grant usage on schema extensions to tiku_api, tiku_worker/i);
assert.match(sql, /search_path = pg_catalog, public, extensions/i);
assert.match(sql, /pg_auth_members[\s\S]*revoke %I from %I/i);
assert.match(
  sql,
  /revoke execute on all functions in schema public[\s\S]*from public, anon, authenticated, tiku_api, tiku_worker/i,
);
assert.match(
  sql,
  /revoke execute on all functions in schema extensions[\s\S]*from public, anon, authenticated, tiku_api, tiku_worker/i,
);
for (const trustedRole of [
  'postgres',
  'service_role',
  'dashboard_user',
  'supabase_auth_admin',
  'supabase_storage_admin',
  'supabase_realtime_admin',
  'supabase_functions_admin',
]) {
  assert.ok(sql.includes(`'${trustedRole}'::name`), `${trustedRole} must retain extension execution when present`);
}
assert.match(
  sql,
  /alter default privileges for role %I revoke execute on functions from public, anon, authenticated, tiku_api, tiku_worker/i,
);
assert.match(sql, /extension\.extname in \('citext', 'ltree', 'pg_trgm'\)[\s\S]*grant execute on function %s to tiku_api, tiku_worker/i);
assert.doesNotMatch(sql, /password\s+['"]/i, 'bootstrap must preserve externally managed passwords');

assert.doesNotMatch(migration, /create role tiku_api|alter role tiku_api/i);
assert.match(migration, /Runtime role % is missing[\s\S]*bootstrap-backend-runtime-roles\.js/i);
assert.match(migration, /not role_state\.rolbypassrls/i);

console.log('[PASS] privileged backend runtime role bootstrap contract');