import { readFileSync } from 'node:fs';
import { describe, expect, it } from 'vitest';

describe('tenant isolation migration', () => {
  const sql = readFileSync('migrations/0001_infrastructure.up.sql', 'utf8');
  const tables = ['staff_outbox', 'staff_inbox', 'staff_idempotency_keys', 'staff_audit_log'];
  it.each(tables)('%s is tenant scoped and protected by RLS', (table) => {
    const create = sql.slice(sql.indexOf(`CREATE TABLE IF NOT EXISTS ${table}`), sql.indexOf(';', sql.indexOf(`CREATE TABLE IF NOT EXISTS ${table}`)));
    expect(create).toContain('tenant_id VARCHAR(26) NOT NULL');
    expect(sql).toContain(`ALTER TABLE ${table} ENABLE ROW LEVEL SECURITY`);
    expect(sql).toContain(`ALTER TABLE ${table} FORCE ROW LEVEL SECURITY`);
    expect(sql).toMatch(new RegExp(`CREATE POLICY [a-z_]+ ON ${table} `));
  });
  it('sets tenant and actor locally inside each transaction', () => {
    const source = readFileSync('src/infrastructure/database.ts', 'utf8');
    expect(source).toContain("set_config('app.tenant_id', $1, true)");
    expect(source).toContain("set_config('app.user_id', $2, true)");
  });
});