import { readFileSync } from 'node:fs';
import { describe, expect, it } from 'vitest';

describe('security boundary regressions', () => {
  it('requires section-specific permissions before owner workbook writes', () => {
    const source = readFileSync('src/operations.ts', 'utf8');
    const permissionCheck = source.indexOf("requiredPermissions.add('staff:org_unit:write')");
    const transaction = source.indexOf(
      'const counts = await database.tenantTransaction',
      permissionCheck,
    );
    expect(permissionCheck).toBeGreaterThan(0);
    expect(source.slice(permissionCheck, transaction)).toContain('staff:employee:write');
    expect(source.slice(permissionCheck, transaction)).toContain('staff:metric:write');
    expect(source.slice(permissionCheck, transaction)).toContain('staff:shift:confirm');
    expect(source.slice(permissionCheck, transaction)).toContain('staff:payout:write');
    expect(source.slice(permissionCheck, transaction)).toContain('await auth.require');
  });

  it('does not grant broad authenticated-user access to state or IPC', () => {
    const store = readFileSync('apps/KronaStaffTerminal/Services/TerminalStore.cs', 'utf8');
    const ipc = readFileSync('apps/KronaStaffTerminal/Services/TerminalIpc.cs', 'utf8');
    expect(store).not.toContain('WellKnownSidType.AuthenticatedUserSid');
    expect(store).not.toContain('catch\n        {\n            Directory.CreateDirectory');
    expect(ipc).not.toContain('WellKnownSidType.AuthenticatedUserSid');
    expect(ipc).toContain('IpcRequestAuthenticator');
    expect(store).toContain('return await InitializeFreshStateAsync()');
    expect(store).toContain('FileShare.None');
    expect(store).toContain('await SaveAsync(state)');
  });

  it('enforces active employee status in standalone token resolution', () => {
    const portal = readFileSync('src/portal.ts', 'utf8');
    expect(portal).toContain("employee.status = 'active'");
    const patchRoute = portal.indexOf('api.patch<{ Params: { employeeId: string }');
    const accessRoute = portal.indexOf("'/employees/:employeeId/access-token'", patchRoute);
    expect(portal.slice(patchRoute, accessRoute)).toContain(
      'DELETE FROM staff_standalone_employee_access',
    );
  });

  it('versions payroll formulas independently per organization unit', () => {
    const service = readFileSync('src/domain/payroll/service.ts', 'utf8');
    const migration = readFileSync('migrations/0009_professions.up.sql', 'utf8');
    expect(service.match(/org_unit_id IS NOT DISTINCT FROM \$4::varchar\(26\)/g)).toHaveLength(3);
    expect(service).toContain('pg_advisory_xact_lock');
    expect(migration).toContain('staff_pay_assignments_effective_version_idx');
  });

  it('uses stable external identities for repeatable workbook imports', () => {
    const importer = readFileSync('scripts/import-owner-workbook.py', 'utf8');
    const migration = readFileSync('migrations/0009_professions.up.sql', 'utf8');
    expect(importer).toContain('xlsx:staff:');
    expect(importer).not.toContain('enumerate(names');
    expect(importer).not.toContain('{row}|{date_text}');
    expect(migration).toContain('staff_employees_external_ref_idx');
  });
});