import { readFileSync } from 'node:fs';
import { describe, expect, it } from 'vitest';
import { parse } from 'yaml';

describe('container deployment boundaries', () => {
  const compose = parse(readFileSync('compose.yaml', 'utf8')) as {
    services: Record<string, { environment?: Record<string, string>; depends_on?: unknown }>;
  };

  it('probes the versioned liveness route', () => {
    expect(readFileSync('Dockerfile', 'utf8')).toContain('/api/v1/staff/live');
    expect(readFileSync('Dockerfile', 'utf8')).not.toMatch(/8080\/live\b/);
  });

  it('does not expose migration credentials to the runtime service', () => {
    const environment = compose.services.app?.environment ?? {};
    expect(environment).not.toHaveProperty('DATABASE_MIGRATION_URL');
    expect(environment).not.toHaveProperty('POSTGRES_MIGRATION_PASSWORD');
    expect(environment).not.toHaveProperty('POSTGRES_APP_PASSWORD');
  });

  it('provisions the app role and migrates before app startup', () => {
    expect(compose.services['db-role']).toBeDefined();
    expect(compose.services.migrate?.depends_on).toHaveProperty('db-role');
    expect(compose.services.app?.depends_on).toHaveProperty('migrate');
  });

  it('removes only the machine terminal state after explicit uninstall confirmation', () => {
    const installer = readFileSync('installer/KronaStaffTerminal.nsi', 'utf8');
    expect(installer).toContain('RMDir /r "$COMMONAPPDATA\\Krona\\StaffTerminal"');
    expect(installer).not.toContain('RMDir /r "$APPDATA\\Krona\\StaffTerminal"');
    expect(installer).not.toContain('RMDir /r "$COMMONAPPDATA\\Krona"');
  });
});