import { describe, expect, it } from 'vitest';
import {
  parseTenantRehomeArgs,
  validateBackupEvidenceObject,
} from '../../scripts/rehome-tenant.mjs';

const source = '01J00000000000000000000001';
const target = '01J00000000000000000000002';
const actor = '01J00000000000000000000003';
const sha256 = 'a'.repeat(64);

describe('tenant rehome argument and evidence validation', () => {
  it('defaults to read-only dry-run and accepts the published CLI aliases', () => {
    expect(parseTenantRehomeArgs(['--from', source, '--to', target, '--json'])).toEqual({
      mode: 'dry-run', source, target, json: true,
    });
    expect(parseTenantRehomeArgs(['--dry-run', '--source', source, '--target', target]).mode).toBe('dry-run');
  });

  it('requires backup evidence for every apply invocation', () => {
    expect(() => parseTenantRehomeArgs(['--apply', '--from', source, '--to', target, '--actor', actor]))
      .toThrow('--backup-evidence is required');
    expect(() => parseTenantRehomeArgs(['--from', source, '--source', source, '--to', target]))
      .toThrow('Duplicate option for source.');
  });

  it('accepts only evidence with encrypted off-host backup and a matching successful restore', () => {
    const fullEvidence = {
      backup: {
        format: 'pg_dump -Fc' as const,
        encrypted: true as const,
        offHost: true as const,
        sha256,
        createdAt: '2026-09-26T08:00:00Z',
      },
      restoreDrill: {
        status: 'passed' as const,
        backupSha256: sha256,
        restoredAt: '2026-09-26T08:30:00Z',
        verifiedAt: '2026-09-26T08:45:00Z',
        isolatedDatabase: 'krona_staff_restore_check',
      },
    };
    expect(validateBackupEvidenceObject(fullEvidence)).toEqual(fullEvidence);
    expect(() => validateBackupEvidenceObject({
      backupSha256: sha256,
      backupCreatedAt: '2026-09-26T08:00:00Z',
      restoreVerifiedAt: '2026-09-26T08:45:00Z',
    })).toThrow('does not attest an encrypted off-host custom dump');
    expect(() => validateBackupEvidenceObject({
      ...fullEvidence,
      restoreDrill: { ...fullEvidence.restoreDrill, backupSha256: 'b'.repeat(64) },
    })).toThrow('does not attest an encrypted off-host custom dump');
  });
});