package deployment_test

import (
	"os"
	"path/filepath"
	"regexp"
	"strings"
	"testing"
)

func TestComposeUsesSafeDeploymentDefaults(t *testing.T) {
	root := filepath.Join("..", "..")
	compose := readFile(t, filepath.Join(root, "compose.yml"))
	envExample := readFile(t, filepath.Join(root, ".env.example"))

	for _, required := range []string{
		`${UPSTREAM_URL:?set UPSTREAM_URL}`,
		`${CLICKHOUSE_URL:?set CLICKHOUSE_URL with URL-encoded credentials}`,
		`${CLICKHOUSE_PASSWORD:?set a strong CLICKHOUSE_PASSWORD}`,
	} {
		if !strings.Contains(compose, required) {
			t.Errorf("compose.yml must reject an empty required setting with %q", required)
		}
	}

	if !regexp.MustCompile(`(?m)^\s+image: clickhouse/clickhouse-server:26\.3\s*$`).MatchString(compose) {
		t.Error("ClickHouse image must use version 26.3")
	}

	serviceStart := strings.LastIndex(compose, "  thief_clickhouse:")
	if serviceStart < 0 {
		t.Fatal("compose.yml is missing the thief_clickhouse service")
	}
	clickhouseService := compose[serviceStart:]
	for _, port := range []string{
		`${CLICKHOUSE_LISTEN_IP:-127.0.0.1}:${CLICKHOUSE_HTTP_PORT:-8123}:8123`,
		`${CLICKHOUSE_LISTEN_IP:-127.0.0.1}:${CLICKHOUSE_NATIVE_PORT:-9000}:9000`,
	} {
		if !strings.Contains(clickhouseService, port) {
			t.Errorf("ClickHouse port must bind to loopback by default with %q", port)
		}
	}
	if !strings.Contains(envExample, "CLICKHOUSE_LISTEN_IP=127.0.0.1\n") {
		t.Error(".env.example must bind ClickHouse to loopback by default")
	}

	for _, emptySecret := range []string{"CLICKHOUSE_URL=\n", "CLICKHOUSE_PASSWORD=\n"} {
		if !strings.Contains(envExample, emptySecret) {
			t.Errorf(".env.example must leave %q empty", strings.TrimSpace(emptySecret))
		}
	}
}

func TestReviewDocumentsUseStablePaths(t *testing.T) {
	root := filepath.Join("..", "..")
	for _, path := range []string{
		filepath.Join(root, "docs", "compose", "specs", "reliability-security-fixes.md"),
		filepath.Join(root, "docs", "compose", "plans", "reliability-security-fixes.md"),
	} {
		content := readFile(t, path)
		if !strings.Contains(content, "2026-07-09-clickhouse-migration.md") {
			t.Errorf("%s must link to the dated source document", path)
		}
	}
}

func readFile(t *testing.T, path string) string {
	t.Helper()
	b, err := os.ReadFile(path)
	if err != nil {
		t.Fatal(err)
	}
	return string(b)
}