<?php

namespace Tests\Feature;

use App\Shared\Testing\TestingDatabaseGuard;
use Illuminate\Support\Facades\DB;
use RuntimeException;
use Tests\TestCase;
use Symfony\Component\Process\Process;

final class DatabaseSafetyTest extends TestCase
{
    public function test_test_runner_has_no_cluster_administration_privileges(): void
    {
        $role = DB::selectOne('SELECT rolsuper, rolcreatedb, rolcreaterole, rolbypassrls FROM pg_roles WHERE rolname = current_user');
        $this->assertFalse($role->rolsuper);
        $this->assertFalse($role->rolcreatedb);
        $this->assertFalse($role->rolcreaterole);
        $this->assertFalse($role->rolbypassrls);
        $this->assertFalse(DB::selectOne("SELECT has_database_privilege(current_user, 'sgf_tempo_dev', 'CONNECT') AS allowed")->allowed);
    }

    public function test_guard_rejects_development_before_connecting(): void
    {
        config(['database.connections.unsafe' => array_merge(config('database.connections.pgsql'), ['database' => 'sgf_tempo_dev'])]);
        $this->expectException(RuntimeException::class);
        $this->expectExceptionMessage('SGF_TEST_DATABASE_REFUSED');
        TestingDatabaseGuard::assertSafe('unsafe');
    }

    public function test_guard_rejects_connection_url_overrides(): void
    {
        config(['database.connections.unsafe' => array_merge(config('database.connections.pgsql'), ['url' => 'pgsql://invalid'])]);
        $this->expectException(RuntimeException::class);
        $this->expectExceptionMessage('SGF_TEST_DATABASE_REFUSED');
        TestingDatabaseGuard::assertSafe('unsafe');
    }

    public function test_destructive_cli_command_refuses_the_development_environment(): void
    {
        $process = new Process([PHP_BINARY, 'artisan', 'migrate:fresh', '--env=local', '--no-interaction'], base_path(), [
            'APP_ENV' => 'local', 'DB_CONNECTION' => false, 'DB_HOST' => false,
            'DB_PORT' => false, 'DB_DATABASE' => false, 'DB_USERNAME' => false,
            'DB_PASSWORD' => false, 'DB_URL' => false,
        ]);
        $process->run();
        $this->assertFalse($process->isSuccessful());
        $this->assertStringContainsString('SGF_TEST_DATABASE_REFUSED', $process->getOutput().$process->getErrorOutput());
    }
}