<?php

namespace App\Shared\Testing;

use Illuminate\Support\Facades\DB;
use RuntimeException;

final class TestingDatabaseGuard
{
    public static function assertSafe(?string $connection = null): void
    {
        $name = $connection ?: config('database.default');
        $config = config("database.connections.{$name}", []);
        $expected = [
            'driver' => 'pgsql', 'host' => '127.0.0.1', 'port' => '55432',
            'database' => 'sgf_tempo_test', 'username' => 'sgf_test_runner',
        ];
        foreach ($expected as $key => $value) {
            if ((string) ($config[$key] ?? '') !== $value) {
                throw new RuntimeException('SGF_TEST_DATABASE_REFUSED: apenas sgf_tempo_test no cluster próprio é permitido.');
            }
        }
        if (! empty($config['url']) || ! empty($config['read']) || ! empty($config['write']) || ($config['search_path'] ?? 'public') !== 'public') {
            throw new RuntimeException('SGF_TEST_DATABASE_REFUSED: redireccionamento de ligação não permitido.');
        }
        $identity = DB::connection($name)->selectOne('SELECT current_database() AS db, current_user AS role');
        if ($identity->db !== 'sgf_tempo_test' || $identity->role !== 'sgf_test_runner') {
            throw new RuntimeException('SGF_TEST_DATABASE_REFUSED: destino efectivo inválido.');
        }
    }
}