from __future__ import annotations

from pathlib import Path

import pytest

from sbom_nexus.config import database_target, migration_role


def test_database_target_prefers_secret_file(monkeypatch, tmp_path: Path) -> None:
    secret = tmp_path / "url"
    secret.write_text("postgresql://mounted-secret\n", encoding="utf-8")
    monkeypatch.setenv("SBOM_NEXUS_DATABASE_URL_FILE", str(secret))
    monkeypatch.setenv("SBOM_NEXUS_DATABASE_URL", "postgresql://environment")

    assert database_target() == "postgresql://mounted-secret"


def test_database_target_rejects_empty_secret_file(monkeypatch, tmp_path: Path) -> None:
    secret = tmp_path / "url"
    secret.write_text("\n", encoding="utf-8")
    monkeypatch.setenv("SBOM_NEXUS_DATABASE_URL_FILE", str(secret))

    with pytest.raises(RuntimeError, match="is empty"):
        database_target()


def test_migration_role_accepts_a_postgres_identifier(monkeypatch) -> None:
    monkeypatch.setenv("SBOM_NEXUS_MIGRATION_ROLE", "sbom_nexus_owner")

    assert migration_role() == "sbom_nexus_owner"


@pytest.mark.parametrize("role", ["owner; DROP DATABASE postgres", "UpperCase", 'bad"role'])
def test_migration_role_rejects_unsafe_identifiers(monkeypatch, role: str) -> None:
    monkeypatch.setenv("SBOM_NEXUS_MIGRATION_ROLE", role)

    with pytest.raises(RuntimeError, match="PostgreSQL identifier"):
        migration_role()