import { describe, expect, it } from "vitest";

import {
  createPostgresPool,
  getScriptDataBackend,
  quotePostgresIdentifier
} from "../scripts/postgres-client.mjs";

describe("PostgreSQL script configuration", () => {
  it("requires an explicit data backend", () => {
    expect(() => getScriptDataBackend({ NODE_ENV: "test" })).toThrow("ZHINIAN_DATA_BACKEND");
    expect(getScriptDataBackend({ NODE_ENV: "test", ZHINIAN_DATA_BACKEND: "postgres" })).toBe("postgres");
  });

  it("rejects connection-string SSL options that could override the verified CA configuration", () => {
    expect(() => createPostgresPool({
      env: {
        NODE_ENV: "test",
        ZHINIAN_DATA_BACKEND: "postgres",
        DATABASE_URL: "postgresql://app:secret@rds.example:5432/app?sslmode=no-verify"
      }
    })).toThrow("must not contain SSL query parameters");
  });

  it("quotes PostgreSQL role identifiers without allowing SQL syntax injection", () => {
    expect(quotePostgresIdentifier("zhinian_app")).toBe('"zhinian_app"');
    expect(() => quotePostgresIdentifier('app"role')).toThrow("identifier");
    expect(() => quotePostgresIdentifier("bad\0role")).toThrow("identifier");
  });
});