import { readFile } from "node:fs/promises";
import { describe, expect, it } from "vitest";

describe("PostgreSQL application-role privilege contract", () => {
  it("uses explicit current-object grants and no blanket future-object grants", async () => {
    const source = await readFile(new URL("../scripts/migrate-postgres.mjs", import.meta.url), "utf8");
    expect(source).toContain('["billing_wallets", "SELECT, INSERT, UPDATE"]');
    expect(source).toContain('["billing_ledger", "SELECT, INSERT"]');
    expect(source).toContain("applicationRoleTablePrivileges().map");
    expect(source).toContain("REVOKE ALL ON TABLE");
    expect(source).not.toContain("ALTER DEFAULT PRIVILEGES");
    expect(source).not.toContain("ALL FUNCTIONS IN SCHEMA");
  });
});