import { readFileSync } from 'node:fs';
import path from 'node:path';
import { describe, expect, it } from 'vitest';

const projectRoot = process.cwd();
const compose = readFileSync(path.join(projectRoot, 'compose.yaml'), 'utf8');
const containerfile = readFileSync(
  path.join(projectRoot, 'Containerfile.release'),
  'utf8'
);
const releaseLock = JSON.parse(
  readFileSync(path.join(projectRoot, 'release', 'toolbox.lock.json'), 'utf8')
) as { releaseVersion: string };

describe('production deployment', () => {
  it('keeps the release version and checksum pins synchronized', () => {
    const containerVersion = containerfile.match(
      /^ARG TOOLBOX_RELEASE_VERSION=(\S+)$/mu
    )?.[1];
    const composeVersion = compose.match(
      /\$\{TOOLBOX_RELEASE_VERSION:-([^}]+)\}/u
    )?.[1];
    const containerChecksum = containerfile.match(
      /^ARG TOOLBOX_RELEASE_SHA256=([a-f0-9]{64})$/mu
    )?.[1];
    const composeChecksum = compose.match(
      /\$\{TOOLBOX_RELEASE_SHA256:-([a-f0-9]{64})\}/u
    )?.[1];

    expect(containerVersion).toBe(releaseLock.releaseVersion);
    expect(composeVersion).toBe(containerVersion);
    expect(composeChecksum).toBe(containerChecksum);
  });

  it('verifies the release before extraction and retains a rootless final image', () => {
    expect(containerfile).toContain("--proto-redir '=https' --tlsv1.2");
    expect(containerfile.indexOf('sha256sum -c -')).toBeGreaterThan(0);
    expect(containerfile.indexOf('unzip -q')).toBeGreaterThan(
      containerfile.indexOf('sha256sum -c -')
    );
    expect(containerfile).toContain(
      'COPY --from=release --chown=101:101 /tmp/toolbox/'
    );
    expect(containerfile).toMatch(/\nUSER 101:101\nEXPOSE 8080\n/u);
  });

  it('uses only the requested external Traefik network and HTTPS router', () => {
    expect(compose).toContain('dockerfile: Containerfile.release');
    expect(compose).toContain('traefik.enable: "true"');
    expect(compose).toContain(
      'traefik.docker.network: "${TRAEFIK_NETWORK:-internal}"'
    );
    expect(compose).toContain(
      'traefik.http.routers.addideas-toolbox.rule: "Host(`${TOOLBOX_HOST:-toolbax.add-ideas.de}`)"'
    );
    expect(compose).toContain(
      'traefik.http.routers.addideas-toolbox.entrypoints: websecure'
    );
    expect(compose).toContain(
      'traefik.http.routers.addideas-toolbox.tls.certresolver: "${TRAEFIK_CERT_RESOLVER:-netcup}"'
    );
    expect(compose).toContain('external: true');
    expect(compose).not.toMatch(/^\s+ports:/mu);
  });
});