import { describe, expect, test } from 'bun:test';
import type { NetworkZone } from '../../db/schema';
import { reachabilityHint } from './module-where';

describe('reachabilityHint (ce-jje — role-based, never a literal address)', () => {
  test('internal is reachable directly from the LAN', () => {
    expect(reachabilityHint('internal')).toContain('directly from the internal/home LAN');
  });

  test('external is a public zone reachable at its own address', () => {
    expect(reachabilityHint('external')).toContain('public');
  });

  test('firewall-segmented zones route via the natIp DNAT', () => {
    for (const zone of ['dmz', 'app', 'secure'] as NetworkZone[]) {
      expect(reachabilityHint(zone)).toContain('natIp DNAT');
    }
  });

  test('no hint hardcodes an IP address (CLAUDE.md network-model rule)', () => {
    const zones: NetworkZone[] = ['internal', 'dmz', 'app', 'secure', 'external'];
    for (const zone of zones) {
      expect(reachabilityHint(zone)).not.toMatch(/\d+\.\d+\.\d+\.\d+/);
    }
  });
});