/**
 * Tests for zone policy enforcement
 */

import { describe, expect, it } from 'bun:test';
import type { NetworkZone } from '../db/schema';
import {
  getZoneRequirement,
  getZoneRequirements,
  isZoneRequired,
  validateModuleZoneRequirements,
  validateZoneRequirement,
} from './zone-policy';

describe('zone-policy', () => {
  describe('getZoneRequirement', () => {
    it('returns dmz for public_web capability', () => {
      expect(getZoneRequirement('public_web')).toBe('dmz');
    });

    it('returns null for unknown capability', () => {
      expect(getZoneRequirement('unknown_capability')).toBeNull();
    });

    it('returns null for non-restricted capability', () => {
      expect(getZoneRequirement('my_custom_capability')).toBeNull();
    });
  });

  describe('validateZoneRequirement', () => {
    it('passes when public_web is in dmz zone', () => {
      const result = validateZoneRequirement('public_web', 'dmz');
      expect(result.valid).toBe(true);
      expect(result.error).toBeUndefined();
    });

    it('fails when public_web is in wrong zone', () => {
      const result = validateZoneRequirement('public_web', 'app');
      expect(result.valid).toBe(false);
      expect(result.error).toContain("Capability 'public_web' requires zone='dmz'");
      expect(result.error).toContain("Module specifies zone='app'");
    });

    it('passes for non-restricted capability in any zone', () => {
      const zones: NetworkZone[] = ['internal', 'dmz', 'app', 'secure', 'external'];
      for (const zone of zones) {
        const result = validateZoneRequirement('my_custom_capability', zone);
        expect(result.valid).toBe(true);
        expect(result.error).toBeUndefined();
      }
    });
  });

  describe('validateModuleZoneRequirements', () => {
    it('passes when all capabilities meet zone requirements', () => {
      const result = validateModuleZoneRequirements(['public_web'], 'dmz');
      expect(result.valid).toBe(true);
      expect(result.error).toBeUndefined();
    });

    it('fails when any capability violates zone requirement', () => {
      const result = validateModuleZoneRequirements(['public_web'], 'external');
      expect(result.valid).toBe(false);
      expect(result.error).toContain("Capability 'public_web' requires zone='dmz'");
    });

    it('passes when module provides only non-restricted capabilities', () => {
      const result = validateModuleZoneRequirements(['my_capability', 'another_capability'], 'app');
      expect(result.valid).toBe(true);
      expect(result.error).toBeUndefined();
    });

    it('passes when module provides mix of restricted and non-restricted capabilities in correct zone', () => {
      const result = validateModuleZoneRequirements(['public_web', 'my_custom_capability'], 'dmz');
      expect(result.valid).toBe(true);
      expect(result.error).toBeUndefined();
    });
  });

  describe('isZoneRequired', () => {
    it('returns true when module has infrastructure spec', () => {
      expect(isZoneRequired(true)).toBe(true);
    });

    it('returns false when module has no infrastructure spec', () => {
      expect(isZoneRequired(false)).toBe(false);
    });
  });

  describe('getZoneRequirements', () => {
    it('returns list of all zone requirements', () => {
      const requirements = getZoneRequirements();
      expect(requirements).toContainEqual({ capability: 'public_web', zone: 'dmz' });
      expect(requirements.length).toBeGreaterThanOrEqual(1);
    });
  });
});