import { describe, expect, test } from 'bun:test';
import { isProtectedRecord, updateZone } from './zone-updater';

describe('namecheap-ddns protected records (e2e-confidence #257)', () => {
  test('celilo.computer apex + www are protected', () => {
    expect(isProtectedRecord('celilo.computer', '@')).toBe(true);
    expect(isProtectedRecord('celilo.computer', '')).toBe(true);
    expect(isProtectedRecord('celilo.computer', 'celilo.computer')).toBe(true);
    expect(isProtectedRecord('celilo.computer', 'www')).toBe(true);
  });

  test('customer DDNS hosts are NOT protected', () => {
    // subdomains of the reserved domain are fine — only the seeded sim records
    // are protected
    expect(isProtectedRecord('celilo.computer', 'app')).toBe(false);
    expect(isProtectedRecord('celilo.computer', 'dns-int.infra')).toBe(false);
    // other domains are entirely customer-managed
    expect(isProtectedRecord('iamtheinternet.org', '@')).toBe(false);
    expect(isProtectedRecord('example.net', 'www')).toBe(false);
  });

  test('updateZone refuses a protected record before touching the filesystem', () => {
    // The guard runs before any readFileSync, so this throws the protection
    // error (not an ENOENT) even with no /config present — proving a DDNS apex
    // clobber of the website-sim can never reach the zone file.
    expect(() => updateZone('celilo.computer', '@', '100.64.0.1')).toThrow(
      /reserved e2e infrastructure/,
    );
    expect(() => updateZone('celilo.computer', 'www', '100.64.0.1')).toThrow(
      /reserved e2e infrastructure/,
    );
  });
});