package main

import (
	"os"
	"strings"
	"testing"
)

func readDeployScript(t *testing.T, path string) string {
	t.Helper()
	raw, err := os.ReadFile(path)
	if err != nil {
		t.Fatal(err)
	}
	return string(raw)
}

func TestDeployAdminPowerShell_固定提交隔离构建且支持WhatIf(t *testing.T) {
	source := readDeployScript(t, "deploy/deploy-admin.ps1")
	for _, want := range []string{
		"SupportsShouldProcess = $true",
		"\"archive\", \"--format=tar\"",
		"$env:GOTOOLCHAIN = \"go1.23.0\"",
		"$env:GOOS = \"linux\"",
		"$env:GOARCH = \"amd64\"",
		"$env:CGO_ENABLED = \"0\"",
		"BatchMode=yes",
		"StrictHostKeyChecking=yes",
		"AllowSchemaMigration",
	} {
		if !strings.Contains(source, want) {
			t.Errorf("本地部署脚本缺少关键安全步骤 %q", want)
		}
	}
}

func TestDeployAdminRemote_备份预检原子切换和失败回退(t *testing.T) {
	source := readDeployScript(t, "deploy/deploy-admin-remote.sh")
	for _, want := range []string{
		"check_active_jobs",
		"mysqldump --defaults-extra-file=",
		"gzip -t",
		"preflight_port=\"18083\"",
		"current_schema < target_schema",
		"allow_migration",
		"install -d -o root -g cmautobuy -m 0750 \"$release_root\"",
		"install -d -o root -g cmautobuy -m 0750 \"$release_dir\"",
		"mv -Tf \"$temporary_link\" \"$stable_binary\"",
		"restore_previous_release",
		"数据库迁移不会自动回滚",
		"nginx -t",
	} {
		if !strings.Contains(source, want) {
			t.Errorf("远端部署脚本缺少关键安全步骤 %q", want)
		}
	}
}

func TestDeployScripts_不降低传输安全或写死凭据(t *testing.T) {
	source := readDeployScript(t, "deploy/deploy-admin.ps1") + "\n" +
		readDeployScript(t, "deploy/deploy-admin-remote.sh")
	for _, forbidden := range []string{
		"StrictHostKeyChecking=no",
		"--no-check-certificate",
		"curl -k",
		"CMAUTOBUY_DB_PASSWORD=",
		"Authorization:",
	} {
		if strings.Contains(source, forbidden) {
			t.Errorf("部署脚本包含禁止内容 %q", forbidden)
		}
	}
}