package connector_oauth

import (
	"os"
	"path/filepath"
	"regexp"
	"strings"
	"testing"
)

func TestRepositoryDeclaresFullPreCallAndFinalizeFence(t *testing.T) {
	var source strings.Builder
	for _, name := range []string{"repository.go", "repository_effect.go"} {
		raw, err := os.ReadFile(name)
		if err != nil {
			t.Fatal(err)
		}
		source.Write(raw)
	}
	for _, required := range []string{
		"SELECT Id FROM User WHERE Id = ? LIMIT 1 FOR UPDATE",
		"PrincipalGeneration = ? AND TokenVersion = ?",
		"RefreshOwnershipEpoch = ? AND BINARY RefreshOwnerId = BINARY ?",
		"RefreshDispatchStartedAt IS NULL",
		"OAuthEffectState = ? AND RefreshDispatchStartedAt IS NOT NULL",
		"OAuthEffectVersion = ? AND OAuthEffectState = ? AND PendingTokenCiphertext = ?",
	} {
		if !strings.Contains(source.String(), required) {
			t.Fatalf("repository lacks required SQL fence %q", required)
		}
	}
}

func TestPackageProductionSourceIsProviderNeutral(t *testing.T) {
	entries, err := os.ReadDir(".")
	if err != nil {
		t.Fatal(err)
	}
	forbidden := regexp.MustCompile(`(?i)\b(gmail|graph|tenant|salesforce)\b`)
	for _, entry := range entries {
		name := entry.Name()
		if entry.IsDir() || !strings.HasSuffix(name, ".go") || strings.HasSuffix(name, "_test.go") {
			continue
		}
		raw, err := os.ReadFile(filepath.Clean(name))
		if err != nil {
			t.Fatal(err)
		}
		if match := forbidden.Find(raw); match != nil {
			t.Fatalf("%s contains provider/product vocabulary %q", name, match)
		}
	}
}