import unittest
from pathlib import Path


ROOT = Path(__file__).resolve().parents[1]
WORKFLOW = (
    ROOT
    / ".github"
    / "workflows"
    / "salesforce-prod-lead-campaign-incremental-sync.yml"
)


class SalesforceProdIncrementalSyncCredentialsTests(unittest.TestCase):
    def test_workflow_exposes_fail_closed_exact_cursor_recovery(self):
        workflow = WORKFLOW.read_text(encoding="utf-8")

        self.assertIn("recover_entry_id:", workflow)
        self.assertIn("recover_expected_queue_sha256:", workflow)
        self.assertIn("DISPATCH_RECOVER_ENTRY_ID", workflow)
        self.assertIn("DISPATCH_RECOVER_EXPECTED_QUEUE_SHA256", workflow)
        self.assertIn("Recover exact dead-letter replay entry", workflow)
        self.assertIn("recover_hourly_delta_replay_entry.py", workflow)
        self.assertIn(
            '--expected-queue-sha256 "${DISPATCH_RECOVER_EXPECTED_QUEUE_SHA256}"',
            workflow,
        )
        self.assertIn("recovery requires DISPATCH_MAX_WINDOWS=1", workflow)
        self.assertIn("salesforce-prod-lead-incremental-recovery.json", workflow)

    def test_workflow_uses_gateway04_github_configuration(self):
        workflow = WORKFLOW.read_text(encoding="utf-8")

        self.assertIn("TIDB_PROD_HOST: ${{ vars.PROD_TIDB_HOST }}", workflow)
        self.assertIn("TIDB_PROD_PORT: ${{ vars.PROD_TIDB_PORT }}", workflow)
        self.assertIn("TIDB_PROD_DATABASE: ${{ vars.PROD_TIDB_DATABASE }}", workflow)
        self.assertIn(
            "TIDB_PROD_USER: ${{ vars.PROD_MIGRATION_TIDB_USER }}",
            workflow,
        )
        self.assertIn(
            "TIDB_PROD_PASSWORD: ${{ secrets.PROD_MIGRATION_TIDB_PASSWORD }}",
            workflow,
        )
        self.assertIn("missing variable PROD_MIGRATION_TIDB_USER", workflow)
        self.assertIn("missing secret PROD_MIGRATION_TIDB_PASSWORD", workflow)
        self.assertIn(
            '[[ "${TIDB_PROD_HOST}" == "gateway04.us-west-2.prod.aws.tidbcloud.com" ]]',
            workflow,
        )
        self.assertIn('[[ "${TIDB_PROD_PORT}" == "4000" ]]', workflow)
        self.assertIn('[[ "${TIDB_PROD_DATABASE}" == "nexuscrm" ]]', workflow)
        self.assertNotIn("PROD_RUNTIME_TIDB_USER", workflow)
        self.assertNotIn("PROD_RUNTIME_TIDB_PASSWORD", workflow)
        self.assertNotIn("SALESFORCE_RECONCILE_TIDB_PROD_PASSWORD", workflow)
        self.assertNotIn("gateway01.us-west-2.prod.aws.tidbcloud.com", workflow)


if __name__ == "__main__":
    unittest.main()