mock_provider "azurerm" {}
mock_provider "azapi" {}
mock_provider "external" {}

override_data {
  target = data.azurerm_subscription.current
  values = {
    display_name = "data-integration-team-internal-azure"
  }
}

override_resource {
  target          = random_id.deployment
  override_during = plan
  values = {
    hex = "0123456789ab"
  }
}

run "defaults_are_safe" {
  command = plan

  variables {
    port_base = 40000
  }

  assert {
    condition     = var.azure_subscription_id == "7f070020-6caa-4321-a999-2d9cce2a6c17"
    error_message = "Unexpected default Azure subscription."
  }

  assert {
    condition     = alltrue([for port in values(local.ports) : port >= 20000 && port <= 60239])
    error_message = "All externally mapped ports must remain high ports."
  }

  assert {
    condition     = length(distinct(values(local.ports))) == 8
    error_message = "Service ports must be unique."
  }

  assert {
    condition     = var.e2e_project_ids == "1369847559694040763,1369847559694040575"
    error_message = "Azure Private Link Kafka dependencies must retain the expected E2E project IDs."
  }

  assert {
    condition = var.private_link_subscription_ids == toset([
      "7f070020-6caa-4321-a999-2d9cce2a6c17",
      "85b598b9-a080-4476-bc96-ba89e64f92d1",
    ])
    error_message = "The Azure Private Link Service must retain the approved subscription allowlist."
  }

  assert {
    condition     = alltrue([for dependency in local.e2e_kafka_dependencies : keys(dependency.dnsRecords) == [var.kafka_privatelink_availability_zone]])
    error_message = "Azure Kafka dependencies must use a logical availability zone, not a region, as the DNS-record key."
  }

  assert {
    condition     = endswith(local.blob_import_uri, "/import/sql/")
    error_message = "The Azure Blob import URI must target the import/sql/ prefix."
  }

  assert {
    condition = (
      length(file("${path.root}/../../scripts/seeddata/import/csv/test.a.0001.csv")) == 79 &&
      file("${path.root}/../../scripts/seeddata/import/csv/test.a.0001.csv") == "id;name;amount\n1;alice;12.50\n2;bob;3.75\n3;carol;99.99\n4;dave;0.01\n5;erin;42.00\n"
    )
    error_message = "The shared Azure CSV fixture must retain its exact bytes."
  }

  assert {
    condition = (
      file("${path.root}/../../scripts/seeddata/import/csv/test-schema-create.sql") == "CREATE DATABASE IF NOT EXISTS `test`;\n" &&
      file("${path.root}/../../scripts/seeddata/import/csv/test.a-schema.sql") == "CREATE TABLE `test`.`a` (\n  `id` BIGINT NOT NULL,\n  `name` VARCHAR(64) NOT NULL,\n  `amount` DECIMAL(10,2) NOT NULL,\n  PRIMARY KEY (`id`)\n);\n"
    )
    error_message = "The shared import schema fixtures must retain their exact DDL contents."
  }

  assert {
    condition     = azapi_resource.import_container.name == "import"
    error_message = "The Azure storage account must include an import container for dedicated import."
  }

  assert {
    condition = !contains(
      flatten([
        for rule in azapi_resource.expire_test_objects.body.properties.policy.rules : rule.definition.filters.prefixMatch
      ]),
      "import/"
    )
    error_message = "The one-day lifecycle rule must NOT delete the import/ container (it is the dedicated import source)."
  }
}

run "import_output_contract" {
  command = plan

  variables {
    port_base                       = 40000
    desired_state                   = "stopped"
    remove_privatelink_when_stopped = true
  }

  assert {
    condition     = output.object_storage.import_uri == local.blob_import_uri
    error_message = "The object_storage import URI must expose the SQL import prefix."
  }

  assert {
    condition = (
      local.e2e_import_sample_data_azure.sourceURL == local.blob_import_uri &&
      contains(keys(local.e2e_import_sample_data_azure), "sasToken")
    )
    error_message = "The Azure import dependency local contract must wire the SQL source URI and SAS key."
  }
}