import {
  mkdtempSync,
  mkdirSync,
  writeFileSync,
  unlinkSync,
  rmdirSync,
} from 'node:fs';
import { join, resolve } from 'node:path';
import { createHash } from 'node:crypto';
import { execFileSync } from 'node:child_process';

describe('migration history protection', () => {
  it('detects edits to a recorded migration', () => {
    mkdirSync('.tmp', { recursive: true });
    const root = mkdtempSync(resolve('.tmp/migration-policy-'));
    const name = '20260909000000_example';
    const directory = join(root, 'prisma', 'migrations', name);
    mkdirSync(directory, { recursive: true });
    const file = join(directory, 'migration.sql');
    const manifest = join(root, 'prisma', 'migration-checksums.json');
    const sql = 'SELECT 1;\n';
    writeFileSync(file, sql);
    writeFileSync(
      manifest,
      JSON.stringify({
        [name]: createHash('sha256').update(sql).digest('hex'),
      }),
    );
    const run = () =>
      execFileSync(
        process.execPath,
        ['scripts/check-migrations.mjs', '--root=' + root],
        { stdio: 'pipe' },
      );
    try {
      expect(run().toString()).toContain('Verified 1');
      writeFileSync(file, 'SELECT 2;\n');
      expect(run).toThrow();
    } finally {
      unlinkSync(file);
      unlinkSync(manifest);
      rmdirSync(directory);
      rmdirSync(join(root, 'prisma', 'migrations'));
      rmdirSync(join(root, 'prisma'));
      rmdirSync(root);
    }
  });
});