package com.cloudhandson.vpdbackoffice.service;

import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatThrownBy;

import org.junit.jupiter.api.Test;

class SecuritySqlScriptServiceTest {

  private final SecuritySqlScriptService service = new SecuritySqlScriptService();

  @Test
  void exposesOnlyTheCuratedGitTrackedSecurityScripts() {
    assertThat(service.list())
        .extracting(item -> item.fileName())
        .containsExactly(
            "62_kb_aso_masking_backoffice_metadata.sql",
            "63_kb_aso_masking_rule_runtime.sql",
            "64_kb_aso_masking_default_column_rules.sql",
            "65_kb_select_ai_vpd_query_api.sql",
            "66_kb_select_ai_vpd_query_ords.sql"
        );

    assertThat(service.find("select-ai-vpd-ords").source())
        .contains("POST /ords/cb-ords/kb-select-ai-vpd/query")
        .contains("Authorization: Bearer <VPD token>");
  }

  @Test
  void rejectsUnknownScriptIdsInsteadOfResolvingAPathFromRequestInput() {
    assertThatThrownBy(() -> service.find("../../etc/passwd"))
        .isInstanceOf(AppException.class)
        .hasMessageContaining("조회할 수 없는");
  }
}
