import { describe, expect, it } from "vitest";
import type { Pool } from "pg";
import { createPublishingRegistry, verifiedDedupeOrigin } from "./registry.js";
import { createPublishingCredentialAccessor } from "./credentials.js";
import type { ConnectorConnection } from "@tactical-media-broadcast-hub/core";
import { runWithPublishingContext } from "./execution-context.js";
const connection: ConnectorConnection = { id: "connection", workspaceId: "workspace", provider: "mastodon", channelId: "channel", fields: {}, createdAt: new Date(), credentialId: { kind: "credential-ref", id: "connection" } };
describe("production publishing registry", () => {
  it("registers real Mastodon and Telegram connectors and rejects duplicates", () => {
    const pool = {} as Pool;
    const registry = createPublishingRegistry(pool);
    expect(registry.list().map((c) => c.manifest().id).sort()).toEqual(["mastodon", "telegram"]);
    expect(registry.get("mastodon").publish).toBeTypeOf("function");
    expect(() => registry.register(registry.get("mastodon"))).toThrow(/already registered/);
  });
  it("trusts only explicitly configured HTTPS origins", () => {
    expect(verifiedDedupeOrigin("https://social.test", "")).toBe(false);
    expect(verifiedDedupeOrigin("https://social.test", "https://social.test")).toBe(true);
    expect(verifiedDedupeOrigin("https://social.test", "https://social.test/path")).toBe(false);
    expect(verifiedDedupeOrigin("http://social.test", "http://social.test")).toBe(false);
  });
  it("refuses absent or mismatched context and publishing credential mutation before SQL", async () => {
    const accessor = createPublishingCredentialAccessor({} as Pool);
    await expect(accessor.getAccessToken(connection)).rejects.toThrow("EXECUTION_CREDENTIAL_FENCE");
    await expect(accessor.put(connection, "access_token", "secret")).rejects.toThrow("MUTATION_REFUSED");
    await expect(runWithPublishingContext({ workspaceId: "other", connectionId: "connection", credentialId: "uuid", credentialGeneration: "1" }, () => accessor.getAccessToken(connection))).rejects.toThrow("EXECUTION_CREDENTIAL_FENCE");
  });
});