import assert from 'node:assert/strict';
import { readFile } from 'node:fs/promises';
import test from 'node:test';

const deployUrl = new URL('../examples/server/forgeflow-deploy', import.meta.url);

test('a signed approved request is consumed once before target selection or mutation', async () => {
  const script = await readFile(deployUrl, 'utf8');
  const verifyIndex = script.indexOf('openssl pkeyutl -verify');
  const consumeIndex = script.indexOf('mkdir -m 0700 "$EVIDENCE_REPLAY_DIR/$APPROVAL_ID"');
  const targetIndex = script.indexOf('APP_DIR=""');
  const resetIndex = script.indexOf('git -C "$APP_DIR" reset --hard "$SHA"');

  assert.ok(verifyIndex > 0);
  assert.ok(consumeIndex > verifyIndex);
  assert.ok(targetIndex > consumeIndex);
  assert.ok(resetIndex > consumeIndex);
  assert.match(script, /EVIDENCE_REPLAY_DIR="\/var\/lib\/forgeflow-status\/approved-requests"/);
  assert.match(script, /install -d -o root -g root -m 0700 "\$EVIDENCE_REPLAY_DIR"/);
  assert.match(script, /Approved deployment evidence was already consumed/);
});