/**
 * P014: lib/db.ts's `getSql()` used to hardcode `ssl: "require"`
 * unconditionally. That is correct for every REAL deployment target this
 * app has (Vercel Postgres, managed Postgres) but made ANY plain,
 * non-TLS Postgres -- compose.dev.yaml's own local-dev container, or a
 * throwaway restore-drill target -- silently unreachable through this
 * function, contradicting compose.dev.yaml's own doc comment and its
 * "UNVERIFIED... not smoke-tested" caveat. Found and fixed while executing
 * P014's real restore drill (see docs/runbook/backup-restore.md).
 */
import { describe, it, expect, beforeEach, afterEach } from "vitest";
import { sslMode } from "@/lib/db";

describe("sslMode", () => {
  const saved = process.env.DATABASE_SSL;
  afterEach(() => {
    if (saved === undefined) delete process.env.DATABASE_SSL;
    else process.env.DATABASE_SSL = saved;
  });
  beforeEach(() => {
    delete process.env.DATABASE_SSL;
  });

  it("defaults to \"require\" when DATABASE_SSL is unset -- unchanged behavior for every real deployment", () => {
    expect(sslMode()).toBe("require");
  });

  for (const value of ["false", "FALSE", "disable", "off", "0", "  false  "]) {
    it(`treats DATABASE_SSL=${JSON.stringify(value)} as an explicit opt-out (false)`, () => {
      process.env.DATABASE_SSL = value;
      expect(sslMode()).toBe(false);
    });
  }

  it("an unrecognized value falls back to the safe default (\"require\"), not an accidental opt-out", () => {
    process.env.DATABASE_SSL = "yes-please";
    expect(sslMode()).toBe("require");
  });
});