from __future__ import annotations

import re
from pathlib import Path

ROOT = Path(__file__).resolve().parents[3]
SCRIPT = ROOT / "scripts" / "backup" / "backup-awoooi.sh"


def test_daily_backup_has_no_hardcoded_database_password() -> None:
    text = SCRIPT.read_text(encoding="utf-8")
    assignment = re.search(r"^AWOOOI_DB_PASS=(.+)$", text, re.MULTILINE)

    assert assignment is not None
    assert assignment.group(1) == '"${AWOOOI_DB_PASS:-}"'
    assert "PGPASSWORD='${AWOOOI_DB_PASS}'" not in text
    assert 'PGPASSFILE="$pgpass"' in text
    assert "pg_dump --no-password" in text


def test_daily_backup_fails_closed_without_runtime_credential() -> None:
    text = SCRIPT.read_text(encoding="utf-8")

    assert 'if [ -z "${AWOOOI_DB_PASS}" ]; then' in text
    assert "refusing an unauthenticated or hardcoded fallback" in text