/**
 * TASK-0102 §3: production fail-closed — `NODE_ENV=production` with no
 * ClamAV scanner configured must REFUSE to boot (the worker refuses to
 * start a silently-unscanned pipeline). Dev mode (scan skipped + WARN) is
 * the default when unconfigured.
 */
import { describe, expect, it } from "vitest";
import { assertScannerConfigured } from "../steps/scan.js";
import type { WorkerEnv } from "../../../config.js";

function env(over: Partial<WorkerEnv>): WorkerEnv {
  return {
    NODE_ENV: "development",
    CLAMD_SOCKET: "",
    CLAMAV_HOST: "",
    CLAMAV_PORT: 3310,
    ...over
  } as WorkerEnv;
}

describe("clamav boot gate (TASK-0102 §3 fail closed)", () => {
  it("dev + no scanner → allowed (scan skipped, WARN at run time)", () => {
    expect(() => assertScannerConfigured(env({ NODE_ENV: "development" }))).not.toThrow();
  });

  it("production + no scanner → boot error (fail closed)", () => {
    expect(() => assertScannerConfigured(env({ NODE_ENV: "production" }))).toThrow(
      /requires a ClamAV scanner/i
    );
  });

  it("production + unix socket → allowed", () => {
    expect(() =>
      assertScannerConfigured(env({ NODE_ENV: "production", CLAMD_SOCKET: "/run/clamav/clamd.sock" }))
    ).not.toThrow();
  });

  it("production + TCP host → allowed", () => {
    expect(() =>
      assertScannerConfigured(env({ NODE_ENV: "production", CLAMAV_HOST: "clamav" }))
    ).not.toThrow();
  });
});