import assert from "node:assert/strict";
import {readFile,readdir} from "node:fs/promises";
import {PGlite} from "../.data/sql-verification/node_modules/@electric-sql/pglite/dist/index.js";
const db=new PGlite();
const id=n=>`00000000-0000-4000-8000-${String(n).padStart(12,"0")}`;
const [owner,other,player,moderator,admin]=[1,2,3,4,5].map(id);
try {
 await db.exec(`create role anon;create role authenticated;create role service_role bypassrls;
 create schema auth;create table auth.users(id uuid primary key);
 create function auth.uid() returns uuid language sql as $$select nullif(current_setting('request.jwt.claim.sub',true),'')::uuid$$;
 create schema storage;create table storage.buckets(id text primary key,name text,public boolean,file_size_limit bigint);
 create publication supabase_realtime;`);
 for(const file of (await readdir("supabase/migrations")).filter(f=>f.endsWith(".sql")).sort()) await db.exec(await readFile(`supabase/migrations/${file}`,"utf8"));
 for(const user of [owner,other,player,moderator,admin]) await db.query("insert into auth.users(id) values($1)",[user]);
 await db.query("insert into public.profiles(id,role) values($1,'contributor'),($2,'contributor'),($3,'contributor'),($4,'moderator'),($5,'admin')",[owner,other,player,moderator,admin]);
 await db.query("update public.profiles set account_status='banned',account_status_version=1 where id in($1,$2)",[owner,other]);
 await db.query("insert into public.account_appeals(owner_id,status_version,reason) values($1,1,'First private appeal reason'),($2,1,'Second private appeal reason')",[owner,other]);
 const visible=async(user)=>{
  await db.query("select set_config('request.jwt.claim.sub',$1,false)",[user]);
  await db.exec("set role authenticated");
  try{return (await db.query("select owner_id from public.account_appeals order by owner_id")).rows.map(r=>r.owner_id);}
  finally{await db.exec("reset role");}
 };
 assert.deepEqual(await visible(owner),[owner],"Banned players can receive only their own history");
 assert.deepEqual(await visible(other),[other]);
 assert.deepEqual(await visible(player),[],"Ordinary players cannot observe the staff queue");
 assert.deepEqual(await visible(moderator),[owner,other]);
 assert.deepEqual(await visible(admin),[owner,other]);
 await db.query("update public.profiles set account_status='banned' where id=$1",[moderator]);
 assert.deepEqual(await visible(moderator),[],"A stale Moderator JWT cannot retain staff access");
 await db.query("select set_config('request.jwt.claim.sub',$1,false)",[admin]);await db.exec("set role authenticated");
 for(const sql of ["update public.account_appeals set state='approved'",`insert into public.account_appeals(owner_id,status_version,reason) values('${owner}',2,'Forged direct write is rejected')`,"delete from public.account_appeals"])
  await assert.rejects(db.query(sql),/permission denied/);
 await db.exec("reset role;set role anon");await assert.rejects(db.query("select * from public.account_appeals"),/permission denied/);await db.exec("reset role");
 const published=(await db.query("select tablename from pg_publication_tables where pubname='supabase_realtime' order by tablename")).rows.map(r=>r.tablename);
 assert.deepEqual(published,["account_appeals","profiles"]);
 console.log("Appeal Realtime SQL checks passed: own history, active staff, revoked staff role/status, denied anonymous reads/direct writes, publication tables.");
} finally {await db.close();}