package main

import (
	"path/filepath"
	"testing"
)

func TestResolveDatabasePasswordRejectsDirectEnvironmentSecret(t *testing.T) {
	t.Setenv("WORK_POSTGRES_PASSWORD", "literal-secret")
	if _, err := resolveDatabasePassword(); err == nil {
		t.Fatal("direct database password environment variable was accepted")
	}
}

func TestResolveDatabasePasswordRejectsPathOutsideProtectedRoot(t *testing.T) {
	root := t.TempDir()
	t.Setenv("SECRET_BACKEND_ROOT", root)
	t.Setenv("WORK_POSTGRES_PASSWORD_FILE", filepath.Join(root, "..", "outside"))
	t.Setenv("WORK_POSTGRES_CREDENTIAL_REF", "credential://domovoy/work/db-password/v1")
	if _, err := resolveDatabasePassword(); err == nil {
		t.Fatal("database password path outside protected root was accepted")
	}
}