from pathlib import Path

ROOT = Path(__file__).resolve().parents[1]


def test_formal_compose_accepts_portainer_environment_without_env_file() -> None:
    compose = ROOT.joinpath("compose.yaml").read_text(encoding="utf-8")

    assert "env_file:" not in compose
    assert "APP_ENCRYPTION_KEY: ${APP_ENCRYPTION_KEY:?" in compose
    assert "${APP_STORAGE_PATH:-./data}:/app/data" in compose
    assert '"${APP_PUBLISH_PORT:-8876}:8765"' in compose
    assert "read_only: true" in compose
    assert "no-new-privileges:true" in compose
    assert "cap_drop:\n      - ALL" in compose


def test_preflight_migrates_before_web_and_cannot_default_to_formal_storage() -> None:
    compose = ROOT.joinpath("compose.preflight.yaml").read_text(encoding="utf-8")

    storage_guard = "${APP_STORAGE_PATH:?APP_STORAGE_PATH must be a dedicated preflight directory}"
    assert storage_guard in compose
    assert "/app/data/legacy-review.db" in compose
    assert "/app/data/xiaobai.db" in compose
    assert "/app/data/migration-report.json" in compose
    assert "condition: service_completed_successfully" in compose
    assert '"${APP_PUBLISH_PORT:-8876}:8765"' in compose
    assert "8765:8765" not in compose