tests/test_production_configuration.py

from __future__ import annotations

import pytest
from pydantic import ValidationError

from app.core.config import Settings


def production_settings(**overrides: object) -> Settings:
    values: dict[str, object] = {
        "_env_file": None,
        "app_environment": "production",
        "database_url": "postgresql+asyncpg://security@db.example/mediarouter",
        "security_database_role": "mediarouter_security_service",
        "cors_allowed_origins": "https://app.example.vercel.app",
        # Social persistence has an additional tenant/worker role boundary.
        # Disable it in the minimal production fixture; dedicated coverage
        # below verifies the enabled contract.
        "social_enabled": False,
    }
    values.update(overrides)
    return Settings(**values)


def test_production_configuration_accepts_external_postgres_and_https_cors() -> None:
    settings = production_settings(
        cors_allowed_origins=(
            "https://app.example.vercel.app, https://preview.example.vercel.app/"
        )
    )

    assert settings.allowed_cors_origins == (
        "https://app.example.vercel.app",
        "https://preview.example.vercel.app",
    )


@pytest.mark.parametrize(
    "database_url",
    [
        "sqlite+aiosqlite:////app/data/mediarouter.db",
        "postgresql+asyncpg://security@localhost/mediarouter",
        "",
    ],
)
def test_production_configuration_rejects_local_or_missing_database(
    database_url: str,
) -> None:
    with pytest.raises(ValidationError, match="external PostgreSQL"):
        production_settings(database_url=database_url)


@pytest.mark.parametrize("origin", ["*", "https://*.vercel.app"])
def test_production_configuration_rejects_wildcard_cors(origin: str) -> None:
    with pytest.raises(ValidationError, match="CORS_ALLOWED_ORIGINS"):
        production_settings(cors_allowed_origins=origin)


def test_production_configuration_rejects_automatic_migrations() -> None:
    with pytest.raises(ValidationError, match="AUTO_MIGRATE must be false"):
        production_settings(security_auto_migrate=True)


def test_social_enabled_requires_explicit_tenant_and_worker_boundaries() -> None:
    with pytest.raises(ValidationError, match="SOCIAL_DATABASE_URL"):
        production_settings(social_enabled=True)

    settings = production_settings(
        social_enabled=True,
        social_database_url="postgresql+asyncpg://tenant@db.example/mediarouter",
        social_tenant_database_role="mediarouter_tenant",
        social_worker_database_url=(
            "postgresql+asyncpg://social_worker@db.example/mediarouter"
        ),
        social_worker_database_role="mediarouter_social_worker",
    )
    assert settings.social_enabled is True


def test_development_keeps_the_existing_sqlite_contract() -> None:
    settings = Settings(_env_file=None, cors_allowed_origins="http://localhost:3000/")

    assert settings.database_url.startswith("sqlite")
    assert settings.allowed_cors_origins == ("http://localhost:3000",)