from pathlib import Path


MIGRATION = Path(
    "migrations/versions/20260718_50_datasource_credentials.py"
)


def test_datasource_credential_migration_is_encrypted_and_versioned():
    assert MIGRATION.exists(), "encrypted credential migration is missing"

    source = MIGRATION.read_text(encoding="utf-8")

    assert "datasource_credentials" in source
    assert "encrypted_payload" in source
    assert "nonce" in source
    assert "key_version" in source
    assert "credential_version" in source
    assert "UNIQUE (data_source_uid, credential_version)" in source
    assert "password VARCHAR" not in source
    assert "connection_url" not in source


def test_datasource_credential_migration_has_safe_audit_and_preserving_rollback():
    assert MIGRATION.exists(), "encrypted credential migration is missing"

    source = MIGRATION.read_text(encoding="utf-8")

    assert "datasource_credential_audit_events" in source
    assert "safe_detail" in source
    assert "def downgrade()" in source
    assert "DROP TABLE" not in source
