"""Tests for core-api T-3's `make dev-test-server` target: it must refuse to
start when the resolved database is not `core_api_test`, before uvicorn ever
binds the port, and it must never print credentials while doing so."""
import os
import socket
import subprocess
from urllib.parse import urlsplit

from tests.conftest import REPO_ROOT

PORT = 8777


def _port_is_free(port: int) -> bool:
    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
        return s.connect_ex(("localhost", port)) != 0


def test_refuses_when_resolved_database_is_not_core_api_test(test_database_url):
    password = urlsplit(test_database_url).password
    wrong = test_database_url.rsplit("/", 1)[0] + "/core_api"

    env = os.environ.copy()
    env["TEST_DATABASE_URL"] = wrong

    result = subprocess.run(
        ["make", "dev-test-server"],
        cwd=str(REPO_ROOT),
        env=env,
        capture_output=True,
        text=True,
        timeout=15,
    )

    combined = result.stdout + result.stderr
    assert result.returncode != 0
    assert "core_api_test" in combined
    if password:
        assert password not in combined
    assert _port_is_free(PORT), "dev-test-server must never bind the port when it refuses"