from pathlib import Path


ROOT = Path(__file__).resolve().parents[2]


def test_compose_does_not_embed_password_or_net_admin_capability():
    compose = (ROOT / "docker-compose.yml").read_text(encoding="utf-8")

    assert "POSTGRES_PASSWORD=pingwatch123" not in compose
    assert "NET_ADMIN" not in compose
    assert "PINGWATCH_BACKEND_BIND" in compose
    assert "VITE_AUTH_ENABLED" in compose


def test_oauth_client_does_not_disable_tls_verification():
    auth_source = (ROOT / "backend" / "app" / "core" / "auth.py").read_text(encoding="utf-8")

    assert "verify=False" not in auth_source