import { describe, expect, test } from 'bun:test';
import { issueWithDnsChallenge } from './domains';

/**
 * The refusals, which are the part worth testing.
 *
 * The happy path writes to Postgres and talks to NPM, so a test of it would be a test of this machine.
 * What can be silently WRONG is which requests get through: a certificate built for a domain Officer does
 * not know, or one spanning two providers, fails deep inside NPM after a challenge record has already been
 * placed — and the error that comes back is about certbot rather than about the mistake.
 */

describe('issueWithDnsChallenge refuses before it can leave a mess', () => {
  test('no names at all', async () => {
    await expect(issueWithDnsChallenge({ domainNames: [] })).rejects.toThrow(/at least one domain/i);
  });

  test('a name that belongs to no stored domain', async () => {
    await expect(issueWithDnsChallenge({ domainNames: ['not-a-domain-officer-knows.example'] })).rejects.toThrow(
      /add the domain first/i,
    );
  });
});