# base/tests/sicherheit.tftest.hcl
mock_provider "azurerm" {}

run "subnetz_ohne_impliziten_internetzugang" {
  command = plan

  assert {
    condition     = azurerm_subnet.app.default_outbound_access_enabled == false
    error_message = "Das App-Subnetz darf keinen impliziten Outbound-Zugang haben."
  }
}

run "kein_ssh_in_der_nsg" {
  command = plan

  assert {
    condition = alltrue([
      for r in azurerm_network_security_group.app.security_rule :
      r.destination_port_range != "22"
    ])
    error_message = "Die NSG darf SSH (Port 22) nicht freigeben – Nutzvieh wird nicht gestreichelt."
  }
}

run "namenskonvention" {
  command = plan

  variables {
    prefix = "iaclab"
  }

  assert {
    condition     = azurerm_resource_group.base.name == "rg-iaclab-base"
    error_message = "Ressourcengruppen folgen dem Schema rg-<prefix>-<schicht>."
  }
}