Describe 'Azure Network Security Perimeter Workshop package' {
    BeforeAll {
        $projectRoot = Split-Path -Parent $PSScriptRoot
    }

    It 'pins the requested Terraform and provider versions' {
        $terraform = Get-Content -Raw -LiteralPath (Join-Path $projectRoot 'terraform.tf')
        $terraform | Should -Match 'required_version\s*=\s*"= 1\.15\.8"'
        $terraform | Should -Match 'version\s*=\s*"= 4\.79\.0"'
        $terraform | Should -Match 'version\s*=\s*"= 2\.11\.0"'
        $terraform | Should -Match 'version\s*=\s*"= 3\.9\.0"'
        $terraform | Should -Match 'version\s*=\s*"= 4\.3\.0"'
    }

    It 'rejects unrecognized association modes' {
        $variables = Get-Content -Raw -LiteralPath (Join-Path $projectRoot 'variables.tf')
        $variables | Should -Match 'contains\(\["Learning", "Enforced"\]'
    }

    It 'requires an explicit subscription list for the final rule' {
        $locals = Get-Content -Raw -LiteralPath (Join-Path $projectRoot 'locals.tf')
        $locals | Should -Match 'length\(var\.allowed_subscription_ids\) > 0'
    }

    It 'keeps all private runtime material under the ignored work directory' {
        $ignore = Get-Content -Raw -LiteralPath (Join-Path $projectRoot '.gitignore')
        $ignore | Should -Match '(?m)^work/$'
        $ignore | Should -Match '\*\.tfstate'
        $ignore | Should -Match '\*\.tfplan'
    }

    It 'contains the staged entry points' {
        @(
            'Start-AzureNetworkSecurityPerimeterWorkshop.ps1',
            'Test-AzureNetworkSecurityPerimeter.ps1',
            'Get-AzureNetworkSecurityPerimeterEvidence.ps1',
            'Remove-AzureNetworkSecurityPerimeterWorkshop.ps1'
        ) | ForEach-Object {
            Join-Path $projectRoot $_ | Should -Exist
        }
    }
}
