# Local Confluent Platform stack for integration testing mcp-confluent.
#
# Usage:
#   docker compose -f docker-compose.cp-test.yml up -d
#   # Wait ~30s for Kafka + SR to become ready
#   RUN_CP_INTEGRATION=1 npm run test -- src/cp-integration.test.ts
#   docker compose -f docker-compose.cp-test.yml down -v
#
# Notes:
# - Kafka uses SASL_PLAINTEXT/PLAIN (not SASL_SSL) to avoid cert setup.
#   The mcp-confluent Kafka client code path is identical for the two;
#   only security.protocol differs, and the test overrides it via
#   extra_properties.
# - Schema Registry runs unauthenticated for simplicity. Clients that
#   send Basic Auth headers work fine; SR just ignores them.

services:
  kafka:
    image: confluentinc/cp-kafka:7.6.1
    hostname: kafka
    container_name: mcp-cp-test-kafka
    ports:
      - "9092:9092"
    environment:
      KAFKA_NODE_ID: 1
      KAFKA_PROCESS_ROLES: "broker,controller"
      KAFKA_LISTENERS: "SASL_PLAINTEXT://0.0.0.0:9092,CONTROLLER://0.0.0.0:9093"
      KAFKA_ADVERTISED_LISTENERS: "SASL_PLAINTEXT://localhost:9092"
      KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: "SASL_PLAINTEXT:SASL_PLAINTEXT,CONTROLLER:PLAINTEXT"
      KAFKA_CONTROLLER_LISTENER_NAMES: "CONTROLLER"
      KAFKA_CONTROLLER_QUORUM_VOTERS: "1@kafka:9093"
      KAFKA_INTER_BROKER_LISTENER_NAME: "SASL_PLAINTEXT"
      KAFKA_SASL_ENABLED_MECHANISMS: "PLAIN"
      KAFKA_SASL_MECHANISM_INTER_BROKER_PROTOCOL: "PLAIN"
      # cp-kafka's `configure` step runs `dub ensure KAFKA_OPTS` whenever SASL
      # appears in the advertised listeners and aborts startup if it is unset.
      # The JAAS login is supplied per-listener below, so this only needs to be
      # a harmless non-empty JVM flag to satisfy that guard.
      KAFKA_OPTS: "-Dmcp.cp.test=1"
      # cp-docker translates env-var keys to properties with `_` -> `.` and
      # `__` -> `_`. The listener is named SASL_PLAINTEXT (literal underscore),
      # so its per-listener JAAS key must double the underscore between SASL and
      # PLAINTEXT; a single underscore yields `listener.name.sasl.plaintext...`,
      # which Kafka ignores, dropping back to a missing global JAAS file.
      KAFKA_LISTENER_NAME_SASL__PLAINTEXT_PLAIN_SASL_JAAS_CONFIG: >-
        org.apache.kafka.common.security.plain.PlainLoginModule required
        username="admin" password="admin-secret"
        user_admin="admin-secret"
        user_mcp="mcp-secret";
      KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
      KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: 1
      KAFKA_TRANSACTION_STATE_LOG_MIN_ISR: 1
      KAFKA_AUTO_CREATE_TOPICS_ENABLE: "false"
      KAFKA_LOG_DIRS: "/var/lib/kafka/data"
      CLUSTER_ID: "MkU3OEVBNTcwNTJENDM2Qk"

  schema-registry:
    image: confluentinc/cp-schema-registry:7.6.1
    hostname: schema-registry
    container_name: mcp-cp-test-sr
    depends_on:
      - kafka
    ports:
      - "8081:8081"
    environment:
      SCHEMA_REGISTRY_HOST_NAME: "schema-registry"
      SCHEMA_REGISTRY_LISTENERS: "http://0.0.0.0:8081"
      SCHEMA_REGISTRY_KAFKASTORE_BOOTSTRAP_SERVERS: "SASL_PLAINTEXT://kafka:9092"
      SCHEMA_REGISTRY_KAFKASTORE_SECURITY_PROTOCOL: "SASL_PLAINTEXT"
      SCHEMA_REGISTRY_KAFKASTORE_SASL_MECHANISM: "PLAIN"
      SCHEMA_REGISTRY_KAFKASTORE_SASL_JAAS_CONFIG: >-
        org.apache.kafka.common.security.plain.PlainLoginModule required
        username="admin" password="admin-secret";