package config

import (
	"os"
	"path/filepath"
	"strings"
	"testing"
	"time"
)

const mockOSSDeployment = `{"dispatcher_id":"c046b893-8628-4589-ae50-619d049248a6","oss":{"endpoint":"https://127.0.0.1:19445","region":"cn-mock","bucket":"mock-bucket","object_prefix":"approved","access_key_id_env":"MOCK_OSS_KEY_ID","access_key_secret_env":"MOCK_OSS_KEY_SECRET","max_asset_bytes":1048576}}`

func writeMockOSSDeployment(t *testing.T, body string) string {
	t.Helper()
	path := filepath.Join(t.TempDir(), "oss.json")
	if err := os.WriteFile(path, []byte(body), 0600); err != nil {
		t.Fatal(err)
	}
	return path
}

func TestLoadCurrentOSSConfigRequiresBoundLocalHTTPSAndExplicitCredentials(t *testing.T) {
	t.Setenv("MOCK_OSS_KEY_ID", "isolated-id")
	t.Setenv("MOCK_OSS_KEY_SECRET", "isolated-secret")
	configuration, err := LoadCurrentOSSConfig(writeMockOSSDeployment(t, mockOSSDeployment), dispatcherFixtureID)
	if err != nil {
		t.Fatal(err)
	}
	if configuration.Endpoint != "https://127.0.0.1:19445" || configuration.Bucket != "mock-bucket" ||
		configuration.KeyPrefix != "approved" || configuration.MaxAssetBytes != 1048576 || configuration.GrantTTL != 15*time.Minute ||
		configuration.AccessKeyID != "isolated-id" || configuration.AccessKeySecret != "isolated-secret" {
		t.Fatal("approved deployment settings were rewritten")
	}
}

func TestLoadCurrentOSSConfigRejectsUnapprovedDeploymentWithoutLeakingCredentials(t *testing.T) {
	t.Setenv("MOCK_OSS_KEY_ID", "isolated-id")
	t.Setenv("MOCK_OSS_KEY_SECRET", "isolated-secret")
	for _, tc := range []struct {
		name string
		body string
	}{
		{"wrong Dispatcher", strings.Replace(mockOSSDeployment, dispatcherFixtureID, "22222222-2222-4222-8222-222222222222", 1)},
		{"legacy generation", strings.Replace(mockOSSDeployment, `{"dispatcher_id":`, `{"schema_version":"v3","dispatcher_id":`, 1)},
		{"insecure endpoint", strings.Replace(mockOSSDeployment, "https://127.0.0.1:19445", "http://127.0.0.1:19445", 1)},
		{"external endpoint", strings.Replace(mockOSSDeployment, "https://127.0.0.1:19445", "https://oss.example.invalid:443", 1)},
		{"duplicate key", strings.Replace(mockOSSDeployment, `"bucket":"mock-bucket"`, `"bucket":"mock-bucket","bucket":"other"`, 1)},
		{"missing size", strings.Replace(mockOSSDeployment, `"max_asset_bytes":1048576`, `"max_asset_bytes":0`, 1)},
		{"extra document", mockOSSDeployment + ` {}`},
		{"oversized", strings.Repeat(" ", 65<<10) + mockOSSDeployment},
	} {
		t.Run(tc.name, func(t *testing.T) {
			if _, err := LoadCurrentOSSConfig(writeMockOSSDeployment(t, tc.body), dispatcherFixtureID); err == nil || strings.Contains(err.Error(), "isolated-secret") {
				t.Fatalf("unapproved deployment admitted or exposed credential: %v", err)
			}
		})
	}
	t.Setenv("MOCK_OSS_KEY_SECRET", "")
	if _, err := LoadCurrentOSSConfig(writeMockOSSDeployment(t, mockOSSDeployment), dispatcherFixtureID); err == nil || strings.Contains(err.Error(), "isolated-id") {
		t.Fatalf("unavailable credential was defaulted or exposed: %v", err)
	}
}