package config

import (
	"os"
	"path/filepath"
	"strings"
	"testing"
)

func setAgentEnvironment(t *testing.T) string {
	t.Helper()
	root := t.TempDir()
	state := filepath.Join(root, "session.json")
	for name, value := range map[string]string{
		"AGENT_ID": "agent-mock", "CELL_ID": "cell-mock", "AGENT_GRPC_LISTEN": "127.0.0.1:0",
		"AGENT_SESSION_PATH": state, "AGENT_RECOVERY_ROOT": filepath.Join(root, "recovery"),
		"DISPATCHER_ID":            "11111111-1111-4111-8111-111111111111",
		"DISPATCHER_GRPC_ENDPOINT": "127.0.0.1:39443", "DISPATCHER_GRPC_SERVER_NAME": "dispatcher.local",
		"MTLS_CA_FILE": filepath.Join(root, "ca.pem"), "MTLS_CERT_FILE": filepath.Join(root, "agent.pem"),
		"MTLS_KEY_FILE": filepath.Join(root, "agent.key"), "MTLS_PEER_CERT_FINGERPRINTS": strings.Repeat("a", 64),
		"AGENT_MOCK_SCENARIO_FILE":    filepath.Join(root, "scenario.json"),
		"AGENT_MOCK_APPLIED_SIP_FILE": filepath.Join(root, "applied-sip.json"),
	} {
		t.Setenv(name, value)
	}
	return state
}

func TestLoadAgentEnvironmentRefusesNonMockBeforeResources(t *testing.T) {
	for _, mode := range []string{"real", "mixed", ""} {
		t.Run(mode, func(t *testing.T) {
			state := setAgentEnvironment(t)
			if _, err := LoadAgentEnvironment(mode); err == nil || !strings.Contains(err.Error(), "Mock") {
				t.Fatalf("unapproved Agent mode was admitted: %v", err)
			}
			if _, err := os.Stat(state); !os.IsNotExist(err) {
				t.Fatalf("mode refusal opened Agent state: %v", err)
			}
		})
	}
}

func TestLoadAgentEnvironmentRequiresExplicitDeploymentValues(t *testing.T) {
	for _, name := range []string{
		"AGENT_ID", "CELL_ID", "AGENT_GRPC_LISTEN", "AGENT_SESSION_PATH", "AGENT_RECOVERY_ROOT",
		"DISPATCHER_ID", "DISPATCHER_GRPC_ENDPOINT", "DISPATCHER_GRPC_SERVER_NAME", "MTLS_CA_FILE", "MTLS_CERT_FILE",
		"MTLS_KEY_FILE", "MTLS_PEER_CERT_FINGERPRINTS", "AGENT_MOCK_SCENARIO_FILE", "AGENT_MOCK_APPLIED_SIP_FILE",
	} {
		t.Run(name, func(t *testing.T) {
			setAgentEnvironment(t)
			t.Setenv(name, "")
			if _, err := LoadAgentEnvironment("mock"); err == nil || !strings.Contains(err.Error(), name) {
				t.Fatalf("missing current Agent setting silently used a legacy default: %v", err)
			}
		})
	}
}

func TestLoadAgentEnvironmentRequiresLocalMockEndpointsAndDoesNotOpenFiles(t *testing.T) {
	state := setAgentEnvironment(t)
	settings, err := LoadAgentEnvironment("mock")
	if err != nil {
		t.Fatal(err)
	}
	if settings.AgentID != "agent-mock" || settings.CellID != "cell-mock" || settings.DispatcherID != "11111111-1111-4111-8111-111111111111" || settings.Listen != "127.0.0.1:0" || settings.SessionPath != state || settings.DispatcherEndpoint != "127.0.0.1:39443" {
		t.Fatal("explicit deployment identity or address was rewritten")
	}
	if _, err := os.Stat(state); !os.IsNotExist(err) {
		t.Fatalf("Agent preflight opened durable state: %v", err)
	}
	for _, tc := range []struct{ name, value string }{
		{"AGENT_GRPC_LISTEN", "0.0.0.0:39444"},
		{"DISPATCHER_ID", "unapproved-dispatcher"},
		{"DISPATCHER_GRPC_ENDPOINT", "saas.example.invalid:443"},
	} {
		t.Run(tc.name, func(t *testing.T) {
			setAgentEnvironment(t)
			t.Setenv(tc.name, tc.value)
			if _, err := LoadAgentEnvironment("mock"); err == nil || !strings.Contains(err.Error(), tc.name) || strings.Contains(err.Error(), tc.value) {
				t.Fatalf("external Mock address was accepted or leaked: %v", err)
			}
		})
	}
}