package config_test

import (
	"os"
	"os/exec"
	"path/filepath"
	"strings"
	"testing"
)

func TestConfigureUserAsteriskARIPrivateAndNoOverwrite(t *testing.T) {
	home := t.TempDir()
	root := filepath.Join(home, ".config", "go-sip-asterisk")
	if err := os.MkdirAll(root, 0700); err != nil {
		t.Fatal(err)
	}
	if err := os.WriteFile(filepath.Join(root, "asterisk.conf"), []byte("[directories]\n"), 0600); err != nil {
		t.Fatal(err)
	}
	path := "../../deploys/cell/configure-asterisk-user-ari.sh"
	run := func() (string, error) {
		command := exec.Command("bash", path)
		command.Env = append(os.Environ(), "HOME="+home)
		output, err := command.CombinedOutput()
		return string(output), err
	}
	if output, err := run(); err != nil {
		t.Fatalf("private ARI configuration failed: %v %s", err, output)
	}
	for _, name := range []string{"ari.conf", "http.conf", "ari-secret"} {
		info, err := os.Stat(filepath.Join(root, name))
		if err != nil || info.Mode().Perm() != 0600 {
			t.Fatalf("ARI file %s must be private: info=%v err=%v", name, info, err)
		}
	}
	password, err := os.ReadFile(filepath.Join(root, "ari-secret"))
	if err != nil || len(password) != 64 {
		t.Fatalf("ARI credential must be a generated 32-byte hex secret: err=%v length=%d", err, len(password))
	}
	ari, err := os.ReadFile(filepath.Join(root, "ari.conf"))
	if err != nil || !strings.Contains(string(ari), "password = "+string(password)) || !strings.Contains(string(ari), "read_only = no") {
		t.Fatalf("ARI config did not bind generated credential: err=%v", err)
	}
	http, err := os.ReadFile(filepath.Join(root, "http.conf"))
	if err != nil || !strings.Contains(string(http), "bindaddr = 127.0.0.1") || !strings.Contains(string(http), "bindport = 8088") {
		t.Fatalf("HTTP must be explicitly restricted to the local Cell: err=%v", err)
	}
	if output, err := run(); err == nil || !strings.Contains(output, "already exists") {
		t.Fatalf("repeat install must not overwrite private credentials: err=%v output=%s", err, output)
	}
	again, err := os.ReadFile(filepath.Join(root, "ari-secret"))
	if err != nil || string(again) != string(password) {
		t.Fatal("existing ARI credential was changed by a repeat install")
	}
}