package config

import (
	"encoding/base64"
	"os"
	"path/filepath"
	"testing"

	"github.com/stretchr/testify/require"
)

func validReleaseConfig() *Config {
	return &Config{
		Server:     ServerConfig{Port: 3000, Mode: "release", CORS: CORSConfig{AllowedOrigins: []string{"https://chat.acme.test"}, AllowCredentials: true}},
		Database:   DatabaseConfig{DSN: "postgres://user:pass@db.acme.test/gochat?sslmode=verify-full"},
		Redis:      RedisConfig{DSN: "rediss://:redis-secret@redis.acme.test:6379"},
		JWT:        JWTConfig{Secret: "production-secret-at-least-32-bytes", AccessExpiryMinutes: 15, RefreshExpiryHours: 168},
		Encryption: EncryptionConfig{Enabled: true, CurrentKeyVersion: 1, AESKey: base64.StdEncoding.EncodeToString(make([]byte, 32))},
		Log:        LogConfig{Level: "info"},
		Worker:     WorkerConfig{Concurrency: 1, BlockTimeoutS: 5, SweepIntervalS: 30},
		Search:     SearchConfig{Engine: "meilisearch", Host: "https://search.acme.test", APIKey: "search-secret-123", TimeoutSeconds: 5},
	}
}

func TestReleaseTransportValidationFailsClosed(t *testing.T) {
	tests := []struct {
		name    string
		mutate  func(*Config)
		message string
	}{
		{"database TLS without identity verification", func(c *Config) { c.Database.DSN = "postgres://user:pass@db.acme.test/gochat?sslmode=require" }, "sslmode=disable, verify-full or verify-ca"},
		{"redis certificate not verified", func(c *Config) { c.Redis.DSN = "rediss://:redis-secret@redis.acme.test:6379?insecure_skip_verify=true" }, "cannot be disabled"},
	}
	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			cfg := validReleaseConfig()
			tt.mutate(cfg)
			err := Validate(cfg)
			require.ErrorContains(t, err, tt.message)
		})
	}
}

func TestReleaseAllowsPasswordProtectedRedisWithoutTLS(t *testing.T) {
	cfg := validReleaseConfig()
	cfg.Redis.DSN = "redis://:redis-secret@redis.acme.test:6379"
	require.NoError(t, Validate(cfg))
}

func TestReleaseAllowsPrivateRedisWithoutCredentials(t *testing.T) {
	cfg := validReleaseConfig()
	cfg.Redis.DSN = "redis://redis:6379/1"
	require.NoError(t, Validate(cfg))
}

func TestSecuritySettingsLoadFromEnvironment(t *testing.T) {
	workingDir, err := os.Getwd()
	require.NoError(t, err)
	require.NoError(t, os.Chdir(filepath.Join(workingDir, "..", "..")))
	t.Cleanup(func() { _ = os.Chdir(workingDir) })
	t.Setenv("GOCHAT_SERVER_TRUSTED_PROXIES", "10.0.0.0/8,192.0.2.10")
	t.Setenv("GOCHAT_JWT_WS_TICKET_TTL_SECONDS", "20")
	t.Setenv("GOCHAT_ENCRYPTION_ENABLED", "true")
	t.Setenv("GOCHAT_RATE_LIMIT_LOGIN_REQUESTS", "7")

	cfg, err := LoadWithEnv("default")
	require.NoError(t, err)
	require.Equal(t, []string{"10.0.0.0/8", "192.0.2.10"}, cfg.Server.TrustedProxies)
	require.Equal(t, 20, cfg.JWT.WSTicketTTLSeconds)
	require.True(t, cfg.Encryption.Enabled)
	require.Equal(t, 7, cfg.RateLimit.Login.Requests)
}