package app

import (
	"context"
	"testing"

	"github.com/bnema/gordon/internal/domain"
	"github.com/bnema/zerowrap"
	"github.com/spf13/viper"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

func TestBuildAuthConfig_UsesConfigEnabledFlag(t *testing.T) {
	t.Setenv(TokenSecretEnvVar, "test-token-secret-that-is-at-least-32-bytes-long")

	cfg := Config{}
	cfg.Auth.Enabled = false
	cfg.Auth.Type = "token"

	authCfg, err := buildAuthConfig(context.Background(), cfg, domain.AuthTypeToken, domain.SecretsBackendUnsafe, t.TempDir(), zerowrap.Default())
	require.NoError(t, err)
	assert.False(t, authCfg.Enabled, "expected auth config enabled=false")
}

func TestResolveSecretsBackend_RejectsMissingBackend(t *testing.T) {
	_, err := resolveSecretsBackend("")
	require.Error(t, err)
	assert.Contains(t, err.Error(), "auth.secrets_backend is required")
}

func TestResolveSecretsBackend_RejectsUnknownBackend(t *testing.T) {
	_, err := resolveSecretsBackend("vault")
	require.Error(t, err)
	assert.Contains(t, err.Error(), `unsupported auth.secrets_backend "vault"`)
}

func TestResolveAuthType_RejectsPassword(t *testing.T) {
	cfg := Config{}
	cfg.Auth.Type = "password"
	_, err := resolveAuthType(cfg)
	require.Error(t, err)
	assert.Contains(t, err.Error(), "unsupported auth.type")
}

func TestResolveAuthType_AcceptsToken(t *testing.T) {
	cfg := Config{}
	cfg.Auth.Type = "token"
	authType, err := resolveAuthType(cfg)
	require.NoError(t, err)
	assert.Equal(t, domain.AuthTypeToken, authType)
}

func TestResolveAuthType_AcceptsEmpty(t *testing.T) {
	cfg := Config{}
	authType, err := resolveAuthType(cfg)
	require.NoError(t, err)
	assert.Equal(t, domain.AuthTypeToken, authType)
}

func TestLoadConfig_DoesNotDefaultSecretsBackendToUnsafe(t *testing.T) {
	v := viper.New()

	err := loadConfig(v, "")
	require.NoError(t, err)
	assert.Empty(t, v.GetString("auth.secrets_backend"), "expected empty default for auth.secrets_backend")
}