package config

import (
	"encoding/base64"
	"strings"
	"testing"
)

func TestLoadAcceptsExactly32ByteKeys(t *testing.T) {
	values := map[string]string{
		"DATABASE_URL":               "postgres://localhost/test",
		"DATA_ENCRYPTION_KEY_BASE64": base64.StdEncoding.EncodeToString([]byte(strings.Repeat("a", 32))),
		"PHONE_HMAC_KEY_BASE64":      base64.StdEncoding.EncodeToString([]byte(strings.Repeat("b", 32))),
		"SESSION_COOKIE_SECURE":      "false",
	}
	cfg, err := load(func(key string) (string, bool) { value, ok := values[key]; return value, ok })
	if err != nil {
		t.Fatalf("load returned error: %v", err)
	}
	if len(cfg.EncryptionKey) != 32 || len(cfg.PhoneHMACKey) != 32 {
		t.Fatalf("unexpected key lengths: %d, %d", len(cfg.EncryptionKey), len(cfg.PhoneHMACKey))
	}
}

func TestLoadRejectsWrongKeyLength(t *testing.T) {
	values := map[string]string{
		"DATABASE_URL":               "postgres://localhost/test",
		"DATA_ENCRYPTION_KEY_BASE64": base64.StdEncoding.EncodeToString([]byte(strings.Repeat("a", 31))),
		"PHONE_HMAC_KEY_BASE64":      base64.StdEncoding.EncodeToString([]byte(strings.Repeat("b", 32))),
	}
	_, err := load(func(key string) (string, bool) { value, ok := values[key]; return value, ok })
	if err == nil || !strings.Contains(err.Error(), "exactly 32 bytes") {
		t.Fatalf("expected exact length error, got %v", err)
	}
}

func TestLoadRequiresSecureCookieInProduction(t *testing.T) {
	key := base64.StdEncoding.EncodeToString([]byte(strings.Repeat("x", 32)))
	values := map[string]string{
		"APP_ENV":                    "production",
		"DATABASE_URL":               "postgres://localhost/test",
		"DATA_ENCRYPTION_KEY_BASE64": key,
		"PHONE_HMAC_KEY_BASE64":      key,
		"SESSION_COOKIE_SECURE":      "false",
	}
	_, err := load(func(key string) (string, bool) { value, ok := values[key]; return value, ok })
	if err == nil || !strings.Contains(err.Error(), "must be true") {
		t.Fatalf("expected production cookie error, got %v", err)
	}
}

func TestLoadRequiresTLSAndReleaseMigrationsInProduction(t *testing.T) {
	key := base64.StdEncoding.EncodeToString([]byte(strings.Repeat("x", 32)))
	values := map[string]string{
		"APP_ENV":                    "production",
		"DATABASE_URL":               "postgres://queue:secret@pg.internal/queue?sslmode=verify-full",
		"DATA_ENCRYPTION_KEY_BASE64": key,
		"PHONE_HMAC_KEY_BASE64":      key,
		"SESSION_COOKIE_SECURE":      "true",
		"MIGRATE_ON_START":           "false",
	}
	if _, err := load(func(key string) (string, bool) { value, ok := values[key]; return value, ok }); err != nil {
		t.Fatalf("secure production configuration rejected: %v", err)
	}

	values["DATABASE_URL"] = "postgres://queue:secret@pg.internal/queue?sslmode=disable"
	if _, err := load(func(key string) (string, bool) { value, ok := values[key]; return value, ok }); err == nil || !strings.Contains(err.Error(), "TLS") {
		t.Fatalf("expected production database TLS error, got %v", err)
	}

	values["DATABASE_URL"] = "postgres://queue:secret@pg.internal/queue?sslmode=verify-full"
	values["MIGRATE_ON_START"] = "true"
	if _, err := load(func(key string) (string, bool) { value, ok := values[key]; return value, ok }); err == nil || !strings.Contains(err.Error(), "MIGRATE_ON_START") {
		t.Fatalf("expected production migration mode error, got %v", err)
	}
}