package config

import (
	"os"
	"path/filepath"
	"testing"
)

func TestLoad(t *testing.T) {
	for _, tt := range []struct {
		name, body string
		wantErr    bool
	}{
		{"valid", "admin:\n  password: a-long-test-password\n", false},
		{"short", "admin:\n  password: short\n", true},
		{"multiple documents", "admin:\n  password: a-long-test-password\n---\nadmin:\n  password: ignored-password\n", true},
		{"placeholder", "admin:\n  password: CHANGE-ME-use-a-long-random-password\n", true},
		{"unknown", "admin:\n  password: a-long-test-password\nunknown: true\n", true},
	} {
		t.Run(tt.name, func(t *testing.T) {
			path := filepath.Join(t.TempDir(), "config.yaml")
			if err := os.WriteFile(path, []byte(tt.body), 0600); err != nil {
				t.Fatal(err)
			}
			c, err := Load(path)
			if (err != nil) != tt.wantErr {
				t.Fatalf("error=%v, wantErr=%v", err, tt.wantErr)
			}
			if err == nil && (c.Server.Listen != "127.0.0.1:8080" || c.Storage.Path != "./data/router.db") {
				t.Fatal("defaults missing")
			}
		})
	}
}

func TestSecurityConfig(t *testing.T) {
	for _, tt := range []struct {
		body    string
		invalid bool
	}{
		{"", false},
		{"limits:\n  requests_per_minute: 0\n", true},
		{"limits:\n  per_key_concurrency: -1\n", true},
		{"limits:\n  global_concurrency: 0\n", true},
		{"limits:\n  requests_per_minute: nope\n", true},
		{"server:\n  trusted_proxies: [not-a-cidr]\n", true},
		{"server:\n  trusted_proxies: [0.0.0.0/0]\n", true},
		{"server:\n  trusted_proxies: ['::/0']\n", true},
		{"server:\n  trusted_proxies: [10.0.0.0/8, '::1/128']\n", false},
		{"storage:\n  log_retention_days: -1\n", true},
	} {
		t.Run(tt.body, func(t *testing.T) {
			p := filepath.Join(t.TempDir(), "config.yaml")
			if err := os.WriteFile(p, []byte("admin:\n  password: a-long-test-password\n"+tt.body), 0600); err != nil {
				t.Fatal(err)
			}
			c, err := Load(p)
			if (err != nil) != tt.invalid {
				t.Fatalf("error=%v", err)
			}
			if err == nil && (c.Limits.RequestsPerMinute != 120 || c.Limits.PerKeyConcurrency != 8 || c.Limits.GlobalConcurrency != 64 || c.Storage.LogRetentionDays != 0) {
				t.Fatal("security defaults missing")
			}
		})
	}
}