package authproxy

import (
	"strings"
	"testing"
	"time"
)

func validConfig() Config {
	return Config{
		ClientID:       "cid",
		ClientSecret:   "sec",
		CookieSecret:   strings.Repeat("x", 32),
		AuthHost:       "auth.example.com",
		AllowedDomains: []string{"signal.org"},
		CookieName:     "_google_auth",
		SessionTTL:     time.Hour,
	}
}

func TestConfigValidate(t *testing.T) {
	if err := validConfig().validate(); err != nil {
		t.Fatalf("valid config rejected: %v", err)
	}

	mutations := map[string]func(*Config){
		"missing client id":     func(c *Config) { c.ClientID = "" },
		"missing client secret": func(c *Config) { c.ClientSecret = "" },
		"short cookie secret":   func(c *Config) { c.CookieSecret = "short" },
		"missing auth host":     func(c *Config) { c.AuthHost = "" },
		"auth host with scheme": func(c *Config) { c.AuthHost = "https://auth.example.com" },
		"no allow rules":        func(c *Config) { c.AllowedDomains = nil; c.AllowedEmails = nil },
	}
	for name, mutate := range mutations {
		cfg := validConfig()
		mutate(&cfg)
		if err := cfg.validate(); err == nil {
			t.Errorf("%s: expected validation error", name)
		}
	}
}

func TestConfigFromEnv(t *testing.T) {
	t.Setenv("GOOGLE_AUTH_CLIENT_ID", "cid")
	t.Setenv("GOOGLE_AUTH_CLIENT_SECRET", "sec")
	t.Setenv("GOOGLE_AUTH_COOKIE_SECRET", strings.Repeat("x", 32))
	t.Setenv("GOOGLE_AUTH_AUTH_HOST", "HTTPS://Auth.Example.com/")
	t.Setenv("GOOGLE_AUTH_ALLOWED_DOMAINS", "Signal.org, @example.com")
	t.Setenv("GOOGLE_AUTH_ALLOWED_EMAILS", "Guest@Partner.com")
	t.Setenv("GOOGLE_AUTH_SESSION_TTL", "48h")

	cfg, err := ConfigFromEnv()
	if err != nil {
		t.Fatal(err)
	}
	if cfg.AuthHost != "auth.example.com" {
		t.Errorf("AuthHost = %q", cfg.AuthHost)
	}
	if len(cfg.AllowedDomains) != 2 || cfg.AllowedDomains[0] != "signal.org" || cfg.AllowedDomains[1] != "example.com" {
		t.Errorf("AllowedDomains = %v", cfg.AllowedDomains)
	}
	if len(cfg.AllowedEmails) != 1 || cfg.AllowedEmails[0] != "guest@partner.com" {
		t.Errorf("AllowedEmails = %v", cfg.AllowedEmails)
	}
	if cfg.SessionTTL != 48*time.Hour {
		t.Errorf("SessionTTL = %v", cfg.SessionTTL)
	}
}

func TestConfigFromEnvRejectsBadTTL(t *testing.T) {
	t.Setenv("GOOGLE_AUTH_CLIENT_ID", "cid")
	t.Setenv("GOOGLE_AUTH_CLIENT_SECRET", "sec")
	t.Setenv("GOOGLE_AUTH_COOKIE_SECRET", strings.Repeat("x", 32))
	t.Setenv("GOOGLE_AUTH_AUTH_HOST", "auth.example.com")
	t.Setenv("GOOGLE_AUTH_ALLOWED_DOMAINS", "signal.org")
	t.Setenv("GOOGLE_AUTH_SESSION_TTL", "2 fortnights")
	if _, err := ConfigFromEnv(); err == nil {
		t.Fatal("expected error for bad TTL")
	}
}