package console

import (
	"bytes"
	"crypto/ecdh"
	"encoding/base64"
	"log"
	"strings"
	"testing"

	"github.com/carlosframework/platform/internal/appconfig"
)

// mustTestSecretsKey is the fixed P-256 key every R9 test in this package
// uses: its public half as CARLOS_SECRETS_PUBKEY carries it, and the
// fingerprint a box holding it publishes.
func mustTestSecretsKey() (pubB64, fp string) {
	priv, err := ecdh.P256().NewPrivateKey(bytes.Repeat([]byte{1}, 32))
	if err != nil {
		panic(err)
	}
	return base64.StdEncoding.EncodeToString(priv.PublicKey().Bytes()), appconfig.KeyFingerprint(priv.PublicKey())
}

func TestAppRegionsOnNeedsANamedHome(t *testing.T) {
	fx := newConsoleFixture(t)
	for _, c := range []struct {
		on   bool
		home string
		want bool
	}{{false, "ie", false}, {true, "", false}, {true, "ie", true}} {
		fx.srv.cfg.AppRegions, fx.srv.cfg.HomeRegion = c.on, c.home
		if got := fx.srv.appRegionsOn(); got != c.want {
			t.Errorf("AppRegions=%v HomeRegion=%q: appRegionsOn = %v, want %v", c.on, c.home, got, c.want)
		}
	}
}

func TestExpectedSecretsFP(t *testing.T) {
	fx := newConsoleFixture(t)
	pub, fp := mustTestSecretsKey()
	fx.srv.cfg.SecretsPub = pub
	if got := fx.srv.expectedSecretsFP(); got != fp {
		t.Fatalf("expectedSecretsFP = %q, want %q", got, fp)
	}
	fx.srv.cfg.SecretsPub = ""
	if got := fx.srv.expectedSecretsFP(); got != "" {
		t.Fatalf("no CARLOS_SECRETS_PUBKEY = %q, want empty (cannot judge)", got)
	}
	fx.srv.cfg.SecretsPub = "not a key"
	if got := fx.srv.expectedSecretsFP(); got != "" {
		t.Fatalf("an unparseable CARLOS_SECRETS_PUBKEY = %q, want empty (cannot judge)", got)
	}
}

func TestAppRegionUsesTheSeamWhenSet(t *testing.T) {
	fx := newConsoleFixture(t)
	if r, src, err := fx.srv.appRegion(OpsAccountID, "nobody"); err != nil || r != "" || src != "" {
		t.Fatalf("store read of a missing app = %q %q %v, want empty", r, src, err)
	}
	fx.srv.appRegionOf = func(id int64, app string) (string, string, error) {
		return "uk", "timezone", nil
	}
	if r, src, err := fx.srv.appRegion(OpsAccountID, "nobody"); err != nil || r != "uk" || src != "timezone" {
		t.Fatalf("seam read = %q %q %v, want uk timezone", r, src, err)
	}
}

func TestLogRegionConfig(t *testing.T) {
	var buf bytes.Buffer
	prev := log.Writer()
	log.SetOutput(&buf)
	defer log.SetOutput(prev)
	logRegionConfig(Config{AppRegions: true})
	out := buf.String()
	if !strings.Contains(out, "CONSOLE_APP_REGIONS=on but CONSOLE_HOME_REGION is unset, so app regions stay off until the home is named") ||
		!strings.Contains(out, "CARLOS_SECRETS_PUBKEY is unset, so no region outside the home can be chosen automatically") {
		t.Fatalf("missing startup lines: %s", out)
	}
	// Switch off: the guess endpoint still answers, so a missing secrets
	// key is still worth saying (codex plan-R2 8); an unnamed home is not.
	buf.Reset()
	logRegionConfig(Config{})
	if out := buf.String(); !strings.Contains(out, "CARLOS_SECRETS_PUBKEY is unset") || strings.Contains(out, "CONSOLE_HOME_REGION") {
		t.Fatalf("switch off logged %q, want only the secrets-key line", out)
	}
	buf.Reset()
	pub, _ := mustTestSecretsKey()
	logRegionConfig(Config{AppRegions: true, HomeRegion: "ie", SecretsPub: pub})
	if buf.Len() != 0 {
		t.Fatalf("a complete configuration logged: %s", buf.String())
	}
}