package config_test

import (
	"os"
	"path/filepath"
	"testing"

	"forgejo.riotpiao.com/rock/homelab-frontend/internal/config"
)

func TestLoadAuthConfig_TokenURLAndClientID(t *testing.T) {
	yaml := `
routes: []
models: []
auth:
  enabled: true
  issuer: "https://authentik.example.com/application/o/api-gw/"
  audience: "api-gw"
  jwksUrl: "https://authentik.example.com/application/o/api-gw/jwks/"
  requiredCapability: "llm:inference"
  tokenUrl: "https://authentik.example.com/application/o/token/"
  clientId: "api-gw"
`
	dir := t.TempDir()
	path := filepath.Join(dir, "config.yaml")
	if err := os.WriteFile(path, []byte(yaml), 0644); err != nil {
		t.Fatal(err)
	}

	// Set env for client secret
	t.Setenv("AUTH_CLIENT_SECRET", "test-secret-value")

	_, _, _, auth, err := config.LoadRoutesAndModelsFromFile(path)
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}

	if !auth.Enabled {
		t.Error("auth should be enabled")
	}
	if auth.TokenURL != "https://authentik.example.com/application/o/token/" {
		t.Errorf("tokenUrl = %q, want authentik token endpoint", auth.TokenURL)
	}
	if auth.ClientID != "api-gw" {
		t.Errorf("clientId = %q, want api-gw", auth.ClientID)
	}
	if auth.ClientSecret != "test-secret-value" {
		t.Errorf("clientSecret = %q, want test-secret-value", auth.ClientSecret)
	}
}

func TestLoadAuthConfig_ClientSecretFromEnvOnly(t *testing.T) {
	yaml := `
routes: []
models: []
auth:
  enabled: true
  tokenUrl: "https://example.com/token/"
  clientId: "test"
`
	dir := t.TempDir()
	path := filepath.Join(dir, "config.yaml")
	os.WriteFile(path, []byte(yaml), 0644)

	// No AUTH_CLIENT_SECRET env set
	t.Setenv("AUTH_CLIENT_SECRET", "")

	_, _, _, auth, err := config.LoadRoutesAndModelsFromFile(path)
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}

	if auth.ClientSecret != "" {
		t.Errorf("clientSecret should be empty when env not set, got %q", auth.ClientSecret)
	}
}

func TestLoadAuthConfig_BackwardCompatible(t *testing.T) {
	// Config without tokenUrl/clientId should still load (zero values)
	yaml := `
routes: []
models: []
auth:
  enabled: true
  issuer: "https://example.com/"
  jwksUrl: "https://example.com/jwks/"
  requiredCapability: "llm:inference"
`
	dir := t.TempDir()
	path := filepath.Join(dir, "config.yaml")
	os.WriteFile(path, []byte(yaml), 0644)

	_, _, _, auth, err := config.LoadRoutesAndModelsFromFile(path)
	if err != nil {
		t.Fatalf("unexpected error: %v", err)
	}

	if auth.TokenURL != "" {
		t.Errorf("tokenUrl should be empty, got %q", auth.TokenURL)
	}
	if auth.ClientID != "" {
		t.Errorf("clientId should be empty, got %q", auth.ClientID)
	}
}