package main

import (
	"os"
	"path/filepath"
	"testing"
)

func TestLifeboatProviderIsOptionalAndLocalAdapterBacked(t *testing.T) {
	if _, enabled, err := newLifeboatProvider(""); err != nil || enabled {
		t.Fatalf("empty lifeboat URL should disable provider: enabled=%v err=%v", enabled, err)
	}
	provider, enabled, err := newLifeboatProvider("http://lifeboat:8080/v1")
	if err != nil || !enabled {
		t.Fatalf("configured lifeboat should be enabled: enabled=%v err=%v", enabled, err)
	}
	if provider.ProviderInstanceID != "local-lifeboat" || provider.EndpointRef != "local-lifeboat-v1" || provider.Provider == nil {
		t.Fatalf("unexpected lifeboat registration: %+v", provider)
	}
}

func TestLoadLocalCPUProviderAPIKeyUsesProtectedFileReference(t *testing.T) {
	t.Setenv("LOCAL_CPU_PROVIDER_API_KEY", "")
	_ = os.Unsetenv("LOCAL_CPU_PROVIDER_API_KEY")
	root := t.TempDir()
	path := filepath.Join(root, "local_cpu_provider_api_key")
	if err := os.WriteFile(path, []byte("resolved-key\n"), 0o600); err != nil {
		t.Fatal(err)
	}
	t.Setenv("LOCAL_CPU_PROVIDER_API_KEY_FILE", path)
	t.Setenv("LOCAL_CPU_PROVIDER_CREDENTIAL_REF", "credential://domovoy/local-cpu/provider-api-key/v1")
	t.Setenv("SECRET_BACKEND_ROOT", root)
	key, err := loadLocalCPUProviderAPIKey()
	if err != nil || key != "resolved-key" {
		t.Fatalf("unexpected key resolution result: err=%v", err)
	}
}

func TestLoadLocalCPUProviderAPIKeyRejectsDirectEnvironmentSecret(t *testing.T) {
	t.Setenv("LOCAL_CPU_PROVIDER_API_KEY", "must-not-be-used")
	t.Setenv("LOCAL_CPU_PROVIDER_API_KEY_FILE", "")
	if _, err := loadLocalCPUProviderAPIKey(); err == nil {
		t.Fatal("expected direct environment secret to be rejected")
	}
}

func TestLoadProviderAPIKeySupportsMediumCredentialRef(t *testing.T) {
	t.Setenv("LOCAL_MEDIUM_PROVIDER_API_KEY", "")
	_ = os.Unsetenv("LOCAL_MEDIUM_PROVIDER_API_KEY")
	root := t.TempDir()
	path := filepath.Join(root, "medium_provider_api_key")
	if err := os.WriteFile(path, []byte("medium-key\n"), 0o600); err != nil {
		t.Fatal(err)
	}
	t.Setenv("LOCAL_MEDIUM_PROVIDER_API_KEY_FILE", path)
	t.Setenv("LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF", "credential://domovoy/local-medium/provider-api-key/v1")
	t.Setenv("SECRET_BACKEND_ROOT", root)
	key, err := loadProviderAPIKey("LOCAL_MEDIUM_PROVIDER_API_KEY", "LOCAL_MEDIUM_PROVIDER_API_KEY_FILE", "LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF", "credential://domovoy/local-medium/provider-api-key/v1")
	if err != nil || key != "medium-key" {
		t.Fatalf("unexpected medium key resolution result: err=%v", err)
	}
}

func TestLoadProviderAPIKeyRejectsMediumDirectEnvironmentSecret(t *testing.T) {
	t.Setenv("LOCAL_MEDIUM_PROVIDER_API_KEY", "must-not-be-used")
	t.Setenv("LOCAL_MEDIUM_PROVIDER_API_KEY_FILE", "")
	if _, err := loadProviderAPIKey("LOCAL_MEDIUM_PROVIDER_API_KEY", "LOCAL_MEDIUM_PROVIDER_API_KEY_FILE", "LOCAL_MEDIUM_PROVIDER_CREDENTIAL_REF", "credential://domovoy/local-medium/provider-api-key/v1"); err == nil {
		t.Fatal("expected direct medium environment secret to be rejected")
	}
}