import test from 'node:test';
import assert from 'node:assert/strict';

import { validateEnvironment } from '../runtime/validate-env.mjs';

const validEnv = {
  DOMAIN: 'game.test.invalid',
  ACME_EMAIL: 'admin@test.invalid',
  CORE_REPOSITORY_URL: 'https://git.test.invalid/team/core2026.git',
  POSTGRES_PASSWORD: 'p'.repeat(24),
  REDIS_PASSWORD: 'r'.repeat(24),
  GAME_TOKEN_SECRET: 'g'.repeat(32),
  GATEWAY_BOOTSTRAP_TOKEN: 'b'.repeat(32),
  INITIAL_ADMIN_USERNAME: 'admin',
  INITIAL_ADMIN_PASSWORD: 'a'.repeat(16),
  KAKAO_REST_KEY: 'kakao-test-key',
};

test('accepts a complete public repository environment', () => {
  assert.deepEqual(validateEnvironment(validEnv), []);
});

test('accepts an HTTP Caddy address for external TLS termination', () => {
  assert.deepEqual(
    validateEnvironment({ ...validEnv, CADDY_SITE_ADDRESS: 'http://game.test.invalid' }),
    [],
  );
});

test('rejects a Caddy address for a different host', () => {
  const errors = validateEnvironment({ ...validEnv, CADDY_SITE_ADDRESS: 'http://other.test.invalid' });
  assert.ok(errors.some((error) => error.includes('CADDY_SITE_ADDRESS')));
});

test('accepts paired HTTPS credentials without embedding them in the URL', () => {
  assert.deepEqual(
    validateEnvironment({ ...validEnv, CORE_REPOSITORY_USERNAME: 'deploy', CORE_REPOSITORY_TOKEN: 'token' }),
    [],
  );
});

test('accepts a paired SSH deploy key and pinned host data', () => {
  assert.deepEqual(
    validateEnvironment({
      ...validEnv,
      CORE_REPOSITORY_URL: 'ssh://git@git.test.invalid:2222/team/core2026.git',
      CORE_SSH_PRIVATE_KEY_BASE64: Buffer.from('-----BEGIN OPENSSH PRIVATE KEY-----\ntest\n').toString('base64'),
      CORE_SSH_KNOWN_HOSTS_BASE64: Buffer.from('git.test.invalid ssh-ed25519 test\n').toString('base64'),
    }),
    [],
  );
});

test('rejects placeholders, weak secrets, and partial credentials', () => {
  const errors = validateEnvironment({
    ...validEnv,
    DOMAIN: 'game.example.com',
    POSTGRES_PASSWORD: 'short',
    CORE_REPOSITORY_USERNAME: 'deploy',
  });
  assert.ok(errors.some((error) => error.includes('DOMAIN still contains')));
  assert.ok(errors.some((error) => error.includes('POSTGRES_PASSWORD must contain')));
  assert.ok(errors.some((error) => error.includes('must be set together')));
});

test('rejects credentials embedded in repository URLs and mixed auth modes', () => {
  const errors = validateEnvironment({
    ...validEnv,
    CORE_REPOSITORY_URL: 'https://deploy:secret@git.test.invalid/team/core2026.git',
    CORE_REPOSITORY_USERNAME: 'deploy',
    CORE_REPOSITORY_TOKEN: 'token',
    CORE_SSH_PRIVATE_KEY_BASE64: 'key',
    CORE_SSH_KNOWN_HOSTS_BASE64: 'hosts',
  });
  assert.ok(errors.some((error) => error.includes('must not embed credentials')));
  assert.ok(errors.some((error) => error.includes('only one Core repository authentication mode')));
});