package email

import "testing"

func TestEncryptDecryptRoundTrip(t *testing.T) {
	t.Setenv("APP_ENV", "development")
	key := DeriveKey("0123456789abcdef0123456789abcdef", "")
	enc, err := EncryptSecret(key, "re_test_secret")
	if err != nil {
		t.Fatal(err)
	}
	if enc == "" || enc == "re_test_secret" {
		t.Fatal("expected ciphertext")
	}
	plain, err := DecryptSecret(key, enc)
	if err != nil {
		t.Fatal(err)
	}
	if plain != "re_test_secret" {
		t.Fatalf("got %q", plain)
	}
}

func TestDeriveKeyHex(t *testing.T) {
	t.Setenv("APP_ENV", "development")
	hexKey := "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
	key := DeriveKey(hexKey, "fallback")
	if len(key) != 32 {
		t.Fatalf("len=%d", len(key))
	}
}

func TestDecryptLegacyPlaintextRejectedInProduction(t *testing.T) {
	t.Setenv("APP_ENV", "production")
	key := DeriveKey("x", "y")
	if _, err := DecryptSecret(key, "legacy-plain"); err == nil {
		t.Fatal("expected plaintext decrypt rejected in production")
	}
	t.Setenv("APP_ENV", "development")
	plain, err := DecryptSecret(key, "legacy-plain")
	if err != nil {
		t.Fatal(err)
	}
	if plain != "legacy-plain" {
		t.Fatalf("got %q", plain)
	}
}

func TestDeriveKeyRejectsFallbackInProduction(t *testing.T) {
	t.Setenv("APP_ENV", "production")
	if key := DeriveKey("", "postgres://local"); key != nil {
		t.Fatalf("expected nil key without explicit material in production, got len=%d", len(key))
	}
}