package platformsettings

import (
	"context"
	"strings"
	"testing"
	"time"
)

func TestEncryptDecryptRoundTrip(t *testing.T) {
	key := DeriveKey("test-platform-secret-key-material", "fallback")
	if len(key) != 32 {
		t.Fatalf("key len %d", len(key))
	}
	enc, err := EncryptSecret(key, "sk_live_secret_value")
	if err != nil {
		t.Fatal(err)
	}
	if !strings.HasPrefix(enc, encPrefix) {
		t.Fatalf("expected enc prefix, got %q", enc)
	}
	plain, err := DecryptSecret(key, enc)
	if err != nil {
		t.Fatal(err)
	}
	if plain != "sk_live_secret_value" {
		t.Fatalf("got %q", plain)
	}
}

func TestParseDuration(t *testing.T) {
	d, ok := parseDuration("10s")
	if !ok || d != 10*time.Second {
		t.Fatalf("10s -> %v ok=%v", d, ok)
	}
	d, ok = parseDuration("5")
	if !ok || d != 5*time.Second {
		t.Fatalf("5 -> %v ok=%v", d, ok)
	}
}

func TestSecretValueKeys(t *testing.T) {
	if !isSecretValueKey(KeyStripeSecretKey) {
		t.Fatal("stripe secret should be secret")
	}
	if !isSecretValueKey(KeyEPRELAPIKey) {
		t.Fatal("eprel api key should be secret")
	}
	if !isSecretValueKey(KeyPineconeAPIKey) {
		t.Fatal("pinecone.api_key should be secret")
	}
	if !isSecretValueKey(ValueKeyResendAPIKey) {
		t.Fatal("mail.resend_api_key should be secret")
	}
	if isSecretValueKey(KeyPineconeHost) {
		t.Fatal("pinecone.host should not be secret")
	}
	if isSecretValueKey(KeyStripeMock) {
		t.Fatal("stripe.mock should not be secret")
	}
}

func TestAllowedValueKeys(t *testing.T) {
	if !isAllowedValueKey(KeyEPRELFicheLanguage) {
		t.Fatal("eprel.fiche_language must be allowed")
	}
	if isAllowedValueKey("evil.injection") {
		t.Fatal("unknown keys must be rejected")
	}
}

func TestNormalizeEPRELFicheLanguage(t *testing.T) {
	got, err := NormalizeEPRELFicheLanguage(" de ")
	if err != nil || got != "DE" {
		t.Fatalf("got %q err=%v", got, err)
	}
	if _, err := NormalizeEPRELFicheLanguage("xx"); err == nil {
		t.Fatal("expected error for unsupported language")
	}
}

func TestResolvePinecone_envOnly(t *testing.T) {
	svc := NewService(nil, EnvConfig{
		PineconeAPIKey:    "pc-env-key",
		PineconeHost:      "https://index.svc.pinecone.io",
		PineconeNamespace: "ns-env",
	})
	got, err := svc.ResolvePinecone(context.Background())
	if err != nil {
		t.Fatal(err)
	}
	if !got.Configured() {
		t.Fatal("expected configured")
	}
	if got.APIKey != "pc-env-key" || got.Host != "https://index.svc.pinecone.io" || got.Namespace != "ns-env" {
		t.Fatalf("got %+v", got)
	}
}

func TestResolvePinecone_unset(t *testing.T) {
	svc := NewService(nil, EnvConfig{})
	got, err := svc.ResolvePinecone(context.Background())
	if err != nil {
		t.Fatal(err)
	}
	if got.Configured() {
		t.Fatalf("expected unset, got %+v", got)
	}
}