package aiprovider

import "testing"

func TestEncryptDecryptRoundTrip(t *testing.T) {
	t.Setenv("APP_ENV", "development")
	key := DeriveKey("test-ai-key-material", "fallback")
	enc, err := EncryptSecret(key, "sk-test-secret-value")
	if err != nil {
		t.Fatal(err)
	}
	if enc == "" || enc == "sk-test-secret-value" {
		t.Fatalf("expected ciphertext, got %q", enc)
	}
	plain, err := DecryptSecret(key, enc)
	if err != nil {
		t.Fatal(err)
	}
	if plain != "sk-test-secret-value" {
		t.Fatalf("got %q", plain)
	}
}

func TestDecryptSecret_plaintextPassthrough(t *testing.T) {
	// Legacy/migrated rows may store unprefixed plaintext in local/dev only.
	t.Setenv("APP_ENV", "development")
	key := DeriveKey("test-ai-key-material", "fallback")
	got, err := DecryptSecret(key, "sk-legacy-plain")
	if err != nil {
		t.Fatal(err)
	}
	if got != "sk-legacy-plain" {
		t.Fatalf("got %q", got)
	}
}

func TestDecryptSecret_plaintextRejectedInProduction(t *testing.T) {
	t.Setenv("APP_ENV", "production")
	key := DeriveKey("test-ai-key-material", "fallback")
	if _, err := DecryptSecret(key, "sk-legacy-plain"); err == nil {
		t.Fatal("expected plaintext decrypt rejected in production")
	}
}

func TestAnalyticsMode(t *testing.T) {
	cases := []struct {
		mode, name, want string
	}{
		{ModeInternal, "", "internal"},
		{ModePopular, "openai", "popular:openai"},
		{ModePopular, "Google", "popular:google"},
		{ModeCustom, "", "custom"},
		{"", "", "internal"},
	}
	for _, c := range cases {
		got := AnalyticsMode(c.mode, c.name)
		if got != c.want {
			t.Fatalf("AnalyticsMode(%q,%q)=%q want %q", c.mode, c.name, got, c.want)
		}
	}
}

func TestLast4(t *testing.T) {
	if got := last4("sk-abcdefgh"); got != "efgh" {
		t.Fatalf("got %q", got)
	}
	if got := last4("ab"); got != "ab" {
		t.Fatalf("got %q", got)
	}
}

func TestFindPopular(t *testing.T) {
	p, ok := FindPopular("openai")
	if !ok || p.BaseURL == "" {
		t.Fatal("expected openai")
	}
	if _, ok := FindPopular("nope"); ok {
		t.Fatal("expected miss")
	}
}

func TestValidateProviderBaseURL(t *testing.T) {
	ok, err := validateProviderBaseURL("https://api.openai.com/v1")
	if err != nil || ok == "" {
		t.Fatalf("want ok, got %q err=%v", ok, err)
	}
	if _, err := validateProviderBaseURL("http://169.254.169.254/"); err == nil {
		t.Fatal("expected metadata URL blocked")
	}
	if _, err := validateProviderBaseURL("http://192.168.1.1/v1"); err == nil {
		t.Fatal("expected private IP blocked")
	}
}