config_test.go

package config

import (
	"os"
	"path/filepath"
	"reflect"
	"testing"
	"time"

	"github.com/getarcaneapp/arcane/backend/internal/common"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

func TestConfig_LoadPermissions(t *testing.T) {
	// Save original env and common perms
	origFilePerm := os.Getenv("FILE_PERM")
	origDirPerm := os.Getenv("DIR_PERM")
	origCommonFilePerm := common.FilePerm
	origCommonDirPerm := common.DirPerm

	defer func() {
		restoreEnv("FILE_PERM", origFilePerm)
		restoreEnv("DIR_PERM", origDirPerm)
		common.FilePerm = origCommonFilePerm
		common.DirPerm = origCommonDirPerm
	}()

	t.Run("Default permissions", func(t *testing.T) {
		unsetEnv(t, "FILE_PERM")
		unsetEnv(t, "DIR_PERM")

		cfg := Load()
		assert.Equal(t, os.FileMode(0o644), cfg.FilePerm)
		assert.Equal(t, os.FileMode(0o755), cfg.DirPerm)
		assert.Equal(t, os.FileMode(0o644), common.FilePerm)
		assert.Equal(t, os.FileMode(0o755), common.DirPerm)
	})

	t.Run("Custom permissions", func(t *testing.T) {
		setEnv(t, "FILE_PERM", "0664")
		setEnv(t, "DIR_PERM", "0775")

		cfg := Load()
		assert.Equal(t, os.FileMode(0o664), cfg.FilePerm)
		assert.Equal(t, os.FileMode(0o775), cfg.DirPerm)
		assert.Equal(t, os.FileMode(0o664), common.FilePerm)
		assert.Equal(t, os.FileMode(0o775), common.DirPerm)
	})

	t.Run("Restrictive permissions", func(t *testing.T) {
		setEnv(t, "FILE_PERM", "0600")
		setEnv(t, "DIR_PERM", "0700")

		cfg := Load()
		assert.Equal(t, os.FileMode(0o600), cfg.FilePerm)
		assert.Equal(t, os.FileMode(0o700), cfg.DirPerm)
		assert.Equal(t, os.FileMode(0o600), common.FilePerm)
		assert.Equal(t, os.FileMode(0o700), common.DirPerm)
	})
}

func TestConfig_DockerSecretsFileSupport(t *testing.T) {
	// Save original env vars
	origEncryptionKey := os.Getenv("ENCRYPTION_KEY")
	origEncryptionKeyFile := os.Getenv("ENCRYPTION_KEY_FILE")
	origEncryptionKeyDoubleFile := os.Getenv("ENCRYPTION_KEY__FILE")
	origJWTSecret := os.Getenv("JWT_SECRET")
	origJWTSecretFile := os.Getenv("JWT_SECRET_FILE")
	origJWTSecretDoubleFile := os.Getenv("JWT_SECRET__FILE")
	origDefaultAPIKey := os.Getenv("ADMIN_STATIC_API_KEY")
	origDefaultAPIKeyFile := os.Getenv("ADMIN_STATIC_API_KEY_FILE")
	origDefaultAPIKeyDoubleFile := os.Getenv("ADMIN_STATIC_API_KEY__FILE")

	defer func() {
		restoreEnv("ENCRYPTION_KEY", origEncryptionKey)
		restoreEnv("ENCRYPTION_KEY_FILE", origEncryptionKeyFile)
		restoreEnv("ENCRYPTION_KEY__FILE", origEncryptionKeyDoubleFile)
		restoreEnv("JWT_SECRET", origJWTSecret)
		restoreEnv("JWT_SECRET_FILE", origJWTSecretFile)
		restoreEnv("JWT_SECRET__FILE", origJWTSecretDoubleFile)
		restoreEnv("ADMIN_STATIC_API_KEY", origDefaultAPIKey)
		restoreEnv("ADMIN_STATIC_API_KEY_FILE", origDefaultAPIKeyFile)
		restoreEnv("ADMIN_STATIC_API_KEY__FILE", origDefaultAPIKeyDoubleFile)
	}()

	t.Run("Load sensitive field from _FILE env var", func(t *testing.T) {
		// Create a temp file with the secret
		tmpDir := t.TempDir()
		secretFile := filepath.Join(tmpDir, "encryption_key")
		secretValue := "my-super-secret-encryption-key-32chars!"
		err := os.WriteFile(secretFile, []byte(secretValue), 0o600)
		require.NoError(t, err)

		// Clear direct env var and set _FILE variant
		unsetEnv(t, "ENCRYPTION_KEY")
		unsetEnv(t, "ENCRYPTION_KEY__FILE")
		setEnv(t, "ENCRYPTION_KEY_FILE", secretFile)

		cfg := Load()
		assert.Equal(t, secretValue, cfg.EncryptionKey)
	})

	t.Run("Falls back to default when _FILE points to non-existent file", func(t *testing.T) {
		unsetEnv(t, "ENCRYPTION_KEY")
		setEnv(t, "ENCRYPTION_KEY_FILE", "/nonexistent/path/to/secret")
		unsetEnv(t, "ENCRYPTION_KEY__FILE")

		cfg := Load()
		assert.Equal(t, "arcane-dev-key-32-characters!!!", cfg.EncryptionKey)
	})

	t.Run("Load sensitive field from __FILE env var (double underscore)", func(t *testing.T) {
		// Create a temp file with the secret
		tmpDir := t.TempDir()
		secretFile := filepath.Join(tmpDir, "jwt_secret")
		testJWTValue := "test-jwt-stored-in-file"
		err := os.WriteFile(secretFile, []byte(testJWTValue+"\n"), 0o600) // Include trailing newline
		require.NoError(t, err)

		// Clear direct env var and set __FILE variant
		unsetEnv(t, "JWT_SECRET")
		unsetEnv(t, "JWT_SECRET_FILE")
		setEnv(t, "JWT_SECRET__FILE", secretFile)

		cfg := Load()
		assert.Equal(t, testJWTValue, cfg.JWTSecret) // Should be trimmed
	})

	t.Run("Direct env var is used when no _FILE variant exists", func(t *testing.T) {
		directValue := "direct-encryption-key-value-32chars!!"
		setEnv(t, "ENCRYPTION_KEY", directValue)
		unsetEnv(t, "ENCRYPTION_KEY_FILE")
		unsetEnv(t, "ENCRYPTION_KEY__FILE")

		cfg := Load()
		assert.Equal(t, directValue, cfg.EncryptionKey)
	})

	t.Run("Default admin API key supports direct env var", func(t *testing.T) {
		directValue := "arc_directbootstrapkey1234567890"
		setEnv(t, "ADMIN_STATIC_API_KEY", directValue)
		unsetEnv(t, "ADMIN_STATIC_API_KEY_FILE")
		unsetEnv(t, "ADMIN_STATIC_API_KEY__FILE")

		cfg := Load()
		assert.Equal(t, directValue, cfg.AdminStaticAPIKey)
	})

	t.Run("_FILE takes precedence over direct env var", func(t *testing.T) {
		// Create a temp file with the secret
		tmpDir := t.TempDir()
		secretFile := filepath.Join(tmpDir, "encryption_key")
		fileValue := "value-from-file-takes-precedence!!"
		err := os.WriteFile(secretFile, []byte(fileValue), 0o600)
		require.NoError(t, err)

		// Set both direct and _FILE variants
		setEnv(t, "ENCRYPTION_KEY", "direct-value-should-be-ignored!!!")
		unsetEnv(t, "ENCRYPTION_KEY__FILE")
		setEnv(t, "ENCRYPTION_KEY_FILE", secretFile)

		cfg := Load()
		assert.Equal(t, fileValue, cfg.EncryptionKey)
	})

	t.Run("Default admin API key loads from _FILE env var", func(t *testing.T) {
		tmpDir := t.TempDir()
		secretFile := filepath.Join(tmpDir, "default_api_key")
		secretValue := "arc_filebootstrapkey1234567890"
		err := os.WriteFile(secretFile, []byte(secretValue), 0o600)
		require.NoError(t, err)

		unsetEnv(t, "ADMIN_STATIC_API_KEY")
		unsetEnv(t, "ADMIN_STATIC_API_KEY__FILE")
		setEnv(t, "ADMIN_STATIC_API_KEY_FILE", secretFile)

		cfg := Load()
		assert.Equal(t, secretValue, cfg.AdminStaticAPIKey)
	})

	t.Run("__FILE takes precedence over _FILE", func(t *testing.T) {
		tmpDir := t.TempDir()

		// Create single underscore file
		singleFile := filepath.Join(tmpDir, "single")
		err := os.WriteFile(singleFile, []byte("single-underscore-value-32chars!!"), 0o600)
		require.NoError(t, err)

		// Create double underscore file
		doubleFile := filepath.Join(tmpDir, "double")
		err = os.WriteFile(doubleFile, []byte("double-underscore-value-32chars!!"), 0o600)
		require.NoError(t, err)

		unsetEnv(t, "JWT_SECRET")
		setEnv(t, "JWT_SECRET_FILE", singleFile)
		setEnv(t, "JWT_SECRET__FILE", doubleFile)

		cfg := Load()
		assert.Equal(t, "double-underscore-value-32chars!!", cfg.JWTSecret)
	})

	t.Run("Default admin API key __FILE takes precedence over _FILE", func(t *testing.T) {
		tmpDir := t.TempDir()

		singleFile := filepath.Join(tmpDir, "default_api_key_single")
		err := os.WriteFile(singleFile, []byte("arc_singlebootstrapkey1234567890"), 0o600)
		require.NoError(t, err)

		doubleFile := filepath.Join(tmpDir, "default_api_key_double")
		err = os.WriteFile(doubleFile, []byte("arc_doublebootstrapkey1234567890\n"), 0o600)
		require.NoError(t, err)

		unsetEnv(t, "ADMIN_STATIC_API_KEY")
		setEnv(t, "ADMIN_STATIC_API_KEY_FILE", singleFile)
		setEnv(t, "ADMIN_STATIC_API_KEY__FILE", doubleFile)

		cfg := Load()
		assert.Equal(t, "arc_doublebootstrapkey1234567890", cfg.AdminStaticAPIKey)
	})

	t.Run("Non-sensitive fields do not support _FILE suffix", func(t *testing.T) {
		// Create a temp file
		tmpDir := t.TempDir()
		portFile := filepath.Join(tmpDir, "port")
		err := os.WriteFile(portFile, []byte("9999"), 0o600)
		require.NoError(t, err)

		// PORT is not marked with options:"file", so _FILE should not work
		unsetEnv(t, "PORT")
		setEnv(t, "PORT_FILE", portFile)

		cfg := Load()
		assert.Equal(t, "3552", cfg.Port) // Should use default, not file content
	})
}

func TestConfig_OptionsToLower(t *testing.T) {
	origLogLevel := os.Getenv("LOG_LEVEL")
	origEdgeTransport := os.Getenv("EDGE_TRANSPORT")
	origEdgeMTLSMode := os.Getenv("EDGE_MTLS_MODE")
	defer restoreEnv("LOG_LEVEL", origLogLevel)
	defer restoreEnv("EDGE_TRANSPORT", origEdgeTransport)
	defer restoreEnv("EDGE_MTLS_MODE", origEdgeMTLSMode)

	t.Run("LogLevel is converted to lowercase", func(t *testing.T) {
		setEnv(t, "LOG_LEVEL", "DEBUG")

		cfg := Load()
		assert.Equal(t, "debug", cfg.LogLevel)
	})

	t.Run("LogLevel mixed case is converted to lowercase", func(t *testing.T) {
		setEnv(t, "LOG_LEVEL", "WaRn")

		cfg := Load()
		assert.Equal(t, "warn", cfg.LogLevel)
	})

	t.Run("EdgeTransport is converted to lowercase", func(t *testing.T) {
		setEnv(t, "EDGE_TRANSPORT", "GRPC")

		cfg := Load()
		assert.Equal(t, "grpc", cfg.EdgeTransport)
	})

	t.Run("EdgeTransport defaults to auto", func(t *testing.T) {
		unsetEnv(t, "EDGE_TRANSPORT")

		cfg := Load()
		assert.Equal(t, "auto", cfg.EdgeTransport)
	})

	t.Run("EdgeMTLSMode is converted to lowercase", func(t *testing.T) {
		setEnv(t, "EDGE_MTLS_MODE", "REQUIRED")

		cfg := Load()
		assert.Equal(t, "required", cfg.EdgeMTLSMode)
	})

	t.Run("EdgeMTLSMode defaults to disabled", func(t *testing.T) {
		unsetEnv(t, "EDGE_MTLS_MODE")

		cfg := Load()
		assert.Equal(t, "disabled", cfg.EdgeMTLSMode)
	})
}

func TestConfig_AllowDowngrade(t *testing.T) {
	origAllowDowngrade := os.Getenv("ALLOW_DOWNGRADE")
	defer restoreEnv("ALLOW_DOWNGRADE", origAllowDowngrade)

	t.Run("defaults to false", func(t *testing.T) {
		unsetEnv(t, "ALLOW_DOWNGRADE")

		cfg := Load()
		assert.False(t, cfg.AllowDowngrade)
	})

	t.Run("loads explicit true from env", func(t *testing.T) {
		setEnv(t, "ALLOW_DOWNGRADE", "true")

		cfg := Load()
		assert.True(t, cfg.AllowDowngrade)
	})
}

func TestConfig_ListenAddr(t *testing.T) {
	tests := []struct {
		name     string
		listen   string
		port     string
		expected string
	}{
		{
			name:     "empty listen uses all interfaces",
			listen:   "",
			port:     "3553",
			expected: ":3553",
		},
		{
			name:     "ipv4 listen",
			listen:   "127.0.0.1",
			port:     "3553",
			expected: "127.0.0.1:3553",
		},
		{
			name:     "ipv6 listen",
			listen:   "::1",
			port:     "3553",
			expected: "[::1]:3553",
		},
		{
			name:     "empty port falls back to default",
			listen:   "127.0.0.1",
			port:     "",
			expected: "127.0.0.1:3552",
		},
	}

	for _, testCase := range tests {
		t.Run(testCase.name, func(t *testing.T) {
			cfg := &Config{
				Listen: testCase.listen,
				Port:   testCase.port,
			}
			assert.Equal(t, testCase.expected, cfg.ListenAddr())
		})
	}
}

func TestConfig_TLSSettings(t *testing.T) {
	origTLSEnabled := os.Getenv("TLS_ENABLED")
	origTLSCertFile := os.Getenv("TLS_CERT_FILE")
	origTLSKeyFile := os.Getenv("TLS_KEY_FILE")
	defer restoreEnv("TLS_ENABLED", origTLSEnabled)
	defer restoreEnv("TLS_CERT_FILE", origTLSCertFile)
	defer restoreEnv("TLS_KEY_FILE", origTLSKeyFile)

	t.Run("defaults to tls disabled", func(t *testing.T) {
		unsetEnv(t, "TLS_ENABLED")
		unsetEnv(t, "TLS_CERT_FILE")
		unsetEnv(t, "TLS_KEY_FILE")

		cfg := Load()
		assert.False(t, cfg.TLSEnabled)
		assert.Equal(t, "", cfg.TLSCertFile)
		assert.Equal(t, "", cfg.TLSKeyFile)
	})

	t.Run("loads tls settings from env", func(t *testing.T) {
		setEnv(t, "TLS_ENABLED", "true")
		setEnv(t, "TLS_CERT_FILE", "/etc/ssl/certs/fullchain.pem")
		setEnv(t, "TLS_KEY_FILE", "/etc/ssl/private/privkey.pem")

		cfg := Load()
		assert.True(t, cfg.TLSEnabled)
		assert.Equal(t, "/etc/ssl/certs/fullchain.pem", cfg.TLSCertFile)
		assert.Equal(t, "/etc/ssl/private/privkey.pem", cfg.TLSKeyFile)
	})
}

func TestConfig_GetManagerGRPCAddr(t *testing.T) {
	t.Run("uses manager api url explicit port when present", func(t *testing.T) {
		cfg := &Config{
			ManagerApiUrl: "https://manager.example.com:8443/api",
		}
		assert.Equal(t, "manager.example.com:8443", cfg.GetManagerGRPCAddr())
	})

	t.Run("defaults to manager api https port when port is not set", func(t *testing.T) {
		cfg := &Config{
			ManagerApiUrl: "https://manager.example.com/api",
		}
		assert.Equal(t, "manager.example.com:443", cfg.GetManagerGRPCAddr())
	})

	t.Run("defaults to manager api http port when port is not set", func(t *testing.T) {
		cfg := &Config{
			ManagerApiUrl: "http://manager.example.com/api",
		}
		assert.Equal(t, "manager.example.com:80", cfg.GetManagerGRPCAddr())
	})

	t.Run("supports reverse-proxy path prefixes", func(t *testing.T) {
		cfg := &Config{
			ManagerApiUrl: "https://manager.example.com/arcane/api/",
		}
		assert.Equal(t, "manager.example.com:443", cfg.GetManagerGRPCAddr())
	})

	t.Run("supports ipv6 hosts behind reverse proxies", func(t *testing.T) {
		cfg := &Config{
			ManagerApiUrl: "https://[2001:db8::1]/arcane/api",
		}
		assert.Equal(t, "[2001:db8::1]:443", cfg.GetManagerGRPCAddr())
	})

	t.Run("returns empty for invalid manager url", func(t *testing.T) {
		cfg := &Config{
			ManagerApiUrl: "://bad-url",
		}
		assert.Equal(t, "", cfg.GetManagerGRPCAddr())
	})
}

func TestConfig_GetManagerBaseURL(t *testing.T) {
	t.Run("strips trailing slash and api suffix", func(t *testing.T) {
		cfg := &Config{
			ManagerApiUrl: "https://manager.example.com/api/",
		}
		assert.Equal(t, "https://manager.example.com", cfg.GetManagerBaseURL())
	})

	t.Run("keeps reverse-proxy path prefix", func(t *testing.T) {
		cfg := &Config{
			ManagerApiUrl: "https://manager.example.com/arcane/api/",
		}
		assert.Equal(t, "https://manager.example.com/arcane", cfg.GetManagerBaseURL())
	})
}

func TestConfig_JWTRefreshExpiry(t *testing.T) {
	origJWTRefreshExpiry := os.Getenv("JWT_REFRESH_EXPIRY")
	defer restoreEnv("JWT_REFRESH_EXPIRY", origJWTRefreshExpiry)

	t.Run("defaults to 7 days when not set", func(t *testing.T) {
		unsetEnv(t, "JWT_REFRESH_EXPIRY")

		cfg := Load()
		assert.Equal(t, 7*24*time.Hour, cfg.JWTRefreshExpiry)
	})

	t.Run("parses custom duration from env var", func(t *testing.T) {
		setEnv(t, "JWT_REFRESH_EXPIRY", "48h")

		cfg := Load()
		assert.Equal(t, 48*time.Hour, cfg.JWTRefreshExpiry)
	})

	t.Run("supports compound duration format", func(t *testing.T) {
		setEnv(t, "JWT_REFRESH_EXPIRY", "24h30m")

		cfg := Load()
		assert.Equal(t, 24*time.Hour+30*time.Minute, cfg.JWTRefreshExpiry)
	})

	t.Run("falls back to default on invalid duration", func(t *testing.T) {
		setEnv(t, "JWT_REFRESH_EXPIRY", "notaduration")

		cfg := Load()
		assert.Equal(t, 168*time.Hour, cfg.JWTRefreshExpiry)
	})

	t.Run("falls back to default on zero duration", func(t *testing.T) {
		setEnv(t, "JWT_REFRESH_EXPIRY", "0s")

		cfg := Load()
		assert.Equal(t, 168*time.Hour, cfg.JWTRefreshExpiry)
	})

	t.Run("falls back to default on negative duration", func(t *testing.T) {
		setEnv(t, "JWT_REFRESH_EXPIRY", "-1h")

		cfg := Load()
		assert.Equal(t, 168*time.Hour, cfg.JWTRefreshExpiry)
	})
}

func TestSetFieldValueInternal_DurationUsesFieldTagDefault(t *testing.T) {
	type durationConfig struct {
		SessionTimeout time.Duration `env:"SESSION_TIMEOUT" default:"2h"`
	}

	cfg := &durationConfig{}
	v := reflect.ValueOf(cfg).Elem()
	field := v.FieldByName("SessionTimeout")
	fieldType, ok := v.Type().FieldByName("SessionTimeout")
	require.True(t, ok)

	setFieldValueInternal(field, fieldType, "invalid-duration")

	assert.Equal(t, 2*time.Hour, cfg.SessionTimeout)
}

func restoreEnv(key, value string) {
	if value == "" {
		_ = os.Unsetenv(key)
	} else {
		_ = os.Setenv(key, value)
	}
}

func setEnv(t *testing.T, key, value string) {
	t.Helper()
	require.NoError(t, os.Setenv(key, value))
}

func unsetEnv(t *testing.T, key string) {
	t.Helper()
	require.NoError(t, os.Unsetenv(key))
}