package app

import (
	"bytes"
	"testing"
)

func productionConfigForTest() Config {
	return Config{
		Port:                8888,
		DSN:                 "xingyu:password@tcp(mysql:3306)/im",
		JWTSecret:           "0123456789abcdef0123456789abcdef",
		ConfigEncryptionKey: "abcdef0123456789abcdef0123456789",
		Environment:         "production",
		AllowedOrigins:      []string{"https://app.example.com", "https://admin.example.com"},
	}
}

func TestValidateProductionConfig(t *testing.T) {
	config := productionConfigForTest()
	if err := validateConfig(config); err != nil {
		t.Fatalf("expected a valid production config: %v", err)
	}

	tests := []struct {
		name   string
		mutate func(*Config)
	}{
		{"root database account", func(config *Config) { config.DSN = "root:root@tcp(mysql:3306)/im" }},
		{"weak jwt", func(config *Config) { config.JWTSecret = "short" }},
		{"missing encryption key", func(config *Config) { config.ConfigEncryptionKey = "" }},
		{"wildcard cors", func(config *Config) { config.AllowedOrigins = []string{"*"} }},
		{"insecure origin", func(config *Config) { config.AllowedOrigins = []string{"http://app.example.com"} }},
		{"demo seed", func(config *Config) { config.SeedDemo = true }},
	}
	for _, test := range tests {
		t.Run(test.name, func(t *testing.T) {
			invalid := config
			test.mutate(&invalid)
			if err := validateConfig(invalid); err == nil {
				t.Fatal("expected production validation to reject config")
			}
		})
	}
}

func TestPhoneEncryptionRoundTrip(t *testing.T) {
	application := &App{config: productionConfigForTest()}
	phone := "13800138000"
	first, err := application.encryptPhone(phone)
	if err != nil {
		t.Fatal(err)
	}
	second, err := application.encryptPhone(phone)
	if err != nil {
		t.Fatal(err)
	}
	if bytes.Equal(first, second) {
		t.Fatal("phone encryption must use a unique random nonce")
	}
	decrypted, err := application.decryptPhone(first)
	if err != nil || decrypted != phone {
		t.Fatalf("unexpected decrypted phone %q: %v", decrypted, err)
	}
}

func TestProductionURLValidation(t *testing.T) {
	if !validHTTPSURL("https://pay.example.com/create") {
		t.Fatal("expected HTTPS URL to be accepted")
	}
	for _, value := range []string{"http://pay.example.com", "javascript:alert(1)", "https:///missing-host", ""} {
		if validHTTPSURL(value) {
			t.Fatalf("expected URL to be rejected: %s", value)
		}
	}
}

func TestPasswordAndPhoneRules(t *testing.T) {
	if !validUserPassword("Password123") || validUserPassword("12345678") || validUserPassword("password") {
		t.Fatal("password policy is not enforced")
	}
	if !strongAdminPassword("AdminPassword@123") || strongAdminPassword("Password123") || strongAdminPassword("adminpassword@123") {
		t.Fatal("admin password policy is not enforced")
	}
	if !validPhone("13800138000") || validPhone("23800138000") || validPhone("1380013800x") {
		t.Fatal("phone policy is not enforced")
	}
}