using Microsoft.Extensions.Configuration;
using Tiku.Api.Options;
using Tiku.Application.Security;
using Tiku.Infrastructure.Commerce;

namespace Tiku.IntegrationTests.Api;

public sealed class ProductionConfigurationTests
{
    [Fact]
    public void Database_connection_is_required_outside_development()
    {
        var configuration = new ConfigurationBuilder().Build();

        var exception = Assert.Throws<InvalidOperationException>(() =>
            OptionsValidation.ResolveDatabaseConnectionString(configuration, isDevelopment: false));

        Assert.Contains("Database connection is required", exception.Message, StringComparison.Ordinal);
    }

    [Fact]
    public void Development_database_default_uses_current_system_user_without_a_password()
    {
        var configuration = new ConfigurationBuilder().Build();

        var connectionString = OptionsValidation.ResolveDatabaseConnectionString(
            configuration,
            isDevelopment: true);

        Assert.Contains($"Username={Environment.UserName}", connectionString, StringComparison.Ordinal);
        Assert.DoesNotContain("Password=", connectionString, StringComparison.OrdinalIgnoreCase);
    }

    [Fact]
    public void Production_rejects_the_committed_development_jwt_key()
    {
        var options = new JwtOptions
        {
            SigningKey = OptionsValidation.DevelopmentSigningKey
        };

        Assert.False(OptionsValidation.BeValidJwtOptions(options, isProduction: true));
        Assert.True(OptionsValidation.BeValidJwtOptions(options, isProduction: false));
    }

    [Fact]
    public void Tenant_secret_encryption_requires_a_32_byte_base64_key()
    {
        Assert.False(TenantSecretEncryptionOptions.BeValid(new TenantSecretEncryptionOptions()));
        Assert.False(TenantSecretEncryptionOptions.BeValid(new TenantSecretEncryptionOptions
        {
            KeyId = "key-v1",
            MasterKey = Convert.ToBase64String(new byte[16])
        }));
        Assert.True(TenantSecretEncryptionOptions.BeValid(new TenantSecretEncryptionOptions
        {
            KeyId = "key-v1",
            MasterKey = Convert.ToBase64String(new byte[32])
        }));
    }
}