import { expect, test } from "vitest";
import { loadConfig } from "../src/config.js";

test("loadConfig accepts container listening and runtime paths", () => {
  expect(loadConfig({
    HOST: "0.0.0.0",
    PORT: "9000",
    THT_HARNESS_DIR: "/app/harness",
    THT_BIN: "/opt/venv/bin/tht",
    PI_BIN: "/usr/local/bin/pi",
    SETTINGS_FILE: "/data/settings/settings.json",
    THT_DATA_ROOT: "/data",
  })).toMatchObject({
    host: "0.0.0.0",
    port: 9000,
    harnessDir: "/app/harness",
    thtBin: "/opt/venv/bin/tht",
    piBin: "/usr/local/bin/pi",
    settingsFile: "/data/settings/settings.json",
    dataRoot: "/data",
  });
});

test("loadConfig keeps local development defaults", () => {
  expect(loadConfig({})).toMatchObject({
    host: "127.0.0.1",
    port: 8787,
    harnessDir: "../harness",
    thtBin: "tht",
    piBin: "pi",
    settingsFile: "data/settings.json",
  });
  expect(loadConfig({}).dataRoot).toBeUndefined();
});

test("loadConfig rejects unauthenticated public exposure", () => {
  expect(() => loadConfig({
    THOTH_PUBLIC_EXPOSURE: "true",
    AUTH_MODE: "none",
  })).toThrow(/public exposure requires AUTH_MODE=upstream/);
});

test("loadConfig accepts an authenticated upstream trust boundary", () => {
  expect(loadConfig({
    THOTH_PUBLIC_EXPOSURE: "true",
    AUTH_MODE: "upstream",
  }).authMode).toBe("upstream");
});

test("loadConfig accepts only an absolute generic model key file", () => {
  expect(loadConfig({ THT_MODEL_API_KEY_FILE: "/run/secrets/model_api_key" }).modelApiKeyFile)
    .toBe("/run/secrets/model_api_key");
  expect(() => loadConfig({ THT_MODEL_API_KEY_FILE: "relative/key" }))
    .toThrow(/model credential configuration is invalid/);
  expect(() => loadConfig({ THT_MODEL_API_KEY_FILE: " /run/secrets/key" }))
    .toThrow(/model credential configuration is invalid/);
});