package pi

import (
	"context"
	"strings"
	"testing"
)

func TestDoctorRequiresExternalEndpointAuthPiStateAndHealth(t *testing.T) {
	fake := newFakeRunner()
	if err := Doctor(context.Background(), fake); err != nil {
		t.Fatalf("Doctor() error = %v", err)
	}
	for _, command := range []string{"pi --version", "test -w /home/thoth/.pi", "test -r /home/thoth/.pi/agent/auth.json", "/health"} {
		assertCalled(t, fake.calls, command)
	}
}

func TestConfigureValidatesBackendModelOptionsWritesRealCoreSettingsAndUsesUpstreamIdentity(t *testing.T) {
	fake := newFakeRunner()
	if err := Configure(context.Background(), fake, Defaults{Provider: "provider", Model: "model", Thinking: "medium"}); err != nil {
		t.Fatal(err)
	}
	assertCalled(t, fake.calls, "node /app/backend/dist/settings/settings-cli.js --provider provider --model model --thinking medium")
	assertCalled(t, fake.calls, "x-thoth-principal-subject: thothctl-maintenance")
	if got := strings.Join(fake.calls, "\n"); strings.Contains(got, "pi-defaults.json") || strings.Contains(got, "secret") {
		t.Fatalf("commands=%q", got)
	}
	if err := Configure(context.Background(), fake, Defaults{Provider: "provider", Model: "unknown", Thinking: "medium"}); err == nil {
		t.Fatal("expected unknown model rejection")
	}
}

func TestTestUsesOnlySanitizedPiAndCoreProbes(t *testing.T) {
	fake := newFakeRunner()
	if err := Test(context.Background(), fake); err != nil {
		t.Fatalf("Test() error = %v", err)
	}
	for _, command := range []string{"pi --version", "/health", "/models", "/settings"} {
		assertCalled(t, fake.calls, command)
	}
	if got := strings.Join(fake.calls, "\n"); strings.Contains(got, "secret") {
		t.Fatalf("probe commands expose secret: %s", got)
	}
}