import { describe, expect, it } from 'vitest'

import { getRuntimeConfigDiagnostics } from '../runtime-config'

describe('getRuntimeConfigDiagnostics', () => {
  it('marks loopback-only development posture as local and not public-ready', () => {
    const diagnostics = getRuntimeConfigDiagnostics({
      apiDomain: 'http://localhost:3001',
      websiteDomain: 'http://localhost:4273',
      superTokensCoreUri: 'http://localhost:3567',
      cookieSecure: false,
    })

    expect(diagnostics.mode).toBe('local')
    expect(diagnostics.publicOriginReady).toBe(false)
    expect(diagnostics.errors).toEqual([])
    expect(diagnostics.warnings).toContain('API_DOMAIN still targets a loopback/local-development origin.')
    expect(diagnostics.warnings).toContain('WEBSITE_DOMAIN still targets a loopback/local-development origin.')
  })

  it('marks public https posture as ready when cookie hardening is enabled', () => {
    const diagnostics = getRuntimeConfigDiagnostics({
      apiDomain: 'https://hypertwist.app',
      websiteDomain: 'https://hypertwist.app',
      superTokensCoreUri: 'https://auth-core.internal',
      cookieSecure: true,
      githubClientId: 'github-client-id',
      githubClientSecret: 'github-client-secret',
    })

    expect(diagnostics.mode).toBe('public')
    expect(diagnostics.publicOriginReady).toBe(true)
    expect(diagnostics.errors).toEqual([])
    expect(diagnostics.warnings).toEqual([])
  })

  it('flags invalid origins and partial oauth configuration', () => {
    const diagnostics = getRuntimeConfigDiagnostics({
      apiDomain: 'https://hypertwist.app/auth',
      websiteDomain: 'not-a-url',
      superTokensCoreUri: 'http://localhost:3567',
      cookieSecure: false,
      googleClientId: 'only-client-id',
      orcidClientId: 'only-orcid-client-id',
    })

    expect(diagnostics.publicOriginReady).toBe(false)
    expect(diagnostics.errors).toContain('API_DOMAIN must not include a path; use API_BASE_PATH for route prefixing.')
    expect(diagnostics.errors).toContain('WEBSITE_DOMAIN must be an absolute URL origin.')
    expect(diagnostics.warnings).toContain('Google OAuth is only partially configured; set both client ID and client secret or neither.')
    expect(diagnostics.warnings).toContain('ORCID OAuth is only partially configured; set both client ID and client secret or neither.')
  })
})
