package config

import (
	"os"
	"path/filepath"
	"testing"

	"pve-confsync/internal/adapter"
	"pve-confsync/internal/model"
)

func TestLoadExample(t *testing.T) {
	c, err := Load(filepath.Join("..", "..", "examples", "confsync.example.yaml"))
	if err != nil {
		t.Fatal(err)
	}
	a, _ := adapter.ByKind(model.KindZone)
	cl, _ := c.Client("site-a")
	if p := c.Policy(cl, a, "mtu"); p != adapter.Ignore {
		t.Fatalf("site-a mtu policy = %s", p)
	}
	if p := c.Policy(nil, a, "bridge"); p != adapter.Override {
		t.Fatalf("bridge policy = %s", p)
	}
	if c.Selected(model.KindZone, "lab1") || !c.Selected(model.KindZone, "vlanz") {
		t.Fatal("selection")
	}
}

func TestRejects(t *testing.T) {
	for name, body := range map[string]string{
		"clear secret": "reference: {name: r, url: https://x, token_id: a@pve!b, token_secret: s}\n",
		"no secret":    "reference: {name: r, url: https://x, token_id: a@pve!b}\n",
		"forbidden":    "reference: {name: r, url: https://x, token_id: a@pve!b, token_secret_env: X}\npolicies: {datacenter-options: {webauthn: sync}}\n",
		"bad policy":   "reference: {name: r, url: https://x, token_id: a@pve!b, token_secret_env: X}\npolicies: {sdn-zone: {mtu: copy}}\n",
		"unknown kind": "reference: {name: r, url: https://x, token_id: a@pve!b, token_secret_env: X}\nkinds: [firewall]\n",
	} {
		f := filepath.Join(t.TempDir(), "c.yaml")
		_ = os.WriteFile(f, []byte(body), 0o600)
		if _, err := Load(f); err == nil {
			t.Errorf("%s: expected an error", name)
		}
	}
}