"""Tests for the production configuration safety guard (config.check_production_safety)."""

from __future__ import annotations

import base64

import pytest
from legate.config import Settings, UnsafeProductionConfig, check_production_safety

_VALID_MASTER_KEY = base64.b64encode(b"1" * 32).decode()


def _safe_prod_settings(**overrides: object) -> Settings:
    """A production Settings instance that passes the guard, minus any overrides."""
    base: dict[str, object] = {
        "legate_env": "production",
        "legate_secret_key": "a-long-random-production-secret-value",
        "legate_master_key": _VALID_MASTER_KEY,
        "database_url": "postgresql+psycopg://legate:strong-pw@db:5432/legate",
    }
    base.update(overrides)
    return Settings(**base)


def test_safe_production_config_passes() -> None:
    check_production_safety(_safe_prod_settings())  # should not raise


def test_non_production_is_never_blocked() -> None:
    # Even with every insecure default, development must boot freely.
    check_production_safety(
        Settings(
            legate_env="development",
            legate_secret_key="dev-insecure-secret-change-me",
            legate_master_key="",
            database_url="postgresql+psycopg://legate:legate@postgres:5432/legate",
        )
    )


@pytest.mark.parametrize("bad_secret", ["", "dev-insecure-secret-change-me", "CHANGEME-now"])
def test_default_or_empty_secret_key_blocks_production(bad_secret: str) -> None:
    with pytest.raises(UnsafeProductionConfig, match="LEGATE_SECRET_KEY"):
        check_production_safety(_safe_prod_settings(legate_secret_key=bad_secret))


def test_missing_master_key_blocks_production() -> None:
    with pytest.raises(UnsafeProductionConfig, match="LEGATE_MASTER_KEY"):
        check_production_safety(_safe_prod_settings(legate_master_key=""))


@pytest.mark.parametrize("bad_master", ["not-base64!!", base64.b64encode(b"short").decode()])
def test_invalid_master_key_blocks_production(bad_master: str) -> None:
    with pytest.raises(UnsafeProductionConfig, match="32 bytes"):
        check_production_safety(_safe_prod_settings(legate_master_key=bad_master))


def test_default_database_credentials_block_production() -> None:
    with pytest.raises(UnsafeProductionConfig, match="DATABASE_URL"):
        check_production_safety(
            _safe_prod_settings(
                database_url="postgresql+psycopg://legate:legate@postgres:5432/legate"
            )
        )


def test_all_problems_are_reported_together() -> None:
    with pytest.raises(UnsafeProductionConfig) as exc:
        check_production_safety(
            _safe_prod_settings(
                legate_secret_key="change-me",
                legate_master_key="",
                database_url="postgresql+psycopg://legate:legate@postgres:5432/legate",
            )
        )
    message = str(exc.value)
    assert "LEGATE_SECRET_KEY" in message
    assert "LEGATE_MASTER_KEY" in message
    assert "DATABASE_URL" in message
