// Copyright 2025 NVIDIA Corporation
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

#include <env.h>

#include <gtest/gtest.h>

using namespace recc;

// TODO: Add an integration test that verifies mTLS credentials are actually
// passed to the gRPC channel. This requires a TLS-capable test gRPC server
// and self-signed certificate generation (e.g. via OpenSSL APIs), which is
// not yet available in the test infrastructure.

class EnvMtlsTest : public ::testing::Test {
  protected:
    void SetUp() override { resetMtlsVars(); }
    void TearDown() override { resetMtlsVars(); }

  private:
    static void resetMtlsVars()
    {
        RECC_SERVER_CERT = "";
        RECC_CLIENT_KEY = "";
        RECC_CLIENT_CERT = "";
    }
};

TEST_F(EnvMtlsTest, DefaultsAreEmpty)
{
    const char *testEnviron[] = {nullptr};
    Env::parse_config_variables(testEnviron);

    EXPECT_TRUE(RECC_SERVER_CERT.empty());
    EXPECT_TRUE(RECC_CLIENT_KEY.empty());
    EXPECT_TRUE(RECC_CLIENT_CERT.empty());
}

TEST_F(EnvMtlsTest, ServerCertIsParsed)
{
    const char *testEnviron[] = {"RECC_SERVER_CERT=/path/to/ca.pem", nullptr};
    Env::parse_config_variables(testEnviron);

    EXPECT_EQ("/path/to/ca.pem", RECC_SERVER_CERT);
    EXPECT_TRUE(RECC_CLIENT_KEY.empty());
    EXPECT_TRUE(RECC_CLIENT_CERT.empty());
}

TEST_F(EnvMtlsTest, ClientKeyAndCertAreParsed)
{
    const char *testEnviron[] = {"RECC_CLIENT_KEY=/path/to/client-key.pem",
                                 "RECC_CLIENT_CERT=/path/to/client-cert.pem",
                                 nullptr};
    Env::parse_config_variables(testEnviron);

    EXPECT_TRUE(RECC_SERVER_CERT.empty());
    EXPECT_EQ("/path/to/client-key.pem", RECC_CLIENT_KEY);
    EXPECT_EQ("/path/to/client-cert.pem", RECC_CLIENT_CERT);
}

TEST_F(EnvMtlsTest, AllMtlsVarsAreParsed)
{
    const char *testEnviron[] = {"RECC_SERVER_CERT=/path/to/ca.pem",
                                 "RECC_CLIENT_KEY=/path/to/client-key.pem",
                                 "RECC_CLIENT_CERT=/path/to/client-cert.pem",
                                 nullptr};
    Env::parse_config_variables(testEnviron);

    EXPECT_EQ("/path/to/ca.pem", RECC_SERVER_CERT);
    EXPECT_EQ("/path/to/client-key.pem", RECC_CLIENT_KEY);
    EXPECT_EQ("/path/to/client-cert.pem", RECC_CLIENT_CERT);
}

TEST_F(EnvMtlsTest, ClientKeyWithoutCertThrows)
{
    RECC_CLIENT_KEY = "/path/to/client-key.pem";
    EXPECT_THROW(Env::handle_special_defaults(), std::runtime_error);
}

TEST_F(EnvMtlsTest, ClientCertWithoutKeyThrows)
{
    RECC_CLIENT_CERT = "/path/to/client-cert.pem";
    EXPECT_THROW(Env::handle_special_defaults(), std::runtime_error);
}

TEST_F(EnvMtlsTest, ClientKeyAndCertTogetherAccepted)
{
    RECC_CLIENT_KEY = "/path/to/client-key.pem";
    RECC_CLIENT_CERT = "/path/to/client-cert.pem";
    EXPECT_NO_THROW(Env::handle_special_defaults());
}
