package cli

import (
	"os"
	"path/filepath"
	"strings"
	"testing"
)

// TestAuthInitIDP_RendersConfig tests that orca auth init-idp renders
// the Dex config, systemd unit, and Traefik route files (P06, REQ-155).
func TestAuthInitIDP_RendersConfig(t *testing.T) {
	t.Setenv("ORCA_HOME", t.TempDir())
	resetRootFlags(t)

	// Create the cluster dir + server cert/key so the rendered config paths exist.
	clusterDir := filepath.Join(os.Getenv("ORCA_HOME"), "cluster")
	if err := os.MkdirAll(clusterDir, 0o755); err != nil {
		t.Fatalf("mkdir cluster: %v", err)
	}
	if err := os.WriteFile(filepath.Join(clusterDir, "server.crt"), []byte("fake-cert"), 0o600); err != nil {
		t.Fatalf("write cert: %v", err)
	}
	if err := os.WriteFile(filepath.Join(clusterDir, "server.key"), []byte("fake-key"), 0o600); err != nil {
		t.Fatalf("write key: %v", err)
	}

	// Run init-idp with a temp output (we mock the system paths).
	// Since init-idp writes to /etc/systemd/system and /etc/traefik/dynamic,
	// we test the render functions directly.
	dexCfg := renderDexConfig(dexConfig{
		Issuer:         "https://orca.local",
		ConfigPath:     "/tmp/dex.yaml",
		ClusterDir:      clusterDir,
		ServerCertPath:  filepath.Join(clusterDir, "server.crt"),
		ServerKeyPath:   filepath.Join(clusterDir, "server.key"),
		RPID:            "orca.local",
		CredsDBPath:     filepath.Join(clusterDir, "webauthn-credentials.db"),
	})
	if !strings.Contains(dexCfg, "issuer: https://orca.local") {
		t.Errorf("dex config missing issuer: %s", dexCfg)
	}
	if !strings.Contains(dexCfg, "orca-webauthn") {
		t.Errorf("dex config missing webauthn connector: %s", dexCfg)
	}
	if !strings.Contains(dexCfg, "rpID: orca.local") {
		t.Errorf("dex config missing rpID: %s", dexCfg)
	}

	unit := renderDexSystemdUnit("/tmp/dex.yaml")
	if !strings.Contains(unit, "Orca Dex") {
		t.Errorf("systemd unit missing orca-dex: %s", unit)
	}
	if !strings.Contains(unit, "dex serve /tmp/dex.yaml") {
		t.Errorf("systemd unit missing ExecStart: %s", unit)
	}

	route := renderDexTraefikRoute("orca.local")
	if !strings.Contains(route, "orca.local") {
		t.Errorf("traefik route missing rpID: %s", route)
	}
	if !strings.Contains(route, "orca-dex") {
		t.Errorf("traefik route missing service name: %s", route)
	}
}

// TestAuthRegisterCmd_Exists verifies the auth register command is registered.
func TestAuthRegisterCmd_Exists(t *testing.T) {
	found := false
	for _, cmd := range authCmd.Commands() {
		if cmd.Name() == "register" {
			found = true
			break
		}
	}
	if !found {
		t.Error("auth register command not found in auth subcommands")
	}
}

// TestDoctorOIDCCmd_Exists verifies the doctor oidc command is registered.
func TestDoctorOIDCCmd_Exists(t *testing.T) {
	found := false
	for _, cmd := range doctorCmd.Commands() {
		if cmd.Name() == "oidc" {
			found = true
			break
		}
	}
	if !found {
		t.Error("doctor oidc command not found in doctor subcommands")
	}
}