import os
import subprocess
import sys
from pathlib import Path

import pytest

from portal.config.env import ConfigError, load_config

ROOT = Path(__file__).resolve().parents[2]


def test_valid_environment_uses_safe_defaults(valid_env):
    config = load_config(valid_env)
    assert config.debug is False
    assert config.log_level == "INFO"
    assert config.default_timezone == "Europe/Berlin"
    assert config.trusted_proxies == []
    assert config.allowed_hosts == ["testserver"]


def test_every_problem_is_listed_and_no_value_leaks(valid_env):
    secret = "short-secret"
    env = {
        **valid_env,
        "SECRET_KEY": secret,
        "LOG_LEVEL": "loud",
        "DEBUG": "maybe",
        "TRUSTED_PROXIES": "not-an-ip",
        "DEFAULT_TIMEZONE": "Nowhere/Land",
    }
    del env["ALLOWED_HOSTS"]
    with pytest.raises(ConfigError) as info:
        load_config(env)
    message = str(info.value)
    for name in (
        "SECRET_KEY",
        "ALLOWED_HOSTS",
        "LOG_LEVEL",
        "DEBUG",
        "TRUSTED_PROXIES",
        "DEFAULT_TIMEZONE",
    ):
        assert name in message
    assert secret not in message


def test_missing_data_dir_is_reported(valid_env, tmp_path):
    with pytest.raises(ConfigError, match="DATA_DIR"):
        load_config({**valid_env, "DATA_DIR": str(tmp_path / "missing")})


def test_process_exits_nonzero_naming_both_variables(tmp_path):
    env = {k: v for k, v in os.environ.items() if k not in ("SECRET_KEY", "LOG_LEVEL")}
    env.update(
        ALLOWED_HOSTS="testserver",
        DATA_DIR=str(tmp_path),
        LOG_LEVEL="loud",
        DJANGO_SETTINGS_MODULE="portal.config.settings",
    )
    result = subprocess.run(
        [sys.executable, "manage.py", "check"],
        cwd=ROOT,
        env=env,
        capture_output=True,
        text=True,
        check=False,
    )
    assert result.returncode != 0
    assert "SECRET_KEY" in result.stderr
    assert "LOG_LEVEL" in result.stderr
    assert "Traceback" not in result.stderr


@pytest.mark.parametrize(
    "name",
    [
        "LDAP_SERVER",
        "LDAP_USER_OU_DN",
        "LDAP_BIND_DN",
        "LDAP_BIND_PASSWORD",
        "LDAP_CA_FILE",
        "LDAP_PUBLISHER_GROUP_DN",
        "LDAP_ADMIN_GROUP_DN",
    ],
)
def test_each_directory_variable_is_required(valid_env, name):
    del valid_env[name]
    with pytest.raises(ConfigError, match=name):
        load_config(valid_env)


def test_directory_settings_are_loaded_and_the_password_is_not_printed(valid_env):
    directory = load_config(valid_env).directory
    assert directory.server == "dc.example.test"
    assert directory.user_ou_dn == "OU=Users,DC=example,DC=test"
    assert "service-password" not in repr(directory)


def test_ldap_server_must_not_be_a_url(valid_env):
    with pytest.raises(ConfigError, match="LDAP_SERVER"):
        load_config({**valid_env, "LDAP_SERVER": "ldap://dc.example.test"})


def test_a_missing_ca_file_is_reported(valid_env, tmp_path):
    with pytest.raises(ConfigError, match="LDAP_CA_FILE: must be an existing file"):
        load_config({**valid_env, "LDAP_CA_FILE": str(tmp_path / "missing.pem")})


@pytest.mark.parametrize(
    "name", ["OIDC_ISSUER", "OIDC_CLIENT_ID", "OIDC_CLIENT_SECRET", "PUBLIC_BASE_URL"]
)
def test_each_oidc_variable_is_required(valid_env, name):
    del valid_env[name]
    with pytest.raises(ConfigError, match=name):
        load_config(valid_env)


def test_oidc_settings_are_loaded_and_the_secret_is_not_printed(valid_env):
    oidc = load_config({**valid_env, "PUBLIC_BASE_URL": "https://portal.example.test/"}).oidc
    assert oidc.issuer == "https://idp.example.test/application/o/portal/"
    assert oidc.redirect_uri == "https://portal.example.test/auth/callback"
    assert "client-secret" not in repr(oidc)


@pytest.mark.parametrize(
    ("name", "value"),
    [
        ("OIDC_ISSUER", "http://idp.example.test/"),
        ("PUBLIC_BASE_URL", "http://portal.example.test"),
        ("PUBLIC_BASE_URL", "https://portal.example.test/app"),
        ("PUBLIC_BASE_URL", "portal.example.test"),
    ],
)
def test_oidc_addresses_must_be_https_origins(valid_env, name, value):
    with pytest.raises(ConfigError, match=name):
        load_config({**valid_env, name: value})


def test_a_plain_http_origin_is_allowed_only_in_debug(valid_env):
    env = {**valid_env, "PUBLIC_BASE_URL": "http://localhost:8000"}
    assert load_config({**env, "DEBUG": "true"}).oidc.public_base_url == "http://localhost:8000"


def test_smtp_settings_default_to_starttls_on_587_and_hide_the_password(valid_env):
    smtp = load_config(valid_env).smtp
    assert (smtp.host, smtp.port, smtp.security) == ("mail.example.test", 587, "starttls")
    assert smtp.sender == "Portal <portal@example.test>"
    assert "mail-password" not in repr(smtp)


def test_smtp_ssl_defaults_to_port_465_and_the_port_can_be_set(valid_env):
    assert load_config({**valid_env, "SMTP_SECURITY": "SSL"}).smtp.port == 465
    assert load_config({**valid_env, "SMTP_PORT": "2525"}).smtp.port == 2525


@pytest.mark.parametrize(
    ("name", "value"),
    [
        ("SMTP_HOST", "smtp://mail.example.test"),
        ("SMTP_HOST", "mail.example.test:587"),
        ("SMTP_SECURITY", "plain"),
        ("SMTP_PORT", "abc"),
        ("SMTP_PORT", "0"),
        ("SMTP_PORT", "70000"),
        ("MAIL_FROM", "not-an-address"),
        ("MAIL_FROM", "a@b.test\r\nBcc: x@evil.test"),
        ("MAIL_FROM", "@example.test"),
    ],
)
def test_invalid_smtp_settings_are_refused(valid_env, name, value):
    with pytest.raises(ConfigError, match=name):
        load_config({**valid_env, name: value})


@pytest.mark.parametrize("name", ["SMTP_HOST", "SMTP_USERNAME", "SMTP_PASSWORD", "MAIL_FROM"])
def test_the_mail_settings_are_required(valid_env, name):
    del valid_env[name]
    with pytest.raises(ConfigError, match=name):
        load_config(valid_env)