import assert from 'node:assert/strict'
import test from 'node:test'
import {
  assertKeycloakConfiguration,
  assertSupportedAuthMode,
  resolveAuthMode,
  resolveSessionSecret
} from '../authMode'

test('认证模式缺省时统一使用本地登录', () => {
  assert.equal(resolveAuthMode(undefined), 'local')
  assert.equal(resolveAuthMode(''), 'local')
  assert.equal(resolveAuthMode('keycloak'), 'keycloak')
})

test('认证模式拒绝无法识别的部署值', () => {
  assert.throws(() => assertSupportedAuthMode('oauth'), /仅支持 local 或 keycloak/)
})

test('生产环境拒绝缺失或默认 Session 密钥', () => {
  assert.throws(() => resolveSessionSecret('', 'production'), /SESSION_SECRET/)
  assert.throws(
    () => resolveSessionSecret('change-me-session-secret', 'production'),
    /SESSION_SECRET/
  )
  assert.equal(resolveSessionSecret('a-real-production-secret', 'production'), 'a-real-production-secret')
  assert.equal(
    resolveSessionSecret(undefined, 'development'),
    'equipment-management-development-secret'
  )
})

test('Keycloak 模式缺少前后端共同必需项时启动失败', () => {
  assert.throws(
    () => assertKeycloakConfiguration({ AUTH_MODE: 'keycloak' }),
    /KEYCLOAK_URL, KEYCLOAK_REALM, KEYCLOAK_CLIENT_ID/
  )
  assert.throws(
    () => assertKeycloakConfiguration({
      AUTH_MODE: 'keycloak',
      KEYCLOAK_URL: 'not-a-url',
      KEYCLOAK_REALM: 'equipment',
      KEYCLOAK_CLIENT_ID: 'equipment-client'
    }),
    /http\/https/
  )
  assert.deepEqual(
    assertKeycloakConfiguration({
      AUTH_MODE: 'keycloak',
      KEYCLOAK_URL: 'https://sso.example.com/',
      KEYCLOAK_REALM: 'equipment',
      KEYCLOAK_CLIENT_ID: 'equipment-client'
    }),
    {
      serverUrl: 'https://sso.example.com',
      realm: 'equipment',
      clientId: 'equipment-client',
      clientSecret: undefined
    }
  )
  assert.equal(assertKeycloakConfiguration({ AUTH_MODE: 'local' }), null)
})