"""Tests for secret-handling config validation."""

from __future__ import annotations

import pytest

from app.config import Settings, _enforce_secret_policy

_SECRET_ENVS = ("POSTGRES_PASSWORD", "MINIO_ACCESS_KEY", "MINIO_SECRET_KEY")


def _clear_secrets(monkeypatch):
    for key in _SECRET_ENVS:
        monkeypatch.delenv(key, raising=False)


def test_dev_allows_empty_secrets(monkeypatch):
    monkeypatch.setenv("APP_ENV", "dev")
    _clear_secrets(monkeypatch)
    settings = _enforce_secret_policy(Settings(_env_file=None))
    assert settings.app_env == "dev"
    assert settings.postgres_password == ""


def test_prod_requires_secrets(monkeypatch):
    monkeypatch.setenv("APP_ENV", "prod")
    _clear_secrets(monkeypatch)
    with pytest.raises(RuntimeError):
        _enforce_secret_policy(Settings(_env_file=None))


def test_prod_ok_when_secrets_present(monkeypatch):
    monkeypatch.setenv("APP_ENV", "prod")
    monkeypatch.setenv("POSTGRES_PASSWORD", "p")
    monkeypatch.setenv("MINIO_ACCESS_KEY", "a")
    monkeypatch.setenv("MINIO_SECRET_KEY", "s")
    settings = _enforce_secret_policy(Settings(_env_file=None))
    assert settings.app_env == "prod"


def test_prod_error_names_keys_but_never_values(monkeypatch):
    monkeypatch.setenv("APP_ENV", "prod")
    monkeypatch.setenv("POSTGRES_PASSWORD", "super-secret-value")
    monkeypatch.delenv("MINIO_ACCESS_KEY", raising=False)
    monkeypatch.delenv("MINIO_SECRET_KEY", raising=False)
    with pytest.raises(RuntimeError) as exc:
        _enforce_secret_policy(Settings(_env_file=None))
    msg = str(exc.value)
    assert "MINIO_ACCESS_KEY" in msg
    assert "MINIO_SECRET_KEY" in msg
    assert "super-secret-value" not in msg