import assert from "node:assert/strict";
import { generateKeyPairSync } from "node:crypto";
import { mkdtemp, rm, writeFile } from "node:fs/promises";
import { tmpdir } from "node:os";
import { join } from "node:path";
import { readConfig } from "../src/config.mjs";

const base = {
  EXTERNAL_DATA_PLANE_DATABASE_URL: "postgresql://user:pass@example.invalid/data_plane",
  NODEDC_INTERNAL_ACCESS_TOKEN: "legacy-internal-token",
};

const directory = await mkdtemp(join(tmpdir(), "nodedc-edp-config-"));
const secretPath = join(directory, "provisioner-token");
const publicKeyPath = join(directory, "engine-public-key.pem");
const secret = "provisioner_secret_is_separate_from_legacy_internal_token_123456";
try {
  await writeFile(secretPath, `${secret}\n`, { encoding: "utf8", mode: 0o600 });
  const { publicKey } = generateKeyPairSync("ed25519");
  await writeFile(publicKeyPath, publicKey.export({ type: "spki", format: "pem" }), { mode: 0o600 });
  const config = readConfig({
    ...base,
    EXTERNAL_DATA_PLANE_PROVISIONING_ENABLED: "true",
    EXTERNAL_DATA_PLANE_PROVISIONER_TOKEN_FILE: secretPath,
    EXTERNAL_DATA_PLANE_MAX_FUTURE_SKEW_SECONDS: "120",
    EXTERNAL_DATA_PLANE_RETENTION_SWEEP_MS: "60000",
  });
  assert.equal(config.provisionerAccessToken, secret);
  assert.equal(config.provisionerApiEnabled, true);
  assert.equal(config.managedProvisionerApiEnabled, false);
  assert.equal(config.maxFutureSkewSeconds, 120);
  assert.equal(config.retentionSweepMs, 60000);
  assert.equal(config.maxPatchBytes, 262144);
  assert.equal(config.receiptRetentionMs, 604800000);
  assert.equal(config.legacyIntakeEnabled, false);
  assert.equal(readConfig({ ...base, EXTERNAL_DATA_PLANE_LEGACY_INTAKE_ENABLED: "true" }).legacyIntakeEnabled, true);
  assert.throws(() => readConfig({
    ...base,
    EXTERNAL_DATA_PLANE_PROVISIONING_ENABLED: "true",
    EXTERNAL_DATA_PLANE_PROVISIONER_TOKEN_FILE: secretPath,
    NODEDC_INTERNAL_ACCESS_TOKEN: secret,
  }), /provisioner_token_must_differ_from_internal_token/);
  assert.throws(() => readConfig({
    ...base,
    EXTERNAL_DATA_PLANE_PROVISIONING_ENABLED: "true",
    EXTERNAL_DATA_PLANE_PROVISIONER_TOKEN_FILE: join(directory, "missing"),
  }), /external_data_plane_provisioner_token_file_unreadable/);
  const managedConfig = readConfig({
    ...base,
    EXTERNAL_DATA_PLANE_PROVISIONING_ENABLED: "false",
    EXTERNAL_DATA_PLANE_MANAGED_PROVISIONING_ENABLED: "true",
    EXTERNAL_DATA_PLANE_PROVISIONER_TOKEN_FILE: join(directory, "missing-token-is-ignored"),
    EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_PUBLIC_KEY_FILE: publicKeyPath,
    EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_SERVICE_ID: "nodedc-engine",
    EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_KEY_ID: "engine-edp-managed-provisioner-v1",
    EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_AUDIENCE: "nodedc-external-data-plane.managed-provisioning.v1",
    EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_MAX_SKEW_SECONDS: "45",
    EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_REPLAY_CACHE_MAX_ENTRIES: "500",
  });
  assert.equal(managedConfig.provisionerApiEnabled, false);
  assert.equal(managedConfig.managedProvisionerApiEnabled, true);
  assert.equal(managedConfig.provisionerAccessToken, "");
  assert.equal(managedConfig.managedProvisionerPublicKey.asymmetricKeyType, "ed25519");
  assert.equal(managedConfig.managedProvisionerServiceId, "nodedc-engine");
  assert.equal(managedConfig.managedProvisionerKeyId, "engine-edp-managed-provisioner-v1");
  assert.equal(managedConfig.managedProvisionerAudience, "nodedc-external-data-plane.managed-provisioning.v1");
  assert.equal(managedConfig.managedProvisionerMaxSkewMs, 45_000);
  assert.equal(managedConfig.managedProvisionerReplayCacheMaxEntries, 500);
  assert.throws(() => readConfig({
    ...base,
    EXTERNAL_DATA_PLANE_MANAGED_PROVISIONING_ENABLED: "true",
    EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_PUBLIC_KEY_FILE: join(directory, "missing"),
    EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_SERVICE_ID: "nodedc-engine",
    EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_KEY_ID: "engine-edp-managed-provisioner-v1",
    EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_AUDIENCE: "nodedc-external-data-plane.managed-provisioning.v1",
  }), /external_data_plane_managed_provisioner_public_key_file_unreadable/);
  assert.throws(() => readConfig({
    ...base,
    EXTERNAL_DATA_PLANE_MANAGED_PROVISIONING_ENABLED: "true",
    EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_PUBLIC_KEY_FILE: publicKeyPath,
    EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_SERVICE_ID: "invalid service id",
    EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_KEY_ID: "engine-edp-managed-provisioner-v1",
    EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_AUDIENCE: "nodedc-external-data-plane.managed-provisioning.v1",
  }), /external_data_plane_managed_provisioner_service_id_invalid/);
  assert.equal(readConfig({
    ...base,
    EXTERNAL_DATA_PLANE_PROVISIONING_ENABLED: "false",
    EXTERNAL_DATA_PLANE_MANAGED_PROVISIONING_ENABLED: "false",
    EXTERNAL_DATA_PLANE_PROVISIONER_TOKEN_FILE: join(directory, "missing"),
    EXTERNAL_DATA_PLANE_MANAGED_PROVISIONER_PUBLIC_KEY_FILE: join(directory, "missing"),
  }).provisionerAccessToken, "");
} finally {
  await rm(directory, { recursive: true, force: true });
}

console.log("external-data-plane config: ok");