"""B-15: secrets that would only break at first use must stop the app at startup."""

import pytest

from app.config import MIN_JWT_SECRET_LENGTH, ConfigError, Settings, validate_runtime_secrets


def _settings(**overrides) -> Settings:
    base = {
        "jwt_secret": "x" * MIN_JWT_SECRET_LENGTH,
        "xprv_encryption_key": "a-fernet-key",
    }
    base.update(overrides)
    # _env_file=None so a developer's real .env can't make this test pass or fail.
    return Settings(_env_file=None, **base)


def test_valid_secrets_pass():
    validate_runtime_secrets(_settings())


def test_empty_jwt_secret_is_refused():
    """An empty JWT_SECRET makes PyJWT raise InvalidKeyError on every single login —
    a 500 with no hint about the real cause, on a container that started up healthy."""
    with pytest.raises(ConfigError, match="JWT_SECRET"):
        validate_runtime_secrets(_settings(jwt_secret=""))


def test_short_jwt_secret_is_refused():
    with pytest.raises(ConfigError, match="JWT_SECRET"):
        validate_runtime_secrets(_settings(jwt_secret="x" * (MIN_JWT_SECRET_LENGTH - 1)))


def test_empty_xprv_encryption_key_is_refused():
    """Without it Fernet fails on the first key derivation — i.e. the first time
    anyone registers or a transaction needs signing."""
    with pytest.raises(ConfigError, match="XPRV_ENCRYPTION_KEY"):
        validate_runtime_secrets(_settings(xprv_encryption_key="   "))


def test_all_problems_are_reported_at_once():
    with pytest.raises(ConfigError) as exc_info:
        validate_runtime_secrets(_settings(jwt_secret="", xprv_encryption_key=""))
    message = str(exc_info.value)
    assert "JWT_SECRET" in message and "XPRV_ENCRYPTION_KEY" in message


def test_an_empty_admin_token_is_not_fatal():
    """require_admin already denies every request when it's unset, so the effect is a
    locked admin panel rather than an open one — no reason to refuse to boot."""
    validate_runtime_secrets(_settings(admin_token=""))