package cli

import (
	"os"
	"path/filepath"
	"testing"

	"gitea.mynodes.xyz/ilker/llmgw/internal/config"
)

func TestTheAdminTokenIsMadeOnceReadableOnlyByItsOwner(t *testing.T) {
	dir := t.TempDir()
	cfgPath := filepath.Join(dir, "server.yaml")
	p := adminTokenPath(cfgPath, config.Default())
	if p != filepath.Join(dir, "secrets", "admin-token") {
		t.Fatalf("path %s", p)
	}
	tok, err := ensureAdminToken(p)
	if err != nil || len(tok) != 64 {
		t.Fatalf("%q %v", tok, err)
	}
	if st, _ := os.Stat(p); st.Mode().Perm() != 0o600 {
		t.Errorf("mode %v", st.Mode())
	}
	again, _ := ensureAdminToken(p)
	if again != tok {
		t.Error("a second start made a new token")
	}
	t.Setenv("LLMGW_ADMIN_TOKEN", "")
	if got := readAdminToken(p); got != tok {
		t.Errorf("read %q", got)
	}
	t.Setenv("LLMGW_ADMIN_TOKEN", "from-env")
	if got := readAdminToken(p); got != "from-env" {
		t.Errorf("env: %q", got)
	}
}

func TestTheAdminListenerStaysOnLoopbackUnlessToldOtherwise(t *testing.T) {
	cfg := config.Default()
	for addr, ok := range map[string]bool{"127.0.0.1:9090": true, "localhost:9090": true, "[::1]:9090": true,
		"0.0.0.0:9090": false, ":9090": false, "10.0.0.140:9090": false} {
		cfg.AdminListen = addr
		if err := checkAdminListen(cfg); (err == nil) != ok {
			t.Errorf("%s: %v", addr, err)
		}
	}
	cfg.AdminListen, cfg.AdminRemote = "10.0.0.140:9090", true
	if err := checkAdminListen(cfg); err != nil {
		t.Errorf("admin_remote: %v", err)
	}
}