package opsconfig

import (
	"errors"
	"testing"
)

func TestValidatePayloadRoutingAndSensitiveFields(t *testing.T) {
	valid := map[string]any{"default_engine_mode": "s2s_hybrid", "routes": []any{map[string]any{"goal": "open_conversation", "engine_mode": "s2s_hybrid"}}}
	result, err := validatePayload("ROUTING", valid, map[string]string{})
	if err != nil || result["valid"] != true {
		t.Fatalf("valid routing config rejected: result=%v err=%v", result, err)
	}
	for name, payload := range map[string]map[string]any{
		"unsupported engine": {"default_engine_mode": "silent-fallback", "routes": []any{}},
		"embedded secret":    {"default_engine_mode": "s2s_hybrid", "routes": []any{}, "api_secret": "plaintext"},
		"nested token":       {"default_engine_mode": "s2s_hybrid", "routes": []any{map[string]any{"access_token": "plaintext"}}},
	} {
		t.Run(name, func(t *testing.T) {
			if _, err := validatePayload("ROUTING", payload, map[string]string{}); !errors.Is(err, ErrInvalid) {
				t.Fatalf("error = %v, want ErrInvalid", err)
			}
		})
	}
}

func TestValidatePayloadRequiresControlledCredentialReferences(t *testing.T) {
	payload := map[string]any{"provider": "volcengine", "model_id": "model://approved/default"}
	if _, err := validatePayload("MODEL", payload, map[string]string{}); !errors.Is(err, ErrInvalid) {
		t.Fatalf("missing credential reference error = %v", err)
	}
	if _, err := validatePayload("MODEL", payload, map[string]string{"credential_ref": "kms://voice-platform/provider/prod"}); err != nil {
		t.Fatalf("controlled credential reference rejected: %v", err)
	}
	if _, err := validatePayload("MODEL", payload, map[string]string{"credential_ref": "plain text secret"}); !errors.Is(err, ErrInvalid) {
		t.Fatalf("invalid credential reference error = %v", err)
	}
}

func TestValidateAgentBundleRequiresVersionUUIDs(t *testing.T) {
	payload := map[string]any{
		"persona_version_id": "10000000-0000-0000-0000-000000000001",
		"voice_version_id":   "10000000-0000-0000-0000-000000000002",
		"model_version_id":   "10000000-0000-0000-0000-000000000003",
		"routing_version_id": "10000000-0000-0000-0000-000000000004",
	}
	if _, err := validatePayload("AGENT_BUNDLE", payload, map[string]string{}); err != nil {
		t.Fatalf("valid component UUIDs rejected: %v", err)
	}
	payload["model_version_id"] = "not-a-version-id"
	if _, err := validatePayload("AGENT_BUNDLE", payload, map[string]string{}); !errors.Is(err, ErrInvalid) {
		t.Fatalf("invalid component UUID error = %v", err)
	}
}

func TestValidateRolloutScopeAndImpactLimits(t *testing.T) {
	validID := "10000000-0000-0000-0000-000000000401"
	for name, input := range map[string]RolloutInput{
		"tenant":       {ScopeType: "TENANT", RolloutPercent: 1, MaxConcurrentCalls: 1},
		"subject":      {ScopeType: "SUBJECT", ScopeID: validID, RolloutPercent: 100, MaxConcurrentCalls: 25},
		"device group": {ScopeType: "DEVICE_GROUP", ScopeID: validID, RolloutPercent: 15, MaxConcurrentCalls: 100000},
	} {
		t.Run(name, func(t *testing.T) {
			if err := validateRollout(input); err != nil {
				t.Fatalf("valid rollout rejected: %v", err)
			}
		})
	}
	for name, input := range map[string]RolloutInput{
		"tenant with id":         {ScopeType: "TENANT", ScopeID: validID, RolloutPercent: 100, MaxConcurrentCalls: 1},
		"subject partial":        {ScopeType: "SUBJECT", ScopeID: validID, RolloutPercent: 50, MaxConcurrentCalls: 1},
		"group missing id":       {ScopeType: "DEVICE_GROUP", RolloutPercent: 50, MaxConcurrentCalls: 1},
		"zero percent":           {ScopeType: "TENANT", RolloutPercent: 0, MaxConcurrentCalls: 1},
		"excess concurrency":     {ScopeType: "TENANT", RolloutPercent: 100, MaxConcurrentCalls: 100001},
		"unsupported scope type": {ScopeType: "DEVICE", ScopeID: validID, RolloutPercent: 100, MaxConcurrentCalls: 1},
	} {
		t.Run(name, func(t *testing.T) {
			if err := validateRollout(input); !errors.Is(err, ErrInvalid) {
				t.Fatalf("error = %v, want ErrInvalid", err)
			}
		})
	}
}