package config

import (
	"encoding/json"
	"os"
	"path/filepath"
	"strings"
	"testing"
)

func accountFixture() string {
	var b strings.Builder
	for _, name := range volcAccountNames {
		b.WriteString(name + "=\n")
	}
	return b.String()
}

func TestVolcAccountRejectsInvalidWithoutSecretLeak(t *testing.T) {
	for _, suffix := range []string{"SECRET_SENTINEL=do-not-print", "RTC_APP_KEY=do-not-print", "not-valid do-not-print"} {
		p := filepath.Join(t.TempDir(), "account.env")
		if err := os.WriteFile(p, []byte(accountFixture()+suffix), 0600); err != nil {
			t.Fatal(err)
		}
		_, err := ReadVolcAccountFile(p)
		if err == nil || strings.Contains(err.Error(), "do-not-print") {
			t.Fatal("invalid configuration accepted or secret leaked")
		}
	}
}

func TestVolcAccountLiteralParsingAndAuthoritativeSecrets(t *testing.T) {
	p := filepath.Join(t.TempDir(), "account.env")
	raw := strings.Replace(accountFixture(), "RTC_APP_KEY=\n", "RTC_APP_KEY='literal=$value#secret'\n", 1)
	if err := os.WriteFile(p, []byte("\xef\xbb\xbf# worksheet\r\n"+raw), 0600); err != nil {
		t.Fatal(err)
	}
	values, err := ReadVolcAccountFile(p)
	if err != nil {
		t.Fatal(err)
	}
	t.Setenv("RTC_APP_KEY", "old-secret")
	t.Setenv("RTC_APP_KEY_FILE", filepath.Join(t.TempDir(), "missing-legacy-file"))
	t.Setenv("ARK_API_KEY", "obsolete-ark-secret")
	secrets, err := loadSecretValuesWithAccount(values, "RTC_APP_KEY", "ARK_API_KEY")
	if err != nil {
		t.Fatal(err)
	}
	if secrets["RTC_APP_KEY"] != "literal=$value#secret" || secrets["ARK_API_KEY"] != "" {
		t.Fatal("account file did not supersede obsolete credentials")
	}
}

func TestVolcAccountTemplateCredentialsAndPrompts(t *testing.T) {
	c := Config{volcAccount: map[string]string{"S2S_APP_ID": "new-app", "S2S_ACCESS_TOKEN": "new-token", "S2S_MODEL": "O", "S2S_SPEAKER": "new-speaker"}}
	raw := []byte(`{"schema_version":"voice-chat-template-bundle-v1","templates":{"s2s_hybrid":{"Config":{"S2SConfig":{"Provider":"volcano","ProviderParams":{"app":{"appid":"old-app","token":"old-token"},"dialog":{"system_role":"keep this prompt","extra":{"model":"old-model"}},"tts":{"speaker":"old-speaker"}}}}}}}`)
	updated, err := c.ApplyVolcVoiceTemplate(raw)
	if err != nil {
		t.Fatal(err)
	}
	if strings.Contains(string(updated), "old-") || !strings.Contains(string(updated), "keep this prompt") {
		t.Fatal("old credentials retained or prompt lost")
	}
	var root map[string]any
	if json.Unmarshal(updated, &root) != nil {
		t.Fatal("invalid updated JSON")
	}
	conf := root["templates"].(map[string]any)["s2s_hybrid"].(map[string]any)["Config"].(map[string]any)
	pp := conf["S2SConfig"].(map[string]any)["ProviderParams"].(map[string]any)
	if pp["app"].(map[string]any)["token"] != "new-token" || pp["dialog"].(map[string]any)["extra"].(map[string]any)["model"] != "O" {
		t.Fatal("account voice parameters not applied")
	}
	if _, err := c.ApplyVolcVoiceTemplate([]byte(`{"Config":{}}`)); err == nil {
		t.Fatal("missing S2S accepted")
	}
}