package serviceconfig_test

import (
	"bytes"
	"log/slog"
	"strings"
	"testing"

	"queryorchestration/internal/serviceconfig"

	"github.com/stretchr/testify/require"
)

// TestPrintConfigRecursive tests the PrintConfigRecursive function as a blackbox test.
func TestPrintConfigRecursive(t *testing.T) {
	serviceconfig.ResetConfigInitOnceTestOnly()
	envVars := map[string]string{
		"PGUSER":                "postgres",
		"PGPASSWORD":            "password",
		"PGHOST":                "localhost",
		"PGPORT":                "5432",
		"PGDATABASE":            "query_orchestration",
		"DB_NOSSL":              "true",
		"AWS_ACCESS_KEY_ID":     "key",
		"AWS_SECRET_ACCESS_KEY": "password",
		"AWS_REGION":            "region",
		"COGNITO_USER_POOL_ID":  "poolid",
		"COGNITO_CLIENT_SECRET": "secret",
		"COGNITO_DOMAIN":        "domain",
		"COGNITO_CLIENT_ID":     "clientid",
		"PORT":                  "8080", // Only include vars needed by BaseConfig
	}

	// Set environment variables
	for k, v := range envVars {
		t.Setenv(k, v)
	}

	// Create a buffer to capture log output
	var logBuffer bytes.Buffer

	// Create a test logger that writes to our buffer
	testLogger := slog.New(slog.NewTextHandler(&logBuffer, &slog.HandlerOptions{
		Level: slog.LevelDebug,
	}))

	// Use BaseConfig instead of initializeConfigTestStruct
	cfg := &serviceconfig.BaseConfig{}
	err := serviceconfig.InitializeConfig(cfg)
	require.NoError(t, err)

	// Set logger after initialization
	cfg.Logger = testLogger

	// Call the function we're testing
	cfg.PrintConfig("secret")

	// Get the log output as a string
	logOutput := logBuffer.String()

	// Check that each environment variable value appears in the logs
	// except for sensitive values which should be masked
	for envKey, envValue := range envVars {
		if envKey == "PGPASSWORD" || envKey == "AWS_SECRET_ACCESS_KEY" || envKey == "COGNITO_CLIENT_SECRET" {
			// Password should be masked
			if strings.Contains(logOutput, envValue) {
				t.Errorf("Full password should not appear in logs: %s", logOutput)
			}
			// Should see at least part of the masked value
			if !strings.Contains(logOutput, "...") {
				t.Errorf("Expected masked password in logs, got: %s", logOutput)
			}
		} else if !strings.Contains(logOutput, envValue) {
			t.Errorf("Expected %s in logs, but it was not found. Log output: %s", envValue, logOutput)
		}
	}
}