package configgen

import (
	"io"
	"log"
	"path/filepath"
	"strings"
	"testing"

	"gitea.dooplex.hu/admin/felhom-hub/internal/store"
)

// R-975: the tokens are sealed in the database, and the box still receives the REAL tunnel token in its
// generated controller.yaml (the consequence — a sealed string there would be a dead tunnel).
func TestR975_GeneratedConfigCarriesThePlainTunnelToken(t *testing.T) {
	st, err := store.New(filepath.Join(t.TempDir(), "t.db"), log.New(io.Discard, "", 0))
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { st.Close() })
	js := `{"infrastructure":{"cf_tunnel_token":"tunnel-canary-r975","cf_api_token":"cfapi-canary-r975"}}`
	if err := st.SaveCustomerConfig(&store.CustomerConfig{CustomerID: "c1", RetrievalPassword: "p", APIKey: "k1", ConfigJSON: js}); err != nil {
		t.Fatal(err)
	}
	cfg, err := st.GetCustomerConfig("c1")
	if err != nil {
		t.Fatal(err)
	}
	out, err := Generate("hub: {}\n", cfg, nil)
	if err != nil {
		t.Fatal(err)
	}
	if !strings.Contains(out, "cf_tunnel_token: tunnel-canary-r975") || strings.Contains(out, "enc:v1:") {
		t.Fatalf("controller.yaml does not carry the plain tunnel token (or carries a sealed string):\n%s", out)
	}
}