import { describe, expect, it } from "vitest";
import { assertSecureRuntimeEnv, getRuntimeEnvViolations } from "./runtime-env";

describe("runtime env validation", () => {
  it("allows non-production environments without auth runtime settings", () => {
    expect(getRuntimeEnvViolations({ NODE_ENV: "development" })).toEqual([]);
  });

  it("accepts a valid production auth secret and https url", () => {
    expect(
      getRuntimeEnvViolations({
        NODE_ENV: "production",
        NEXTAUTH_SECRET: "super-long-random-secret",
        NEXTAUTH_URL: "https://capakraken.example.com",
      }),
    ).toEqual([]);
  });

  it("rejects a missing production auth secret", () => {
    expect(
      getRuntimeEnvViolations({
        NODE_ENV: "production",
        NEXTAUTH_URL: "https://capakraken.example.com",
      }),
    ).toContain("AUTH_SECRET or NEXTAUTH_SECRET must be set in production.");
  });

  it("rejects the development placeholder auth secret in production", () => {
    expect(
      getRuntimeEnvViolations({
        NODE_ENV: "production",
        NEXTAUTH_SECRET: "dev-secret-change-in-production",
        NEXTAUTH_URL: "https://capakraken.example.com",
      }),
    ).toContain("AUTH_SECRET or NEXTAUTH_SECRET must not use a known development placeholder in production.");
  });

  it("rejects non-https auth urls in production", () => {
    expect(
      getRuntimeEnvViolations({
        NODE_ENV: "production",
        NEXTAUTH_SECRET: "super-long-random-secret",
        NEXTAUTH_URL: "http://capakraken.example.com",
      }),
    ).toContain("AUTH_URL or NEXTAUTH_URL must use https in production.");
  });

  it("throws with a combined startup error when production env is invalid", () => {
    expect(() =>
      assertSecureRuntimeEnv({
        NODE_ENV: "production",
        NEXTAUTH_SECRET: "dev-secret-change-in-production",
        NEXTAUTH_URL: "not-a-url",
      }),
    ).toThrow(/Invalid production runtime configuration/);
  });
});
