package httpapi

import (
	"strings"
	"testing"

	"github.com/easyai/easyai-ai-gateway/apps/api/internal/store"
)

func TestValidateObjectStorageChannelAcceptsS3CredentialAliases(t *testing.T) {
	accessKey := "access"
	secretKey := "secret"
	input := store.FileStorageChannelInput{
		ChannelKey: "s3-primary", Name: "S3 primary", Provider: "s3", Status: "enabled",
		AccessKey: &accessKey, SecretKey: &secretKey,
		Config: map[string]any{
			"endpoint": "https://s3.example.com", "region": "us-east-1", "bucket": "media",
		},
	}
	if message := validateFileStorageChannelInput(input, nil); message != "" {
		t.Fatalf("valid S3 channel rejected: %s", message)
	}
}

func TestValidateObjectStorageChannelRejectsCredentialsInConfig(t *testing.T) {
	accessKeyID := "access"
	accessKeySecret := "secret"
	input := store.FileStorageChannelInput{
		ChannelKey: "oss-primary", Name: "OSS primary", Provider: "aliyun_oss", Status: "enabled",
		AccessKeyID: &accessKeyID, AccessKeySecret: &accessKeySecret,
		Config: map[string]any{
			"endpoint": "https://oss-cn-hangzhou.aliyuncs.com", "region": "cn-hangzhou", "bucket": "media",
			"nested": map[string]any{"session_token": "must-not-be-public"},
		},
	}
	message := validateFileStorageChannelInput(input, nil)
	if !strings.Contains(message, "write-only credential fields") {
		t.Fatalf("credential-bearing config was accepted: %q", message)
	}
}

func TestValidateObjectStorageChannelRejectsCredentialedEndpoint(t *testing.T) {
	accessKeyID := "access"
	accessKeySecret := "secret"
	input := store.FileStorageChannelInput{
		ChannelKey: "s3-primary", Name: "S3 primary", Provider: "s3", Status: "enabled",
		AccessKeyID: &accessKeyID, AccessKeySecret: &accessKeySecret,
		Config: map[string]any{
			"endpoint": "https://user:password@s3.example.com", "region": "us-east-1", "bucket": "media",
		},
	}
	if message := validateFileStorageChannelInput(input, nil); !strings.Contains(message, "without embedded credentials") {
		t.Fatalf("credentialed endpoint was accepted: %q", message)
	}
}