package runner

import (
	"strings"
	"testing"

	"github.com/easyai/easyai-ai-gateway/apps/api/internal/store"
)

func TestCandidateWithEnvironmentCredentialsResolvesNamesAtRuntime(t *testing.T) {
	t.Setenv("TEST_GATEWAY_PROVIDER_SECRET", "secret-value")
	candidate, err := candidateWithEnvironmentCredentials(store.RuntimeModelCandidate{
		Credentials: map[string]any{"safe": "existing"},
		PlatformConfig: map[string]any{"credentialEnv": map[string]any{
			"apiKey": "TEST_GATEWAY_PROVIDER_SECRET",
		}},
	})
	if err != nil {
		t.Fatal(err)
	}
	if candidate.Credentials["apiKey"] != "secret-value" || candidate.Credentials["safe"] != "existing" {
		t.Fatalf("credentials not resolved: %+v", candidate.Credentials)
	}
}

func TestCandidateWithEnvironmentCredentialsDoesNotLeakMissingValue(t *testing.T) {
	candidate := store.RuntimeModelCandidate{PlatformConfig: map[string]any{"credentialEnv": map[string]any{"apiKey": "MISSING_GATEWAY_PROVIDER_SECRET"}}}
	_, err := candidateWithEnvironmentCredentials(candidate)
	if err == nil || strings.Contains(err.Error(), "MISSING_GATEWAY_PROVIDER_SECRET") {
		t.Fatalf("missing credential error should be generic: %v", err)
	}
}