package freeradius

import (
	"context"
	"os"
	"strings"
	"testing"
	"time"

	"git.netcell-it.de/projekte/edgeguard-native/internal/database"
	radiussvc "git.netcell-it.de/projekte/edgeguard-native/internal/services/radius"
	"git.netcell-it.de/projekte/edgeguard-native/internal/services/secrets"
)

// Guarded integration test: set EG_FWTEST_DSN (sonst skip).
func TestRender_ClientsAndUsers(t *testing.T) {
	dsn := os.Getenv("EG_FWTEST_DSN")
	if dsn == "" {
		t.Skip("set EG_FWTEST_DSN to run the freeradius renderer test")
	}
	ctx := context.Background()
	var mErr error
	for i := 0; i < 3; i++ {
		if mErr = database.Migrate(ctx, dsn); mErr == nil {
			break
		}
		time.Sleep(700 * time.Millisecond)
	}
	if mErr != nil {
		t.Fatalf("migrate: %v", mErr)
	}
	pool, err := database.Open(ctx, dsn)
	if err != nil {
		t.Fatalf("open: %v", err)
	}
	defer pool.Close()

	for _, q := range []string{`DELETE FROM radius_clients`, `DELETE FROM radius_users`} {
		if _, err := pool.Exec(ctx, q); err != nil {
			t.Fatalf("clean: %v", err)
		}
	}

	box := secrets.New(t.TempDir() + "/master_key")
	repo := radiussvc.New(pool, box)
	if _, err := repo.CreateClient(ctx, "testnas", "10.0.0.0/24", `s3c"ret\x`, true, "lab"); err != nil {
		t.Fatalf("create client: %v", err)
	}
	if _, err := repo.CreateUser(ctx, "alice", "alicepw", true); err != nil {
		t.Fatalf("create user: %v", err)
	}

	g := New(pool, box)

	clients, err := g.buildClients(ctx, false)
	if err != nil {
		t.Fatalf("buildClients: %v", err)
	}
	for _, want := range []string{
		"client testnas {",
		"ipaddr = 10.0.0.0/24",
		`secret = "s3c\"ret\\x"`, // " und \ escaped → Secret-Roundtrip + Escaping
		"shortname = testnas",
	} {
		if !strings.Contains(clients, want) {
			t.Errorf("clients.conf missing %q\n----\n%s", want, clients)
		}
	}

	authorize, err := g.buildAuthorize(ctx, false)
	if err != nil {
		t.Fatalf("buildAuthorize: %v", err)
	}
	if !strings.Contains(authorize, `"alice" Cleartext-Password := "alicepw"`) {
		t.Errorf("authorize missing alice entry\n----\n%s", authorize)
	}

	// Maskierte Preview enthält keine echten Secrets.
	masked, _ := g.buildClients(ctx, true)
	if strings.Contains(masked, "s3c") {
		t.Errorf("masked preview leaked secret:\n%s", masked)
	}
}