from pathlib import Path

from scripts.validate_release_env import parse_env_file, validate


def test_validate_release_env_accepts_strict_production(tmp_path: Path):
    env_file = tmp_path / ".env.production"
    env_file.write_text(
        "\n".join(
            [
                "APP_ENV=production",
                "DATABASE_URL=postgresql+psycopg://user:pass@db:5432/app",
                "JWT_SECRET_KEY=abcdefghijklmnopqrstuvwxyz123456",
                "REDIS_URL=redis://redis:6379/0",
                "ENABLE_EMAIL_DELIVERY=true",
                "ENABLE_REDIS_SESSIONS=true",
                "SMTP_HOST=smtp.example.internal",
                "SMTP_PORT=587",
                "SMTP_USER=mailer",
                "SMTP_PASSWORD=strong-password",
                "SMTP_FROM_EMAIL=noreply@xiaoxia.local",
                "SMTP_FROM_NAME=Xiaoxia",
                "OSS_ENDPOINT=oss-cn-hangzhou.aliyuncs.com",
                "OSS_ACCESS_KEY_ID=ak-real",
                "OSS_ACCESS_KEY_SECRET=sk-real-secret",
                "OSS_BUCKET_NAME=xiaoxia-prod",
                "GENERATED_FILES_HOST_DIR=/var/lib/xiaoxia-saas-production/generated",
                "DEBUG=false",
                "AUTO_CREATE_SCHEMA=false",
            ]
        ),
        encoding="utf-8",
    )

    assert validate(parse_env_file(env_file), strict_external=True) == []


def test_validate_release_env_allows_disabled_smtp_with_strict_external(tmp_path: Path):
    env_file = tmp_path / ".env.production"
    env_file.write_text(
        "\n".join(
            [
                "APP_ENV=production",
                "DATABASE_URL=postgresql+psycopg://user:pass@db:5432/app",
                "JWT_SECRET_KEY=abcdefghijklmnopqrstuvwxyz123456",
                "REDIS_URL=redis://redis:6379/0",
                "ENABLE_EMAIL_DELIVERY=false",
                "ENABLE_REDIS_SESSIONS=true",
                "OSS_ENDPOINT=oss-cn-hangzhou.aliyuncs.com",
                "OSS_ACCESS_KEY_ID=ak-real",
                "OSS_ACCESS_KEY_SECRET=sk-real-secret",
                "OSS_BUCKET_NAME=xiaoxia-prod",
                "GENERATED_FILES_HOST_DIR=/var/lib/xiaoxia-saas-production/generated",
                "DEBUG=false",
                "AUTO_CREATE_SCHEMA=false",
            ]
        ),
        encoding="utf-8",
    )

    assert validate(parse_env_file(env_file), strict_external=True) == []


def test_validate_release_env_rejects_placeholders_and_staging_paths(tmp_path: Path):
    env_file = tmp_path / ".env.production"
    env_file.write_text(
        "\n".join(
            [
                "APP_ENV=production",
                "DATABASE_URL=postgresql+psycopg://user:pass@db:5432/app",
                "JWT_SECRET_KEY=your-super-secret-key-change-this-in-production-min-32-chars",
                "REDIS_URL=redis://redis:6379/0",
                "GENERATED_FILES_HOST_DIR=/var/lib/xiaoxia-saas-staging/generated",
                "DEBUG=true",
                "AUTO_CREATE_SCHEMA=true",
            ]
        ),
        encoding="utf-8",
    )

    errors = validate(parse_env_file(env_file), strict_external=True)

    assert "placeholder value remains in JWT_SECRET_KEY" in errors
    assert "GENERATED_FILES_HOST_DIR must not point at staging in production" in errors
    assert "DEBUG must be false in production" in errors
    assert "AUTO_CREATE_SCHEMA must not be enabled outside development" in errors
    assert "missing external-service env: OSS_ACCESS_KEY_ID" in errors