package postgres

import (
	"os"
	"path/filepath"
	"strings"
	"testing"

	config "cloud.campbellwireless.net/git/barkstack/barkfile-parser/v2"
)

func TestPostgresDataMount(t *testing.T) {
	tests := []struct {
		image string
		want  string
	}{
		{"postgres:16", "/var/lib/postgresql/data"},
		{"postgres:17", "/var/lib/postgresql/data"},
		{"postgres:18", "/var/lib/postgresql"},
	}
	for _, test := range tests {
		if got := postgresDataMount(test.image); got != test.want {
			t.Errorf("postgresDataMount(%q) = %q, want %q", test.image, got, test.want)
		}
	}
}

func TestReadSecretUsesPrefixedDockerName(t *testing.T) {
	directory := t.TempDir()
	path := filepath.Join(directory, config.DockerSecretName("application_password"))
	if err := os.WriteFile(path, []byte("correct horse battery staple\n"), 0o600); err != nil {
		t.Fatal(err)
	}
	provisioner := &Provisioner{SecretDirectory: directory}
	password, err := provisioner.readSecret("application_password")
	if err != nil {
		t.Fatal(err)
	}
	if password != "correct horse battery staple" {
		t.Fatalf("password = %q", password)
	}
}

func TestReadSecretRejectsUnsafeReference(t *testing.T) {
	provisioner := &Provisioner{SecretDirectory: t.TempDir()}
	_, err := provisioner.readSecret("../../etc/passwd")
	if err == nil || !strings.Contains(err.Error(), "invalid password secret reference") {
		t.Fatalf("readSecret() error = %v", err)
	}
}

func TestReadSecretRejectsMissingAndEmptySecret(t *testing.T) {
	directory := t.TempDir()
	provisioner := &Provisioner{SecretDirectory: directory}
	if _, err := provisioner.readSecret("missing"); err == nil || !strings.Contains(err.Error(), "barkstack_missing") {
		t.Fatalf("missing secret error = %v", err)
	}
	if err := os.WriteFile(filepath.Join(directory, config.DockerSecretName("empty")), []byte("\n"), 0o600); err != nil {
		t.Fatal(err)
	}
	if _, err := provisioner.readSecret("empty"); err == nil || !strings.Contains(err.Error(), "is empty") {
		t.Fatalf("empty secret error = %v", err)
	}
}