# #region Test.AuthConfig [C:3] [TYPE Module] [SEMANTICS test,auth,config,pydantic]
# @BRIEF Tests for core/auth/config.py — AuthConfig Pydantic settings.
# @RELATION BINDS_TO -> [AuthConfigModule]

from pathlib import Path
import sys

sys.path.insert(0, str(Path(__file__).parent.parent.parent / "src"))

from unittest.mock import patch
import pytest


# #region test_auth_config [C:2] [TYPE Function]
# @BRIEF Test AuthConfig validation and default values.
class TestAuthConfig:
    def test_requires_secret_key(self):
        from src.core.auth.config import AuthConfig
        with patch.dict("os.environ", {
            "AUTH_SECRET_KEY": "test-secret-key",
            "AUTH_DATABASE_URL": "sqlite:///test.db",
        }, clear=True):
            config = AuthConfig()
            assert config.SECRET_KEY == "test-secret-key"
            assert config.ALGORITHM == "HS256"
            assert config.ACCESS_TOKEN_EXPIRE_MINUTES == 480
            assert config.JWT_AUDIENCE == "ss-tools-api"

    def test_validates_secret_key_empty(self):
        from src.core.auth.config import AuthConfig
        with patch.dict("os.environ", {
            "AUTH_SECRET_KEY": "",
            "AUTH_DATABASE_URL": "sqlite:///test.db",
        }, clear=True):
            with pytest.raises(ValueError, match="AUTH_SECRET_KEY"):
                AuthConfig()

    def test_validates_auth_db_url_empty(self):
        from src.core.auth.config import AuthConfig
        with patch.dict("os.environ", {
            "AUTH_SECRET_KEY": "test-key",
            "AUTH_DATABASE_URL": "",
        }, clear=True):
            with pytest.raises(ValueError, match="AUTH_DATABASE_URL"):
                AuthConfig()

    def test_adfs_settings_defaults(self):
        from src.core.auth.config import AuthConfig
        with patch.dict("os.environ", {
            "AUTH_SECRET_KEY": "test-key",
            "AUTH_DATABASE_URL": "sqlite:///test.db",
        }, clear=True):
            config = AuthConfig()
            assert config.ADFS_CLIENT_ID == ""
            assert config.ADFS_CLIENT_SECRET == ""
            assert config.ADFS_METADATA_URL == ""

    def test_adfs_settings_from_env(self):
        from src.core.auth.config import AuthConfig
        with patch.dict("os.environ", {
            "AUTH_SECRET_KEY": "test-key",
            "AUTH_DATABASE_URL": "sqlite:///test.db",
            "ADFS_CLIENT_ID": "my-client",
            "ADFS_CLIENT_SECRET": "my-secret",
            "ADFS_METADATA_URL": "https://adfs.example.com/metadata",
        }, clear=True):
            config = AuthConfig()
            assert config.ADFS_CLIENT_ID == "my-client"
            assert config.ADFS_CLIENT_SECRET == "my-secret"
            assert config.ADFS_METADATA_URL == "https://adfs.example.com/metadata"

    def test_jwt_settings_defaults(self):
        from src.core.auth.config import AuthConfig
        with patch.dict("os.environ", {
            "AUTH_SECRET_KEY": "test-key",
            "AUTH_DATABASE_URL": "sqlite:///test.db",
        }, clear=True):
            config = AuthConfig()
            assert config.ALGORITHM == "HS256"
            assert config.ACCESS_TOKEN_EXPIRE_MINUTES == 480
            assert config.REFRESH_TOKEN_EXPIRE_DAYS == 7

    def test_jwt_audience_issuer_defaults(self):
        from src.core.auth.config import AuthConfig
        with patch.dict("os.environ", {
            "AUTH_SECRET_KEY": "test-key",
            "AUTH_DATABASE_URL": "sqlite:///test.db",
        }, clear=True):
            config = AuthConfig()
            assert config.JWT_AUDIENCE == "ss-tools-api"
            assert config.JWT_ISSUER == "ss-tools"
# #endregion test_auth_config


# #region test_auth_config_singleton [C:2] [TYPE Function]
# @BRIEF Test auth_config singleton creation.
class TestAuthConfigSingleton:
    def test_auth_config_instance(self):
        # The module-level auth_config is created at import time
        # We need to mock env vars first
        with patch.dict("os.environ", {
            "AUTH_SECRET_KEY": "test-key-singleton",
            "AUTH_DATABASE_URL": "sqlite:///test_singleton.db",
        }, clear=True):
            # Reimport to trigger module-level creation
            import importlib
            from src.core.auth import config
            importlib.reload(config)
            assert config.auth_config is not None
            assert config.auth_config.SECRET_KEY == "test-key-singleton"
# #endregion test_auth_config_singleton
# #endregion Test.AuthConfig
