namespace ZB.MOM.WW.Secrets.Replicator.Grpc.Tests;

/// <summary>
/// Registration-time validation for the hub server. A misconfigured hub must fail at startup with
/// a message naming the exact configuration key, not serve unauthenticated at runtime.
/// </summary>
public sealed class SecretsGrpcHubServerOptionsTests
{
    [Theory]
    [InlineData("")]
    [InlineData("   ")]
    [InlineData("\t\n")]
    public void Validate_throws_when_the_bearer_token_is_unset(string token)
    {
        var options = new SecretsGrpcHubServerOptions { BearerToken = token };

        InvalidOperationException error =
            Assert.Throws<InvalidOperationException>(() => options.Validate());

        Assert.Contains("Secrets:GrpcHub:BearerToken", error.Message, StringComparison.Ordinal);
    }

    [Fact]
    public void Validate_names_the_section_path_the_hub_was_registered_under()
    {
        var options = new SecretsGrpcHubServerOptions { BearerToken = string.Empty };
        options.SectionPath = "Central:Secrets:Hub";

        InvalidOperationException error =
            Assert.Throws<InvalidOperationException>(() => options.Validate());

        Assert.Contains("Central:Secrets:Hub:BearerToken", error.Message, StringComparison.Ordinal);
    }

    [Fact]
    public void Validate_accepts_a_configured_token()
    {
        var options = new SecretsGrpcHubServerOptions { BearerToken = "a-configured-hub-token" };

        options.Validate();
    }

    [Fact]
    public void Validate_never_echoes_the_configured_token()
    {
        // A token that is present but only whitespace-padded is still a real credential; the
        // failure message must never carry it.
        const string token = "  ";
        var options = new SecretsGrpcHubServerOptions { BearerToken = token };

        InvalidOperationException error =
            Assert.Throws<InvalidOperationException>(() => options.Validate());

        Assert.DoesNotContain($"'{token}'", error.Message, StringComparison.Ordinal);
        Assert.DoesNotContain("was ", error.Message, StringComparison.Ordinal);
    }

    [Fact]
    public void Bearer_token_defaults_to_empty_so_an_unconfigured_hub_cannot_serve()
    {
        var options = new SecretsGrpcHubServerOptions();

        Assert.Equal(string.Empty, options.BearerToken);
        Assert.Throws<InvalidOperationException>(() => options.Validate());
    }

    [Fact]
    public void Section_path_defaults_to_the_documented_convention()
    {
        var options = new SecretsGrpcHubServerOptions();

        Assert.Equal("Secrets:GrpcHub", options.SectionPath);
    }
}