package config

import "testing"

func TestStrictEnvironmentParsing(t *testing.T) {
	t.Setenv("CHECK_CONCURRENCY", "not-a-number")
	if _, err := Load(); err == nil {
		t.Fatal("expected invalid CHECK_CONCURRENCY to fail instead of silently using a default")
	}
}

func TestStrictBooleanParsing(t *testing.T) {
	t.Setenv("CHECK_CONCURRENCY", "8")
	t.Setenv("AUTH_DISABLED", "sometimes")
	if _, err := Load(); err == nil {
		t.Fatal("expected invalid AUTH_DISABLED to fail")
	}
}

func TestHostUserManagementRequiresHostRoot(t *testing.T) {
	t.Setenv("APP_MODE", "agent")
	t.Setenv("AGENT_TOKEN", "123456789012345678901234")
	t.Setenv("ALLOW_HOST_USER_MANAGEMENT", "true")
	t.Setenv("HOST_ROOT", "")
	if _, err := Load(); err == nil {
		t.Fatal("expected host user management without HOST_ROOT to fail")
	}
}

func TestCleanOptionalHostRootPreservesFilesystemRoot(t *testing.T) {
	if got := cleanOptionalPath("/"); got != "/" {
		t.Fatalf("cleanOptionalPath(/) = %q", got)
	}
}

func TestHostPermissionManagementRequiresHostRoot(t *testing.T) {
	t.Setenv("AUTH_DISABLED", "true")
	t.Setenv("APP_SECRET", "01234567890123456789012345678901")
	t.Setenv("ALLOW_HOST_PERMISSION_MANAGEMENT", "true")
	t.Setenv("HOST_ROOT", "")
	if _, err := Load(); err == nil {
		t.Fatal("expected host permission management without HOST_ROOT to fail")
	}
}

func TestHostSecurityRequiresHostRoot(t *testing.T) {
	t.Setenv("AUTH_DISABLED", "true")
	t.Setenv("APP_SECRET", "01234567890123456789012345678901")
	t.Setenv("HOST_SECURITY_ENABLED", "true")
	t.Setenv("HOST_ROOT", "")
	if _, err := Load(); err == nil {
		t.Fatal("expected host security without HOST_ROOT to fail")
	}
}

func TestHostSecurityPackageManagementRequiresChanges(t *testing.T) {
	t.Setenv("AUTH_DISABLED", "true")
	t.Setenv("APP_SECRET", "01234567890123456789012345678901")
	t.Setenv("HOST_ROOT", "/host")
	t.Setenv("HOST_SECURITY_ENABLED", "true")
	t.Setenv("ALLOW_HOST_PACKAGE_MANAGEMENT", "true")
	if _, err := Load(); err == nil {
		t.Fatal("expected package management without security changes opt-in to fail")
	}
}