import pytest

from app.config import check_secrets_config
from tests.conftest import TEST_ENCRYPTION_KEY, make_config


def base_config(tmp_path, **overrides):
    values = dict(
        FLASK_ENV="production",
        SECRET_KEY="a-real-secret-key",
        API_KEY="a-real-api-key",
        TIKTOK_CLIENT_SECRET="a-real-client-secret",
        TOKEN_ENCRYPTION_KEY=TEST_ENCRYPTION_KEY,
    )
    values.update(overrides)
    return dict(vars(make_config(tmp_path, **values)))


def test_production_refuses_placeholder_secrets(tmp_path):
    config = base_config(tmp_path, API_KEY="change-me-to-a-strong-random-string")
    with pytest.raises(RuntimeError) as exc:
        check_secrets_config(config)
    assert "API_KEY" in str(exc.value)
    assert "change-me" not in str(exc.value)


def test_production_refuses_missing_encryption_key(tmp_path):
    config = base_config(tmp_path, TOKEN_ENCRYPTION_KEY="")
    with pytest.raises(RuntimeError) as exc:
        check_secrets_config(config)
    assert "TOKEN_ENCRYPTION_KEY" in str(exc.value)


def test_production_accepts_real_secrets(tmp_path):
    check_secrets_config(base_config(tmp_path))


def test_non_production_mints_a_secret_key(tmp_path):
    config = base_config(tmp_path, FLASK_ENV="development", SECRET_KEY="change-me")
    check_secrets_config(config)
    assert config["SECRET_KEY"] not in ("", "change-me")