package deploy

import (
	"os"
	"os/exec"
	"regexp"
	"strings"
	"testing"
)

func TestKubernetesDevelopmentMTLSOverlayRendersCertificateDerivedIdentities(t *testing.T) {
	kubectl, err := exec.LookPath("kubectl")
	if err != nil {
		t.Skip("kubectl is required to render the Kubernetes development mTLS overlay")
	}
	command := exec.Command(kubectl, "kustomize", "kubernetes/overlays/development-mtls")
	command.Dir = "."
	payload, err := command.CombinedOutput()
	if err != nil {
		t.Fatalf("render development mTLS overlay: %v\n%s", err, payload)
	}
	rendered := string(payload)
	for _, required := range []string{
		"mode: mtls",
		"trustDomain: proxy-pool.local",
		"value: controller:8443",
		"name: PROXY_POOL_AUTO_IDENTITY",
		"value: \"true\"",
		"secretName: proxy-pool-controlplane-server-tls",
		"secretName: proxy-pool-controlplane-gateway-tls",
		"secretName: proxy-pool-controlplane-checker-tls",
		"name: proxy-checker",
		"name: checker-control-plane",
		"minReplicas: 1",
		"maxReplicas: 1",
	} {
		if !strings.Contains(rendered, required) {
			t.Errorf("development mTLS overlay does not render %q", required)
		}
	}
	for _, forbidden := range []string{"name: PROXY_POOL_WORKER_ID", "name: PROXY_POOL_INSTANCE_ID", "name: PROXY_POOL_CHECKER_ID", "name: PROXY_POOL_CHECKER_INSTANCE_ID"} {
		if strings.Contains(rendered, forbidden) {
			t.Errorf("development mTLS overlay still renders manual identity %q", forbidden)
		}
	}
}

func TestKubernetesDevelopmentMTLSOverlayUsesVersionedConfigMap(t *testing.T) {
	payload, err := os.ReadFile("kubernetes/overlays/development-mtls/kustomization.yaml")
	if err != nil {
		t.Fatalf("read development mTLS kustomization: %v", err)
	}
	if strings.Contains(string(payload), "disableNameSuffixHash: true") {
		t.Fatal("development mTLS overlay disables ConfigMap versioning")
	}
	kubectl, err := exec.LookPath("kubectl")
	if err != nil {
		t.Skip("kubectl is required to render the Kubernetes development mTLS overlay")
	}
	command := exec.Command(kubectl, "kustomize", "kubernetes/overlays/development-mtls")
	command.Dir = "."
	renderedPayload, err := command.CombinedOutput()
	if err != nil {
		t.Fatalf("render development mTLS overlay: %v\n%s", err, renderedPayload)
	}
	matched := regexp.MustCompile(`(?m)^  name: (proxy-pool-runtime-config-[a-z0-9]+)$`).FindStringSubmatch(string(renderedPayload))
	if len(matched) != 2 {
		t.Fatalf("rendered overlay has no versioned config map: %s", renderedPayload)
	}
	if occurrences := strings.Count(string(renderedPayload), "name: "+matched[1]); occurrences != 4 {
		t.Fatalf("versioned config map reference count = %d, want config map plus three workload volumes", occurrences)
	}
}