package deploy

import (
	"os/exec"
	"strings"
	"testing"
)

func TestKubernetesDevelopmentMTLSOverlayRendersCertificateDerivedIdentities(t *testing.T) {
	kubectl, err := exec.LookPath("kubectl")
	if err != nil {
		t.Skip("kubectl is required to render the Kubernetes development mTLS overlay")
	}
	command := exec.Command(kubectl, "kustomize", "kubernetes/overlays/development-mtls")
	command.Dir = "."
	payload, err := command.CombinedOutput()
	if err != nil {
		t.Fatalf("render development mTLS overlay: %v\n%s", err, payload)
	}
	rendered := string(payload)
	for _, required := range []string{
		"mode: mtls",
		"trustDomain: proxy-pool.local",
		"value: controller:8443",
		"name: PROXY_POOL_AUTO_IDENTITY",
		"value: \"true\"",
		"secretName: proxy-pool-controlplane-server-tls",
		"secretName: proxy-pool-controlplane-gateway-tls",
		"secretName: proxy-pool-controlplane-checker-tls",
		"name: proxy-checker",
		"name: checker-control-plane",
		"minReplicas: 1",
		"maxReplicas: 1",
	} {
		if !strings.Contains(rendered, required) {
			t.Errorf("development mTLS overlay does not render %q", required)
		}
	}
	for _, forbidden := range []string{"name: PROXY_POOL_WORKER_ID", "name: PROXY_POOL_INSTANCE_ID", "name: PROXY_POOL_CHECKER_ID", "name: PROXY_POOL_CHECKER_INSTANCE_ID"} {
		if strings.Contains(rendered, forbidden) {
			t.Errorf("development mTLS overlay still renders manual identity %q", forbidden)
		}
	}
}