package scripts

import (
	"os"
	"strings"
	"testing"
)

func TestDobotAIDingTalkContainerAssetsProvideSafeShortOperatorCommands(t *testing.T) {
	compose, err := os.ReadFile("../deploy/dobotai-dingtalk/compose.yaml")
	if err != nil {
		t.Fatal(err)
	}
	for _, required := range []string{
		"dobotai-dingtalk:",
		"container_name: dobotai-dingtalk",
		"network_mode: host",
		"env_file:",
		"read_only: true",
		"/var/lib/dobotai/secrets",
	} {
		if !strings.Contains(string(compose), required) {
			t.Errorf("compose missing %q", required)
		}
	}

	configure, err := os.ReadFile("../deploy/dobotai-dingtalk/dobotai-dingtalk-configure")
	if err != nil {
		t.Fatal(err)
	}
	for _, required := range []string{
		"configure_env.py",
		"/etc/dobotai-test/dobotai.env",
		"dobotai-dingtalk-start",
	} {
		if !strings.Contains(string(configure), required) {
			t.Errorf("configure command missing %q", required)
		}
	}

	bind, err := os.ReadFile("../deploy/dobotai-dingtalk/dobotai-dingtalk-bind-admin")
	if err != nil {
		t.Fatal(err)
	}
	for _, required := range []string{
		"docker exec -it dobotai-dingtalk",
		"/usr/local/bin/dobotai bootstrap-admin",
	} {
		if !strings.Contains(string(bind), required) {
			t.Errorf("bind command missing %q", required)
		}
	}
}

func TestDobotAIDingTalkCredentialConfigurationNeverPassesSecretsOnCommandLine(t *testing.T) {
	data, err := os.ReadFile("../deploy/dobotai-dingtalk/configure_env.py")
	if err != nil {
		t.Fatal(err)
	}
	source := string(data)
	for _, required := range []string{"getpass.getpass", "os.replace", "0o600", "DINGTALK_CLIENT_SECRET"} {
		if !strings.Contains(source, required) {
			t.Errorf("credential configurator missing %q", required)
		}
	}
	for _, forbidden := range []string{"subprocess.run([", "-v", "DINGTALK_CLIENT_SECRET="} {
		if strings.Contains(source, forbidden) {
			t.Errorf("credential configurator must not expose secret through process arguments: %q", forbidden)
		}
	}
}