process.env.JWT_SECRET = process.env.JWT_SECRET || 'test-secret'
process.env.SECRET_ENC_KEY = process.env.SECRET_ENC_KEY || 'unit-test-enc-key'
process.env.DB_HOST = '127.0.0.1'
process.env.DB_PORT = '59999'

const { test, after } = require('node:test')
const assert = require('node:assert/strict')

const registry = require('../src/auth/providers/registry')
const authProvidersModel = require('../src/model/authProviders/authProviders.model')
const db = require('../src/utils/db')

after(() => db.close())

test('validateConfig: built-in needs client_id + secret', () => {
  assert.equal(registry.validateConfig({ kind: 'google', client_id: 'x', client_secret_enc: 'e' }).valid, true)
  assert.deepEqual(registry.validateConfig({ kind: 'google', client_id: 'x' }).missing, ['client_secret'])
  assert.deepEqual(registry.validateConfig({ kind: 'google' }).missing, ['client_id', 'client_secret'])
})

test('validateConfig: custom OIDC also needs the endpoint URLs', () => {
  const complete = {
    kind: 'oidc', client_id: 'x', client_secret_enc: 'e',
    authorize_url: 'a', token_url: 't', userinfo_url: 'u',
  }
  assert.equal(registry.validateConfig(complete).valid, true)
  const noUrls = { kind: 'oidc', client_id: 'x', client_secret_enc: 'e' }
  assert.deepEqual(registry.validateConfig(noUrls).missing, ['authorize_url', 'token_url', 'userinfo_url'])
})

test('listConfigured always includes both built-ins with health', async () => {
  authProvidersModel.list = async () => [] // no rows yet
  const out = await registry.listConfigured()
  const ids = out.map((p) => p.id)
  assert.deepEqual(ids, ['google', 'discord'])
  assert.equal(out[0].builtin, true)
  assert.equal(out[0].enabled, 0)
  assert.equal(out[0].health.valid, false) // unconfigured
})

test('listEnabledValid returns only enabled+valid, shaped and sorted by priority', async () => {
  authProvidersModel.list = async () => [
    { id: 'discord', kind: 'discord', name: 'Discord', enabled: 1, client_id: 'd', client_secret_enc: 'e', priority: 2 },
    { id: 'google', kind: 'google', name: 'Google', enabled: 1, client_id: 'g', client_secret_enc: 'e', priority: 1 },
    { id: 'brokenidp', kind: 'oidc', name: 'Broken', enabled: 1, client_id: 'x', client_secret_enc: 'e', priority: 0 }, // missing URLs → hidden
    { id: 'authentik', kind: 'oidc', name: 'Authentik', enabled: 0, client_id: 'x', client_secret_enc: 'e', authorize_url: 'a', token_url: 't', userinfo_url: 'u', priority: 3 }, // disabled → hidden
  ]
  const out = await registry.listEnabledValid()
  assert.deepEqual(out.map((p) => p.id), ['google', 'discord']) // sorted by priority, broken/disabled excluded
  assert.deepEqual(out[0], {
    id: 'google', name: 'Google', icon: 'google', loginUrl: '/api/v1/auth/sso/google/start', priority: 1,
  })
})