import { parseEnvironment } from '../src/config/environment';

describe('identity environment', () => {
  const base = { DATABASE_URL: 'postgresql://localhost/mani' };
  const smtp = {
    SMTP_HOST: 'smtp.example.com',
    SMTP_USER: 'user',
    SMTP_PASSWORD: 'secret',
    SMTP_FROM: 'support@example.com',
    RECOVERY_URL: 'https://shop.example.com/reset',
  };
  it('validates complete SMTP and lifetime configuration', () => {
    expect(
      parseEnvironment({ ...base, ...smtp, SESSION_TTL_MINUTES: '60' }),
    ).toMatchObject({ SESSION_TTL_MINUTES: 60, SMTP_PORT: 587 });
  });
  it('rejects partially configured SMTP without exposing secrets', () => {
    expect(() =>
      parseEnvironment({ ...base, SMTP_PASSWORD: 'sensitive' }),
    ).toThrow('SMTP_HOST');
    try {
      parseEnvironment({ ...base, SMTP_PASSWORD: 'sensitive' });
    } catch (error) {
      expect(String(error)).not.toContain('sensitive');
    }
  });
  it.each([
    'http://shop.example.com/reset',
    'https://shop.example.com/reset?token=x',
    'https://user:pass@shop.example.com/reset',
    'https://shop.example.com/reset#token',
    'not-url',
  ])('rejects unsafe recovery URLs %s', (url) => {
    expect(() =>
      parseEnvironment({ ...base, ...smtp, RECOVERY_URL: url }),
    ).toThrow('RECOVERY_URL');
  });
  it.each([{ SESSION_TTL_MINUTES: '0' }, { RECOVERY_TTL_MINUTES: '61' }])(
    'bounds expiry settings %j',
    (values) => {
      expect(() => parseEnvironment({ ...base, ...values })).toThrow(
        'Invalid environment',
      );
    },
  );
});