using System.Security.Cryptography;
using MiaoJiZhang.Api.Services;
using Microsoft.Extensions.Configuration;

namespace MiaoJiZhang.Api.Tests;

public sealed class LlmSecretProtectorTests
{
    [Fact]
    public void Protect_RoundTripsWithoutEmbeddingPlaintext()
    {
        var configuration = new ConfigurationBuilder()
            .AddInMemoryCollection(new Dictionary<string, string?>
            {
                ["Jwt:Secret"] = Convert.ToBase64String(
                    RandomNumberGenerator.GetBytes(48)),
            })
            .Build();
        var protector = new LlmSecretProtector(configuration);

        var encrypted = protector.Protect("sk-test-secret-1234");

        Assert.DoesNotContain("sk-test-secret-1234", encrypted);
        Assert.Equal("sk-test-secret-1234", protector.Unprotect(encrypted));
        Assert.Equal("••••1234", LlmSecretProtector.Mask("sk-test-secret-1234"));
    }

    [Fact]
    public void Protect_RejectsMissingServerSecret()
    {
        var protector = new LlmSecretProtector(new ConfigurationBuilder().Build());

        var exception = Assert.Throws<InvalidOperationException>(
            () => protector.Protect("sk-test"));

        Assert.Contains("JWT 密钥", exception.Message);
    }

    [Fact]
    public void Defaults_UseStableGenerationParameters()
    {
        Assert.Equal("1024", AppConfigDefaults.Values["llm.max_tokens"]);
        Assert.Equal("0.7", AppConfigDefaults.Values["llm.temperature"]);
    }
}