//go:build test

package user

// M17 follow-up (ITEM 2): twofa_prod.go is excluded from the test,dev suite
// (`!dev && !test`), so its fail-closed branches were never exercised in CI —
// the old twofa_prod_test.go only runs its assertions in a genuine production
// build and skips under the test tag. The pure decision logic now lives
// build-agnostically in twofa.go (twoFAEnsureIssueAllowedStrict /
// twoFAPepperConfigured / twoFADeliveryChannelConfigured); these tests exercise
// those branches in the STANDARD test,dev run, so a regression in the prod
// fail-closed behaviour is CI-visible even though the prod file itself is only
// compiled in a genuine production build.

import (
	"testing"

	"github.com/stretchr/testify/require"
)

// TestTwoFAEnsureIssueAllowedStrict_FailClosed pins the production-style
// issuance gate that twofa_prod.go's twoFAEnsureIssueAllowed delegates to:
// (a) pepper unset → issuance refused (errTwoFAPepperRequired — an unsalted
// digest in the 1M code space would be offline-brute-forceable);
// (b) delivery channel absent → issuance refused (errTwoFADeliveryUnavailable —
// the 503-style error the handlers surface as StatusServiceUnavailable);
// (c) both configured → issuance succeeds.
func TestTwoFAEnsureIssueAllowedStrict_FailClosed(t *testing.T) {
	t.Run("pepper_unset_refuses_issuance", func(t *testing.T) {
		t.Setenv(twoFAPepperEnv, "")
		t.Setenv(twoFAAllowLogDeliveryEnv, "true")
		require.ErrorIs(t, twoFAEnsureIssueAllowedStrict(), errTwoFAPepperRequired)
	})

	t.Run("delivery_channel_absent_refuses_issuance", func(t *testing.T) {
		t.Setenv(twoFAPepperEnv, "test-pepper")
		t.Setenv(twoFAAllowLogDeliveryEnv, "")
		require.ErrorIs(t, twoFAEnsureIssueAllowedStrict(), errTwoFADeliveryUnavailable)
	})

	t.Run("pepper_and_channel_present_allows_issuance", func(t *testing.T) {
		t.Setenv(twoFAPepperEnv, "test-pepper")
		t.Setenv(twoFAAllowLogDeliveryEnv, "true")
		require.NoError(t, twoFAEnsureIssueAllowedStrict())
	})
}

// TestTwoFADeliveryChannelConfigured pins the pure delivery-channel predicate
// behind the 503 refusal: only the exact value "true" opens the channel.
func TestTwoFADeliveryChannelConfigured(t *testing.T) {
	t.Setenv(twoFAPepperEnv, "test-pepper")
	for _, v := range []string{"", "1", "yes", "on", "True", "TRUE", "false"} {
		t.Setenv(twoFAAllowLogDeliveryEnv, v)
		require.False(t, twoFADeliveryChannelConfigured(), "value %q must NOT open the delivery channel (exact 'true' only)", v)
	}
	t.Setenv(twoFAAllowLogDeliveryEnv, "true")
	require.True(t, twoFADeliveryChannelConfigured())
}

// TestTwoFAPepperConfigured pins the pure pepper predicate behind the
// pepper-required refusal.
func TestTwoFAPepperConfigured(t *testing.T) {
	t.Setenv(twoFAPepperEnv, "")
	require.False(t, twoFAPepperConfigured())
	t.Setenv(twoFAPepperEnv, "test-pepper")
	require.True(t, twoFAPepperConfigured())
}