//go:build test

package user

// M17 follow-up (ITEM 2): twofa_prod.go is excluded from the test,dev suite
// (`!dev && !test`), so its fail-closed branches were never exercised in CI —
// the old twofa_prod_test.go only runs its assertions in a genuine production
// build and skips under the test tag. The pure decision logic now lives
// build-agnostically in twofa.go (twoFAEnsureIssueAllowedStrict /
// twoFAPepperConfigured / twoFADeliveryChannelConfigured); these tests exercise
// those branches in the STANDARD test,dev run, so a regression in the prod
// fail-closed behaviour is CI-visible even though the prod file itself is only
// compiled in a genuine production build.
//
// DELIVERY POSTURE (current): stdout-log delivery of 2FA codes is a
// DEV/TEST-ONLY local feature. Production has no delivery channel of any kind
// (email/SMS unwired, P6; no production opt-in to log delivery), so the strict
// gate refuses issuance unconditionally after the pepper check.

import (
	"testing"

	"github.com/stretchr/testify/require"
)

// TestTwoFAEnsureIssueAllowedStrict_FailClosed pins the production-style
// issuance gate that twofa_prod.go's twoFAEnsureIssueAllowed delegates to:
// (a) pepper unset → issuance refused (errTwoFAPepperRequired — an unsalted
// digest in the 1M code space would be offline-brute-forceable);
// (b) pepper set but no delivery channel → issuance STILL refused
// (errTwoFADeliveryUnavailable — production has no channel until email/SMS
// lands, P6; the 503-style error the handlers surface as
// StatusServiceUnavailable). Issuance can never succeed in a production build
// until a real transport exists.
func TestTwoFAEnsureIssueAllowedStrict_FailClosed(t *testing.T) {
	t.Run("pepper_unset_refuses_issuance", func(t *testing.T) {
		t.Setenv(twoFAPepperEnv, "")
		require.ErrorIs(t, twoFAEnsureIssueAllowedStrict(), errTwoFAPepperRequired)
	})

	t.Run("no_delivery_channel_refuses_issuance", func(t *testing.T) {
		t.Setenv(twoFAPepperEnv, "test-pepper")
		require.ErrorIs(t, twoFAEnsureIssueAllowedStrict(), errTwoFADeliveryUnavailable)
	})
}

// TestTwoFADeliveryChannelConfigured pins the pure delivery-channel predicate:
// production has NO delivery channel — stdout-log delivery is a dev/test-only
// local feature and there is no production opt-in — so it is always false.
func TestTwoFADeliveryChannelConfigured(t *testing.T) {
	t.Setenv(twoFAPepperEnv, "test-pepper")
	require.False(t, twoFADeliveryChannelConfigured())
}

// TestTwoFAPepperConfigured pins the pure pepper predicate behind the
// pepper-required refusal.
func TestTwoFAPepperConfigured(t *testing.T) {
	t.Setenv(twoFAPepperEnv, "")
	require.False(t, twoFAPepperConfigured())
	t.Setenv(twoFAPepperEnv, "test-pepper")
	require.True(t, twoFAPepperConfigured())
}