import pytest
from pydantic import SecretStr, ValidationError

from ai_platform.infrastructure.config.settings import Settings

_TEST_DATABASE_URL = "postgresql+asyncpg://test:test@localhost/ai_platform_test"
pytestmark = pytest.mark.usefixtures("isolated_settings")


@pytest.mark.parametrize(
    "base_url",
    ["http://remote.example/v1", "http://localhost:8317/path", "https://user:pass@example.com"],
)
def test_openai_base_url_rejects_unsafe_url(base_url: str):
    with pytest.raises(ValidationError):
        Settings(database_url=_TEST_DATABASE_URL, openai_base_url=base_url)


def test_openai_local_http_allows_no_key_only_in_development():
    settings = Settings(
        database_url=_TEST_DATABASE_URL,
        environment="development",
        openai_base_url="http://127.0.0.1:8317",
    )
    assert settings.openai_api_key is None
    with pytest.raises(ValidationError):
        Settings(
            database_url=_TEST_DATABASE_URL,
            environment="production",
            openai_base_url="http://127.0.0.1:8317",
            openai_api_key=SecretStr("proxy-key"),
        )


def test_openai_production_requires_https_and_key():
    with pytest.raises(ValidationError):
        Settings(
            database_url=_TEST_DATABASE_URL,
            environment="production",
            openai_base_url="https://proxy.example",
        )
    settings = Settings(
        database_url=_TEST_DATABASE_URL,
        environment="production",
        openai_base_url="https://proxy.example",
        openai_api_key=SecretStr("proxy-key"),
    )
    assert settings.openai_base_url == "https://proxy.example"
    assert "proxy-key" not in repr(settings)


def test_openai_rejects_key_without_url_and_header_injection():
    with pytest.raises(ValidationError):
        Settings(database_url=_TEST_DATABASE_URL, openai_api_key=SecretStr("key"))
    with pytest.raises(ValidationError):
        Settings(
            database_url=_TEST_DATABASE_URL,
            environment="development",
            openai_base_url="http://localhost:8317",
            openai_api_key=SecretStr("key\r\nX-Evil: test"),
        )


def test_aihub_base_url_accepts_local_http():
    settings = Settings(
        database_url=_TEST_DATABASE_URL,
        environment="development",
        aihub_base_url="http://localhost:8080",
    )
    assert settings.aihub_base_url == "http://localhost:8080"


@pytest.mark.parametrize(
    "base_url",
    [
        "ftp://localhost:8080",
        "http://user:password@localhost:8080",
        "http://localhost:8080?token=secret",
        "http://aihub:8080",
    ],
)
def test_aihub_base_url_rejects_invalid_or_nonlocal_http(base_url: str):
    with pytest.raises(ValidationError):
        Settings(
            database_url=_TEST_DATABASE_URL,
            environment="development",
            aihub_base_url=base_url,
        )


def test_aihub_base_url_requires_https_outside_development():
    with pytest.raises(ValidationError):
        Settings(
            database_url=_TEST_DATABASE_URL,
            environment="production",
            aihub_base_url="http://localhost:8080",
        )