anchorage/internal/pkg/config/config_test.go

package config_test

import (
	"os"
	"path/filepath"
	"testing"
	"time"

	"anchorage/internal/pkg/config"
)

func TestLoadAllowMissingAppliesDefaults(t *testing.T) {
	cfg, err := config.Load(config.LoadOptions{AllowMissing: true})
	if err != nil {
		t.Fatalf("Load: %v", err)
	}

	if cfg.Server.Port != 8080 {
		t.Errorf("Server.Port = %d, want 8080", cfg.Server.Port)
	}
	if cfg.Cluster.MinReplicas != 1 {
		t.Errorf("Cluster.MinReplicas = %d, want 1", cfg.Cluster.MinReplicas)
	}
	if cfg.Cluster.HeartbeatInterval != 5*time.Second {
		t.Errorf("Cluster.HeartbeatInterval = %s, want 5s", cfg.Cluster.HeartbeatInterval)
	}
	if cfg.Cluster.DrainGracePeriod != 2*time.Minute {
		t.Errorf("Cluster.DrainGracePeriod = %s, want 2m", cfg.Cluster.DrainGracePeriod)
	}
	if cfg.Cluster.Maintenance.MaxDuration != time.Hour {
		t.Errorf("Cluster.Maintenance.MaxDuration = %s, want 1h", cfg.Cluster.Maintenance.MaxDuration)
	}
	if cfg.Logging.Level != "info" {
		t.Errorf("Logging.Level = %q, want info", cfg.Logging.Level)
	}
	if cfg.Auth.APIToken.DefaultTTL != 24*time.Hour {
		t.Errorf("Auth.APIToken.DefaultTTL = %s, want 24h", cfg.Auth.APIToken.DefaultTTL)
	}
	// 1 year + 30-day grace = 395 days = 9480h. Long-lived IPFS client
	// tokens (minted via `anchorage admin mint-token`) use this as their
	// ceiling so CI / service identities can run for a year before rotation.
	if cfg.Auth.APIToken.MaxTTL != 9480*time.Hour {
		t.Errorf("Auth.APIToken.MaxTTL = %s, want 9480h (1y + 30d grace)", cfg.Auth.APIToken.MaxTTL)
	}
}

func TestLoadReadsYAMLFile(t *testing.T) {
	dir := t.TempDir()
	path := filepath.Join(dir, "anchorage.yaml")
	yaml := `
server:
  port: 9090
  readTimeout: 20s
cluster:
  minReplicas: 3
  heartbeatInterval: 2s
  downAfter: 15s
  drainGracePeriod: 30s
  maintenance:
    maxDuration: 45m
ipfs:
  rpc: http://kubo.local:5001
node:
  id: node-alpha
auth:
  apiToken:
    defaultTTL: 12h
    maxTTL: 168h
logging:
  level: debug
  format: json
`
	if err := os.WriteFile(path, []byte(yaml), 0o600); err != nil {
		t.Fatalf("write yaml: %v", err)
	}

	cfg, err := config.Load(config.LoadOptions{Path: path})
	if err != nil {
		t.Fatalf("Load: %v", err)
	}

	if cfg.Server.Port != 9090 {
		t.Errorf("Server.Port = %d, want 9090", cfg.Server.Port)
	}
	if cfg.Server.ReadTimeout != 20*time.Second {
		t.Errorf("Server.ReadTimeout = %s, want 20s", cfg.Server.ReadTimeout)
	}
	if cfg.Cluster.MinReplicas != 3 {
		t.Errorf("Cluster.MinReplicas = %d, want 3", cfg.Cluster.MinReplicas)
	}
	if cfg.Cluster.Maintenance.MaxDuration != 45*time.Minute {
		t.Errorf("Cluster.Maintenance.MaxDuration = %s, want 45m", cfg.Cluster.Maintenance.MaxDuration)
	}
	if cfg.Node.ID != "node-alpha" {
		t.Errorf("Node.ID = %q, want node-alpha", cfg.Node.ID)
	}
	if cfg.Logging.Format != "json" {
		t.Errorf("Logging.Format = %q, want json", cfg.Logging.Format)
	}
}

func TestEnvOverridesYAML(t *testing.T) {
	dir := t.TempDir()
	path := filepath.Join(dir, "anchorage.yaml")
	yaml := `
server:
  port: 9090
node:
  id: node-from-yaml
auth:
  apiToken:
    defaultTTL: 12h
    maxTTL: 24h
ipfs:
  rpc: http://localhost:5001
cluster:
  minReplicas: 1
  heartbeatInterval: 5s
  downAfter: 30s
  drainGracePeriod: 2m
`
	if err := os.WriteFile(path, []byte(yaml), 0o600); err != nil {
		t.Fatalf("write yaml: %v", err)
	}

	t.Setenv("ANCHORAGE_SERVER_PORT", "12345")
	t.Setenv("ANCHORAGE_NODE_ID", "node-from-env")

	cfg, err := config.Load(config.LoadOptions{Path: path})
	if err != nil {
		t.Fatalf("Load: %v", err)
	}

	if cfg.Server.Port != 12345 {
		t.Errorf("Server.Port = %d, want 12345 (env override)", cfg.Server.Port)
	}
	if cfg.Node.ID != "node-from-env" {
		t.Errorf("Node.ID = %q, want node-from-env (env override)", cfg.Node.ID)
	}
}

func TestValidateRejectsBadReplication(t *testing.T) {
	cfg := validBaseConfig()
	cfg.Cluster.MinReplicas = 0
	if err := cfg.Validate(); err == nil {
		t.Error("expected validation error for minReplicas=0")
	}
}

func TestValidateRejectsDownAfterSmallerThanHeartbeat(t *testing.T) {
	cfg := validBaseConfig()
	cfg.Cluster.HeartbeatInterval = 10 * time.Second
	cfg.Cluster.DownAfter = 5 * time.Second
	if err := cfg.Validate(); err == nil {
		t.Error("expected validation error when downAfter <= heartbeatInterval")
	}
}

func TestValidateRejectsMaxTTLSmallerThanDefault(t *testing.T) {
	cfg := validBaseConfig()
	cfg.Auth.APIToken.DefaultTTL = 48 * time.Hour
	cfg.Auth.APIToken.MaxTTL = 24 * time.Hour
	if err := cfg.Validate(); err == nil {
		t.Error("expected validation error when maxTTL < defaultTTL")
	}
}

func TestRequireServeDSNOptional(t *testing.T) {
	// An empty DSN is valid — it selects the in-memory store for
	// dev / demo. RequireServe should succeed as long as the other
	// mandatory fields are set.
	cfg := validBaseConfig()
	cfg.Postgres.DSN = ""
	if err := cfg.RequireServe(); err != nil {
		t.Errorf("RequireServe with empty DSN should succeed (dev mode): %v", err)
	}
}

func TestRequireServeRejectsMissingAuth(t *testing.T) {
	cfg := validBaseConfig()
	cfg.Auth.Authentik.Issuer = ""
	if err := cfg.RequireServe(); err == nil {
		t.Error("expected RequireServe to demand auth.authentik.issuer")
	}
}

// validBaseConfig returns a minimally valid Config so tests can mutate a
// single field to exercise one validation rule at a time.
func validBaseConfig() *config.Config {
	return &config.Config{
		Server: config.ServerConfig{
			Host:         "0.0.0.0",
			Port:         8080,
			ReadTimeout:  10 * time.Second,
			WriteTimeout: 30 * time.Second,
		},
		Node: config.NodeConfig{ID: "test-node"},
		IPFS: config.IPFSConfig{
			RPC:     "http://localhost:5001",
			Timeout: 2 * time.Minute,
		},
		Cluster: config.ClusterConfig{
			MinReplicas:       1,
			HeartbeatInterval: 5 * time.Second,
			DownAfter:         30 * time.Second,
			RebalanceInterval: time.Minute,
			DrainGracePeriod:  2 * time.Minute,
			Maintenance:       config.MaintenanceConfig{MaxDuration: time.Hour},
		},
		Postgres: config.PostgresConfig{
			DSN:            "postgres://u:p@h/d?sslmode=disable",
			MaxConns:       20,
			AutoMigrate:    true,
			RequeueSweeper: 30 * time.Second,
		},
		NATS: config.NATSConfig{
			DataDir:   "/tmp/anchorage-nats",
			Client:    config.NATSClientConfig{Host: "0.0.0.0", Port: 4222},
			Cluster:   config.NATSClusterConfig{Name: "anchorage", Host: "0.0.0.0", Port: 6222},
			JetStream: config.NATSJetStreamConfig{Replicas: 3},
		},
		Auth: config.AuthConfig{
			Authentik: config.AuthentikConfig{
				Issuer:   "https://auth.example.com/",
				ClientID: "anchorage-web",
				Audience: "anchorage",
			},
			APIToken: config.APITokenConfig{
				SigningKeys: []config.SigningKeyConfig{
					{ID: "test", Path: "/etc/anchorage/jwt.key", Primary: true},
				},
				DefaultTTL: 24 * time.Hour,
				MaxTTL:     720 * time.Hour,
			},
		},
	}
}