"""生产配置校验：公网暴露前拦住弱密钥与错误配置。"""
from app.config import Settings

_STRONG = "x" * 40
_FERNET = "8ZQvW0nGx1Kc3pYtRj7Lm9BdEfHsUaNqZvXcTgWyPkI="


def _settings(**overrides) -> Settings:
    base = {
        "debug": False,
        "jwt_secret": _STRONG,
        "fernet_key": _FERNET,
        "cors_origins": "https://example.com",
    }
    return Settings(**{**base, **overrides})


def test_valid_production_config_passes():
    assert _settings().check_production_secrets() == []


def test_default_jwt_secret_rejected():
    problems = _settings(jwt_secret="dev-only-change-me").check_production_secrets()
    assert any("默认值" in p for p in problems)


def test_short_jwt_secret_rejected():
    """HS256 密钥短于 32 字节会削弱签名强度。"""
    problems = _settings(jwt_secret="tooshort").check_production_secrets()
    assert any("32 字节" in p for p in problems)


def test_missing_fernet_key_rejected():
    problems = _settings(fernet_key="").check_production_secrets()
    assert any("FERNET_KEY" in p for p in problems)


def test_wildcard_cors_rejected():
    problems = _settings(cors_origins="*").check_production_secrets()
    assert any("CORS" in p for p in problems)


def test_debug_mode_skips_checks():
    """本地开发不该被这些检查挡住。"""
    s = _settings(debug=True, jwt_secret="dev-only-change-me", fernet_key="")
    assert s.check_production_secrets() == []