package v1

import (
	"os"
	"path/filepath"
	"testing"
)

func TestIsValidCertFile_Valid(t *testing.T) {
	tmp := t.TempDir()
	path := filepath.Join(tmp, "test.pem")
	if err := os.WriteFile(path, []byte("--- cert content ---"), 0600); err != nil {
		t.Fatal(err)
	}
	if !isValidCertFile(path) {
		t.Error("expected valid cert file to return true")
	}
}

func TestIsValidCertFile_Empty(t *testing.T) {
	tmp := t.TempDir()
	path := filepath.Join(tmp, "empty.pem")
	if err := os.WriteFile(path, nil, 0600); err != nil {
		t.Fatal(err)
	}
	if isValidCertFile(path) {
		t.Error("expected 0-byte cert file to return false")
	}
}

func TestIsValidCertFile_Missing(t *testing.T) {
	if isValidCertFile("/nonexistent/path.pem") {
		t.Error("expected missing file to return false")
	}
}

func TestHasCertForDomain_DirectMatch(t *testing.T) {
	tmp := t.TempDir()
	certsDir := filepath.Join(tmp, "certs")
	os.MkdirAll(certsDir, 0700)

	// hasCertForDomain checks certbot.HAProxyCertPath which is hardcoded to /etc/haproxy/certs/.
	// We test isValidCertFile directly instead since hasCertForDomain uses absolute paths.
	path := filepath.Join(certsDir, "example.com.pem")
	os.WriteFile(path, []byte("cert data"), 0600)
	if !isValidCertFile(path) {
		t.Error("expected direct cert match to be valid")
	}
}

func TestHasCertForDomain_ZeroByteShouldFail(t *testing.T) {
	tmp := t.TempDir()
	path := filepath.Join(tmp, "bad.pem")
	os.WriteFile(path, nil, 0600)
	if isValidCertFile(path) {
		t.Error("0-byte cert should not be considered valid")
	}
}