package certbot

import (
	"os"
	"path/filepath"
	"testing"
)

func TestBuildHAProxyCert_EmptyCert(t *testing.T) {
	// BuildHAProxyCert requires sudo + real cert paths,
	// so we test the validation logic directly.
	combined := append([]byte{}, []byte{}...)
	if len(combined) != 0 {
		t.Fatal("test setup: expected empty combined")
	}
	// The check we added: len(combined) == 0 → error
}

func TestHAProxyCertPath(t *testing.T) {
	tests := []struct {
		domain string
		want   string
	}{
		{"example.com", "/etc/haproxy/certs/example.com.pem"},
		{"*.example.com", "/etc/haproxy/certs/*.example.com.pem"},
		{"sub.example.com", "/etc/haproxy/certs/sub.example.com.pem"},
	}
	for _, tt := range tests {
		got := HAProxyCertPath(tt.domain)
		if got != tt.want {
			t.Errorf("HAProxyCertPath(%q) = %q, want %q", tt.domain, got, tt.want)
		}
	}
}

func TestCertPaths(t *testing.T) {
	domain := "example.com"
	certPath := CertPath(domain)
	keyPath := KeyPath(domain)

	if certPath != "/etc/letsencrypt/live/example.com/fullchain.pem" {
		t.Errorf("CertPath = %q", certPath)
	}
	if keyPath != "/etc/letsencrypt/live/example.com/privkey.pem" {
		t.Errorf("KeyPath = %q", keyPath)
	}
}

func TestEnsureCredentials(t *testing.T) {
	tmp := t.TempDir()
	credsPath := filepath.Join(tmp, "subdir", "cloudflare.ini")
	m := NewManager(credsPath)

	if err := m.EnsureCredentials("test-token"); err != nil {
		t.Fatalf("EnsureCredentials: %v", err)
	}

	data, err := os.ReadFile(credsPath)
	if err != nil {
		t.Fatalf("read credentials: %v", err)
	}
	if string(data) != "dns_cloudflare_api_token = test-token\n" {
		t.Errorf("credentials content = %q", string(data))
	}
}

func TestEnsureCredentials_EmptyToken(t *testing.T) {
	m := NewManager(filepath.Join(t.TempDir(), "test.ini"))
	if err := m.EnsureCredentials(""); err == nil {
		t.Error("expected error for empty token")
	}
}