"""MAX stays off without credentials; enabled deployments fail closed on incomplete settings."""

import pytest
from pydantic import ValidationError

from app.config import Settings


def configured(**overrides):
    fields = {
        "max_enabled": True,
        "max_bot_token": "test-only-token",
        "max_bot_username": "test_bot",
        "max_webhook_secret": "test-only-secret-" * 3,
        "max_webhook_url": "https://api.example.org/api/v1/webhooks/max",
        "max_site_url": "https://patient.example.org/#/today",
    }
    return Settings(_env_file=None, **(fields | overrides))


def test_max_disabled_by_default():
    assert not Settings(_env_file=None).max_enabled


def test_max_secrets_are_redacted():
    settings = configured()
    assert "test-only-token" not in repr(settings)
    assert "test-only-secret" not in repr(settings)


@pytest.mark.parametrize(
    "overrides",
    [
        {"max_bot_token": ""},
        {"max_bot_username": "@test_bot"},
        {"max_webhook_secret": "short"},
        {"max_site_url": "http://patient.example.org"},
        {"max_webhook_url": "http://api.example.org"},
        {"max_webhook_url": "https://api.example.org:8443/hook"},
        {"max_webhook_url": "https://user:password@api.example.org/hook"},
        {"max_webhook_url": "https://api.example.org/hook#fragment"},
        {"max_site_url": "https://patient.example.org?token=credential"},
    ],
)
def test_max_rejects_incomplete_or_unsafe_settings(overrides):
    with pytest.raises(ValidationError):
        configured(**overrides)