package worker_test

import (
	"testing"

	"github.com/jfraeys/fetch_ml/internal/worker"
)

func TestSandboxConfig_Validate(t *testing.T) {
	tests := []struct {
		name    string
		config  worker.SandboxConfig
		wantErr bool
	}{
		{
			name:    "valid none network",
			config:  worker.SandboxConfig{NetworkMode: "none", MaxRuntimeHours: 48},
			wantErr: false,
		},
		{
			name:    "valid bridge network",
			config:  worker.SandboxConfig{NetworkMode: "bridge", MaxRuntimeHours: 24},
			wantErr: false,
		},
		{
			name:    "valid slirp4netns network",
			config:  worker.SandboxConfig{NetworkMode: "slirp4netns", MaxRuntimeHours: 12},
			wantErr: false,
		},
		{
			name:    "valid empty network",
			config:  worker.SandboxConfig{NetworkMode: "", MaxRuntimeHours: 48},
			wantErr: false,
		},
		{
			name:    "invalid network mode",
			config:  worker.SandboxConfig{NetworkMode: "host", MaxRuntimeHours: 48},
			wantErr: true,
		},
		{
			name:    "negative runtime hours",
			config:  worker.SandboxConfig{NetworkMode: "none", MaxRuntimeHours: -1},
			wantErr: true,
		},
		{
			name:    "zero runtime hours is valid",
			config:  worker.SandboxConfig{NetworkMode: "none", MaxRuntimeHours: 0},
			wantErr: false,
		},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			err := tt.config.Validate()
			if (err != nil) != tt.wantErr {
				t.Errorf("Validate() error = %v, wantErr %v", err, tt.wantErr)
			}
		})
	}
}

func TestSandboxConfig_WithSecrets(t *testing.T) {
	config := worker.SandboxConfig{
		NetworkMode:     "none",
		ReadOnlyRoot:    true,
		AllowSecrets:    true,
		AllowedSecrets:  []string{"HF_TOKEN", "WANDB_API_KEY"},
		MaxRuntimeHours: 48,
	}

	if err := config.Validate(); err != nil {
		t.Errorf("Valid sandbox config should not error: %v", err)
	}

	if !config.AllowSecrets {
		t.Error("AllowSecrets should be true")
	}

	if len(config.AllowedSecrets) != 2 {
		t.Errorf("Expected 2 allowed secrets, got %d", len(config.AllowedSecrets))
	}
}