# Unit tests for Chef/Cinc configuration in user-data script
# These tests validate Chef-related settings render correctly

variables {
  chef_role         = "test_role"
  aws_iam_role_id   = "test-iam-role"
  aws_instance_name = "test-instance"
}

# Test: Chef version is included in download URL
run "chef_version_in_download_url" {
  command = plan

  variables {
    chef_version = "18.5.0"
  }

  assert {
    condition     = can(regex("cinc/18\\.5\\.0/", output.user_data_output))
    error_message = "Chef version 18.5.0 should appear in Cinc download URL"
  }
}

# Test: Chef server URL is configured
run "chef_server_url_configured" {
  command = plan

  variables {
    chef_server_url = "https://chef.example.com/organizations/myorg"
  }

  assert {
    condition     = can(regex("https://chef\\.example\\.com/organizations/myorg", output.user_data_output))
    error_message = "Chef server URL should appear in client.rb configuration"
  }
}

# Test: Chef environment is configured
run "chef_environment_configured" {
  command = plan

  variables {
    chef_environment = "production"
  }

  assert {
    condition     = can(regex("environment.*production", output.user_data_output))
    error_message = "Chef environment should appear in client.rb configuration"
  }
}

# Test: Instance name is used in node_name
run "instance_name_in_node_name" {
  command = plan

  variables {
    aws_instance_name = "my-app-server"
  }

  assert {
    condition     = can(regex("node_name.*my-app-server", output.user_data_output))
    error_message = "AWS instance name should be used in Chef node_name"
  }
}

# Test: SSL verify mode is configurable
run "ssl_verify_mode_configured" {
  command = plan

  variables {
    ssl_verify_mode = "verify_peer"
  }

  assert {
    condition     = can(regex("ssl_verify_mode.*:verify_peer", output.user_data_output))
    error_message = "SSL verify mode should be configurable in client.rb"
  }
}

# Test: Log file path is configurable
run "log_file_path_configured" {
  command = plan

  variables {
    log_file = "/var/log/custom/bootstrap.log"
  }

  assert {
    condition     = can(regex("/var/log/custom/bootstrap\\.log", output.user_data_output))
    error_message = "Custom log file path should appear in user data"
  }
}

# Test: S3 bucket is used for key downloads
run "s3_bucket_in_download_commands" {
  command = plan

  variables {
    s3_chef_bucket = "my-chef-secrets-bucket"
  }

  assert {
    condition     = can(regex("s3://my-chef-secrets-bucket/", output.user_data_output))
    error_message = "S3 bucket should appear in key download commands"
  }
}

# Test: Chef server name is used in S3 paths
run "chef_server_in_s3_paths" {
  command = plan

  variables {
    chef_server = "production-chef"
  }

  assert {
    condition     = can(regex("production-chef/orchard-validator\\.pem", output.user_data_output))
    error_message = "Chef server name should appear in S3 paths"
  }
}

# Test: Encrypted data bag secret path is configurable
run "encrypted_data_bag_secret_configured" {
  command = plan

  variables {
    encrypted_data_bag_secret = "custom_secret_file"
  }

  assert {
    condition     = can(regex("custom_secret_file", output.user_data_output))
    error_message = "Custom encrypted data bag secret filename should appear in user data"
  }
}

# Test: Qualys data bag secret is downloaded
run "qualys_data_bag_secret_downloaded" {
  command = plan

  variables {
    qualys_encrypted_data_bag_secret = "qualys_secret"
  }

  assert {
    condition     = can(regex("qualys_secret", output.user_data_output))
    error_message = "Qualys encrypted data bag secret should be downloaded"
  }

  assert {
    condition     = can(regex("/etc/cinc/qualys_encrypted_data_bag_secret", output.user_data_output))
    error_message = "Qualys secret should be saved to /etc/cinc/"
  }
}

# Test: firstboot.json is created
run "firstboot_json_created" {
  command = plan

  assert {
    condition     = can(regex("/etc/cinc/firstboot\\.json", output.user_data_output))
    error_message = "firstboot.json should be created"
  }
}

# Test: Node attributes are included in firstboot.json
run "node_attributes_in_firstboot" {
  command = plan

  variables {
    chef_role = "web_server"
    node_attributes = {
      custom_attr = "custom_value"
    }
  }

  assert {
    condition     = can(regex("role\\[web_server\\]", output.user_data_output))
    error_message = "Chef role should appear in firstboot.json run_list"
  }

  assert {
    condition     = can(regex("custom_attr", output.user_data_output))
    error_message = "Custom node attributes should appear in firstboot.json"
  }
}

# Test: cinc-client is invoked with correct arguments
run "cinc_client_invocation" {
  command = plan

  variables {
    chef_environment = "staging"
  }

  assert {
    condition     = can(regex("cinc-client -j /etc/cinc/firstboot\\.json", output.user_data_output))
    error_message = "cinc-client should be invoked with firstboot.json"
  }

  assert {
    condition     = can(regex("--environment.*staging", output.user_data_output))
    error_message = "cinc-client should be invoked with correct environment"
  }
}