data-mesher/pkg/config/env_mapping_test.go

package config_test

import (
	"path/filepath"
	"strings"
	"testing"
	"time"

	"git.clan.lol/clan/data-mesher/pkg/config"
	"git.clan.lol/clan/data-mesher/pkg/crypto"
	"git.clan.lol/clan/data-mesher/test"
	"github.com/spf13/viper"
	"github.com/stretchr/testify/require"
)

// baseConfigTOML returns a minimal valid TOML config for testing env var overrides
// along with the network private key (needed to sign identity certificates).
// Values are intentionally different from what env vars will set, so we can verify
// the env var takes precedence.
func baseConfigTOML(t *testing.T) (string, *crypto.PrivateKey) {
	t.Helper()

	keys := test.GenerateKeys(t, 2)
	ck := generateClusterKeys(t, keys[1])

	toml := `
state_directory = "/default/state"

[http]
port = 1111
interfaces = ["lo"]

[cluster]
bootstrap_peers = ["` + ck.BootstrapPeerAddr + `"]
port = 7946
push_pull_interval = "30s"

identity_key = "` + ck.IdentityKeyPath + `"
identity_cert = "` + ck.CertPath + `"

auth_timeout = "30s"

[network]
id = "` + keys[1].Public.String() + `"

[network.files]
"test_file" = ["` + keys[0].Public.String() + `"]
`

	return toml, keys[1]
}

// mustBaseConfigTOML returns just the TOML string from baseConfigTOML, discarding the network key.
func mustBaseConfigTOML(t *testing.T) string {
	t.Helper()

	toml, _ := baseConfigTOML(t)

	return toml
}

// viperFromTOMLWithEnv creates a viper instance from TOML string with env vars applied.
func viperFromTOMLWithEnv(t *testing.T, toml string) *viper.Viper {
	t.Helper()

	v, err := config.NewViper()
	require.NoError(t, err)
	require.NoError(t, v.ReadConfig(strings.NewReader(toml)))

	return v
}

// TestBindEnvVars_Config tests env var bindings for top-level Config fields.
func TestBindEnvVars_Config(t *testing.T) {
	t.Run("state_directory", func(t *testing.T) {
		as := require.New(t)
		t.Setenv("DATA_MESHER_STATE_DIRECTORY", "/env/state/dir")

		v := viperFromTOMLWithEnv(t, mustBaseConfigTOML(t))
		cfg, err := config.FromViper(v)
		as.NoError(err)
		as.Equal("/env/state/dir", cfg.StateDirectory)
	})

	t.Run("STATE_DIRECTORY systemd compatibility", func(t *testing.T) {
		as := require.New(t)
		t.Setenv("STATE_DIRECTORY", "/systemd/state")

		v := viperFromTOMLWithEnv(t, mustBaseConfigTOML(t))
		cfg, err := config.FromViper(v)
		as.NoError(err)
		as.Equal("/systemd/state", cfg.StateDirectory)
	})

	t.Run("DATA_MESHER_STATE_DIRECTORY takes precedence over STATE_DIRECTORY", func(t *testing.T) {
		// DATA_MESHER vars are bound first, giving them precedence
		as := require.New(t)
		t.Setenv("STATE_DIRECTORY", "/systemd/state")
		t.Setenv("DATA_MESHER_STATE_DIRECTORY", "/data-mesher/state")

		v := viperFromTOMLWithEnv(t, mustBaseConfigTOML(t))
		cfg, err := config.FromViper(v)
		as.NoError(err)
		as.Equal("/data-mesher/state", cfg.StateDirectory)
	})
}

// TestBindEnvVars_HTTP tests env var bindings for HTTP config fields.
func TestBindEnvVars_HTTP(t *testing.T) {
	t.Run("port", func(t *testing.T) {
		as := require.New(t)
		t.Setenv("DATA_MESHER_HTTP_PORT", "9999")

		v := viperFromTOMLWithEnv(t, mustBaseConfigTOML(t))
		cfg, err := config.FromViper(v)
		as.NoError(err)
		as.Equal(uint16(9999), cfg.HTTP.Port)
	})

	t.Run("port max value", func(t *testing.T) {
		as := require.New(t)
		t.Setenv("DATA_MESHER_HTTP_PORT", "65535")

		v := viperFromTOMLWithEnv(t, mustBaseConfigTOML(t))
		cfg, err := config.FromViper(v)
		as.NoError(err)
		as.Equal(uint16(65535), cfg.HTTP.Port)
	})

	t.Run("interfaces", func(t *testing.T) {
		as := require.New(t)
		t.Setenv("DATA_MESHER_HTTP_INTERFACES", "lo")

		v := viperFromTOMLWithEnv(t, mustBaseConfigTOML(t))
		cfg, err := config.FromViper(v)
		as.NoError(err)
		as.Equal([]string{"lo"}, cfg.HTTP.Interfaces)
	})

	//nolint:paralleltest // other subtests use t.Setenv which is not parallel-safe
	t.Run("ListenAddresses is computed not bound", func(t *testing.T) {
		as := require.New(t)

		v := viperFromTOMLWithEnv(t, mustBaseConfigTOML(t))
		cfg, err := config.FromViper(v)
		as.NoError(err)
		as.Equal([]string{"[::1]:1111", "127.0.0.1:1111"}, cfg.HTTP.ListenAddresses)
	})
}

// TestBindEnvVars_Cluster tests env var bindings for Cluster config fields.
func TestBindEnvVars_Cluster(t *testing.T) {
	t.Run("push_pull_interval", func(t *testing.T) {
		as := require.New(t)
		t.Setenv("DATA_MESHER_CLUSTER_PUSH_PULL_INTERVAL", "60s")

		v := viperFromTOMLWithEnv(t, mustBaseConfigTOML(t))
		cfg, err := config.FromViper(v)
		as.NoError(err)
		as.Equal(60*time.Second, cfg.Cluster.PushPullInterval)
	})

	t.Run("port", func(t *testing.T) {
		as := require.New(t)
		t.Setenv("DATA_MESHER_CLUSTER_PORT", "9000")

		v := viperFromTOMLWithEnv(t, mustBaseConfigTOML(t))
		cfg, err := config.FromViper(v)
		as.NoError(err)
		as.Equal(uint16(9000), cfg.Cluster.Port)
	})

	t.Run("identity_key", func(t *testing.T) {
		as := require.New(t)

		toml, networkKey := baseConfigTOML(t)

		expectedKey, keyPath := test.GenerateIdentityKey(t)

		// Sign cert with the network key so validation passes
		now := time.Now()
		cert, err := crypto.SignCertificate(
			"test-machine", expectedKey.Public, networkKey, now.Add(-time.Minute), now.Add(365*24*time.Hour),
		)
		as.NoError(err)

		dir := t.TempDir()
		certPath := filepath.Join(dir, "identity.cert")
		as.NoError(crypto.WriteCertificate(cert, certPath))

		t.Setenv("DATA_MESHER_CLUSTER_IDENTITY_KEY", keyPath)
		t.Setenv("DATA_MESHER_CLUSTER_IDENTITY_CERT", certPath)

		v := viperFromTOMLWithEnv(t, toml)
		cfg, err := config.FromViper(v)
		as.NoError(err)
		as.NotNil(cfg.Cluster.IdentityKey)

		// verify the loaded key matches by comparing peer IDs
		expectedPeerID, err := expectedKey.PeerID()
		as.NoError(err)

		actualPeerID, err := cfg.Cluster.IdentityKey.PeerID()
		as.NoError(err)

		as.Equal(expectedPeerID, actualPeerID)
	})
}

// TestBindEnvVars_DurationFormats tests that various duration formats are parsed correctly.
func TestBindEnvVars_DurationFormats(t *testing.T) {
	tests := []struct {
		name     string
		envValue string
		expected time.Duration
	}{
		{"seconds", "45s", 45 * time.Second},
		{"minutes", "2m", 2 * time.Minute},
		{"hours", "1h", 1 * time.Hour},
		{"combined", "1h30m", 90 * time.Minute},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			as := require.New(t)
			t.Setenv("DATA_MESHER_CLUSTER_PUSH_PULL_INTERVAL", tt.envValue)

			v := viperFromTOMLWithEnv(t, mustBaseConfigTOML(t))
			cfg, err := config.FromViper(v)
			as.NoError(err)
			as.Equal(tt.expected, cfg.Cluster.PushPullInterval)
		})
	}
}

// TestBindEnvVars_Behavior tests cross-cutting env var binding behaviors.
func TestBindEnvVars_Behavior(t *testing.T) {
	t.Run("multiple env vars simultaneously", func(t *testing.T) {
		as := require.New(t)
		t.Setenv("DATA_MESHER_STATE_DIRECTORY", "/multi/state")
		t.Setenv("DATA_MESHER_HTTP_PORT", "7777")
		t.Setenv("DATA_MESHER_CLUSTER_PUSH_PULL_INTERVAL", "120s")

		v := viperFromTOMLWithEnv(t, mustBaseConfigTOML(t))
		cfg, err := config.FromViper(v)
		as.NoError(err)
		as.Equal("/multi/state", cfg.StateDirectory)
		as.Equal(uint16(7777), cfg.HTTP.Port)
		as.Equal(120*time.Second, cfg.Cluster.PushPullInterval)
	})

	t.Run("env var takes precedence over TOML", func(t *testing.T) {
		as := require.New(t)
		keys := test.GenerateKeys(t, 2)
		ck := generateClusterKeys(t, keys[1])
		toml := `
state_directory = "/toml/state"

[http]
port = 1234
interfaces = ["lo"]

[cluster]
port = 7946

bootstrap_peers = ["` + ck.BootstrapPeerAddr + `"]
push_pull_interval = "30s"

identity_key = "` + ck.IdentityKeyPath + `"
identity_cert = "` + ck.CertPath + `"

[network]
id = "` + keys[1].Public.String() + `"

[network.files]
"test_file" = ["` + keys[0].Public.String() + `"]
`

		t.Setenv("DATA_MESHER_STATE_DIRECTORY", "/env/state")

		v := viperFromTOMLWithEnv(t, toml)
		cfg, err := config.FromViper(v)
		as.NoError(err)
		as.Equal("/env/state", cfg.StateDirectory,
			"env var should take precedence over TOML config")
		as.Equal(uint16(1234), cfg.HTTP.Port,
			"TOML value should be used when no env var is set")
	})

	t.Run("empty env var does not override TOML", func(t *testing.T) {
		as := require.New(t)
		keys := test.GenerateKeys(t, 2)
		ck := generateClusterKeys(t, keys[1])
		toml := `
state_directory = "/toml/state"

[http]
port = 1234
interfaces = ["lo"]

[cluster]
port = 7946

bootstrap_peers = ["` + ck.BootstrapPeerAddr + `"]
push_pull_interval = "30s"

identity_key = "` + ck.IdentityKeyPath + `"
identity_cert = "` + ck.CertPath + `"

[network]
id = "` + keys[1].Public.String() + `"

[network.files]
"test_file" = ["` + keys[0].Public.String() + `"]
`

		t.Setenv("DATA_MESHER_HTTP_PORT", "")

		v := viperFromTOMLWithEnv(t, toml)
		cfg, err := config.FromViper(v)
		as.NoError(err)
		as.Equal(uint16(1234), cfg.HTTP.Port)
	})

	t.Run("env vars work without TOML config values", func(t *testing.T) {
		as := require.New(t)
		keys := test.GenerateKeys(t, 2)
		ck := generateClusterKeys(t, keys[1])

		_, bpAddr := test.GenerateBootstrapPeer(t)

		t.Setenv("DATA_MESHER_STATE_DIRECTORY", "/env/only/state")
		t.Setenv("DATA_MESHER_HTTP_PORT", "8080")
		t.Setenv("DATA_MESHER_HTTP_INTERFACES", "lo")
		t.Setenv("DATA_MESHER_CLUSTER_PORT", "7946")
		t.Setenv("DATA_MESHER_CLUSTER_BOOTSTRAP_PEERS", bpAddr)
		t.Setenv("DATA_MESHER_CLUSTER_PUSH_PULL_INTERVAL", "30s")
		t.Setenv("DATA_MESHER_CLUSTER_IDENTITY_KEY", ck.IdentityKeyPath)
		t.Setenv("DATA_MESHER_CLUSTER_IDENTITY_CERT", ck.CertPath)

		// Minimal TOML with only the network section (which can't be set via simple env var)
		minimalTOML := `
[network]
id = "` + keys[1].Public.String() + `"

[network.files]
"test_file" = ["` + keys[0].Public.String() + `"]
`
		v := viperFromTOMLWithEnv(t, minimalTOML)
		cfg, err := config.FromViper(v)
		as.NoError(err)
		as.Equal("/env/only/state", cfg.StateDirectory)
		as.Equal(uint16(8080), cfg.HTTP.Port)
		as.Equal([]string{"lo"}, cfg.HTTP.Interfaces)
		as.Equal(uint16(7946), cfg.Cluster.Port)
		as.Equal(30*time.Second, cfg.Cluster.PushPullInterval)
	})
}