use rust_proxy::config::{compile, demo_config, ValidationPolicy};

fn policy() -> ValidationPolicy {
    ValidationPolicy {
        tls_addr: None,
        cert_dir: None,
        data_dir: None,
        proxy_addr: "127.0.0.1:8080".parse().unwrap(),
        admin_addr: "127.0.0.1:9090".parse().unwrap(),
    }
}

#[test]
fn local_listener_backend_requires_explicit_risk_acceptance() {
    let mut config = demo_config("127.0.0.1:9000".parse().unwrap());
    let backend = &mut config.vhosts[0].backends[0];
    backend.url = "http://127.0.0.1:9090".into();
    backend.allow_private = true;
    backend.accept_local_listener_risk = false;

    let error = compile(config.clone(), 1, &policy())
        .expect_err("local administration listener must be rejected by default");
    assert!(error.to_string().contains("accept_local_listener_risk=true"));

    config.vhosts[0].backends[0].accept_local_listener_risk = true;
    compile(config, 2, &policy())
        .expect("explicit risk acceptance should permit the local listener target");
}

#[test]
fn rfc8441_requires_an_h2_capable_listener_and_h2c_is_explicit() {
    let mut config = demo_config("127.0.0.1:9000".parse().unwrap());
    config.vhosts[0].websockets = true;
    config.vhosts[0].websocket_rfc8441 = true;
    config.vhosts[0].http2_enabled = true;

    let error = compile(config.clone(), 10, &policy())
        .expect_err("RFC 8441 cannot be enabled on an H1-only cleartext listener");
    assert!(error.to_string().contains("HTTP/2-capable listener"));

    config.listeners.endpoints[0].binding.h2c = true;
    let snapshot = compile(config, 11, &policy())
        .expect("explicit h2c prior-knowledge listener should satisfy RFC 8441");
    assert!(snapshot.websocket_rfc8441_on("127.0.0.1:8080".parse().unwrap(), false));
}