"""Config parses env and never leaks secrets."""

from pathlib import Path

from photo_pipeline.config import Config


def test_from_env_reads_prefixed_values():
    config = Config.from_env(
        {
            "PHOTO_PIPELINE_DATA_DIR": "/tmp/pp",
            "PHOTO_PIPELINE_PORT": "9123",
            "PHOTO_PIPELINE_LOG_FORMAT": "text",
            "UNRELATED": "ignored",
        }
    )
    assert config.data_dir == Path("/tmp/pp")
    assert config.port == 9123
    assert config.log_format == "text"


def test_defaults_and_derived_paths():
    config = Config.from_env({})
    assert config.host == "127.0.0.1"
    assert config.database_path == Path("data") / "photo_pipeline.db"
    assert config.database_url == f"sqlite:///{config.database_path}"


def test_secrets_are_masked_everywhere_but_get_secret_value():
    config = Config.from_env({"PHOTO_PIPELINE_VISION_API_KEY": "super-secret-key"})
    assert config.vision_api_key.get_secret_value() == "super-secret-key"
    # Masked in repr, str, and serialized output.
    assert "super-secret-key" not in repr(config)
    assert "super-secret-key" not in str(config)
    assert "super-secret-key" not in config.model_dump_json()


def test_missing_secret_is_none():
    config = Config.from_env({})
    assert config.vision_api_key is None
    assert config.immich_api_key is None