foxhunt/vault-migration/testing/integration-tests.rs

//! Comprehensive integration tests for Vault migration
//!
//! This test suite validates the complete Vault integration including:
//! - Secret loading from Vault
//! - Fallback to environment variables
//! - Service integration
//! - Secret rotation
//! - Error handling and recovery

use anyhow::Result;
use foxhunt_vault_client::{FoxhuntVaultClient, VaultClientConfig};
use foxhunt_vault_client::auth::StaticTokenProvider;
use serde_json::json;
use std::collections::HashMap;
use std::sync::Arc;
use std::time::Duration;
use tokio::time::timeout;
use uuid::Uuid;

use vault_migration::{VaultConfigLoader, ConfigCategory};
use vault_migration::SecretRotationManager;

/// Test configuration for Vault integration tests
struct TestConfig {
    vault_url: String,
    vault_token: String,
    environment: String,
    service_name: String,
}

impl Default for TestConfig {
    fn default() -> Self {
        Self {
            vault_url: std::env::var("TEST_VAULT_URL")
                .unwrap_or_else(|_| "http://localhost:8200".to_string()),
            vault_token: std::env::var("TEST_VAULT_TOKEN")
                .unwrap_or_else(|_| "test-token".to_string()),
            environment: "integration-test".to_string(),
            service_name: "test-service".to_string(),
        }
    }
}

/// Create a test Vault client
async fn create_test_vault_client() -> Result<Arc<FoxhuntVaultClient>> {
    let test_config = TestConfig::default();
    
    let vault_config = VaultClientConfig {
        vault_url: test_config.vault_url,
        environment: test_config.environment,
        service_name: test_config.service_name,
        cache_ttl: Duration::from_secs(10), // Short TTL for testing
        ..Default::default()
    };

    let token_provider = Box::new(StaticTokenProvider::new(test_config.vault_token));
    let client = FoxhuntVaultClient::new(vault_config, token_provider).await?;
    
    Ok(Arc::new(client))
}

/// Setup test secrets in Vault
async fn setup_test_secrets(vault_client: &FoxhuntVaultClient) -> Result<()> {
    // Database secrets
    let db_secrets = json!({
        "url": "postgresql://test:test@localhost:5432/test_db",
        "host": "localhost",
        "port": "5432",
        "database": "test_db",
        "username": "test",
        "password": "test"
    });
    vault_client.write_secret("database/postgresql", 
        serde_json::from_value(db_secrets)?, None).await?;

    // API key secrets
    let api_secrets = json!({
        "api_key": "test-databento-key-12345",
        "endpoint": "wss://test.databento.com",
        "rate_limit": "10"
    });
    vault_client.write_secret("api-keys/databento",
        serde_json::from_value(api_secrets)?, None).await?;

    // JWT secrets
    let jwt_secrets = json!({
        "secret": "test-jwt-secret-minimum-32-characters-long",
        "issuer": "test-foxhunt",
        "audience": "test-services",
        "expiration_seconds": "3600"
    });
    vault_client.write_secret("authentication/jwt",
        serde_json::from_value(jwt_secrets)?, None).await?;

    // Broker credentials
    let broker_secrets = json!({
        "username": "test-ic-user",
        "password": "test-ic-password",
        "endpoint": "test.icmarkets.com:443",
        "sender_comp_id": "TEST_FOXHUNT",
        "target_comp_id": "TEST_ICMARKETS"
    });
    vault_client.write_secret("brokers/icmarkets",
        serde_json::from_value(broker_secrets)?, None).await?;

    Ok(())
}

/// Cleanup test secrets from Vault
async fn cleanup_test_secrets(vault_client: &FoxhuntVaultClient) -> Result<()> {
    let paths = vec![
        "database/postgresql",
        "api-keys/databento", 
        "authentication/jwt",
        "brokers/icmarkets",
    ];

    for path in paths {
        let _ = vault_client.delete_secret(path).await; // Ignore errors for cleanup
    }

    Ok(())
}

#[tokio::test]
async fn test_vault_client_basic_operations() -> Result<()> {
    let vault_client = create_test_vault_client().await?;
    
    // Test health check
    vault_client.health_check().await?;

    // Setup test secrets
    setup_test_secrets(&vault_client).await?;

    // Test reading secrets
    let secret = vault_client.read_secret("database/postgresql").await?;
    assert_eq!(secret.data.get("url").unwrap().as_str().unwrap(), 
               "postgresql://test:test@localhost:5432/test_db");
    assert_eq!(secret.data.get("host").unwrap().as_str().unwrap(), "localhost");

    // Test reading specific field
    let api_key = vault_client.read_secret_field("api-keys/databento", "api_key").await?;
    assert_eq!(api_key, "test-databento-key-12345");

    // Test helper methods
    let database_url = vault_client.get_database_url("postgresql").await?;
    assert_eq!(database_url, "postgresql://test:test@localhost:5432/test_db");

    let databento_key = vault_client.get_api_key("databento").await?;
    assert_eq!(databento_key, "test-databento-key-12345");

    // Test listing secrets
    let secrets = vault_client.list_secrets("api-keys").await?;
    assert!(secrets.contains(&"databento".to_string()));

    // Cleanup
    cleanup_test_secrets(&vault_client).await?;

    println!("✅ Vault client basic operations test passed");
    Ok(())
}

#[tokio::test]
async fn test_vault_config_loader() -> Result<()> {
    let vault_client = create_test_vault_client().await?;
    setup_test_secrets(&vault_client).await?;

    let config_loader = VaultConfigLoader::new(
        vault_client.clone(),
        "integration-test".to_string(),
        "test-service".to_string(),
        true, // Enable fallback
    ).await?;

    // Test database config loading
    let db_config = config_loader.get_database_config("postgresql").await?;
    assert_eq!(db_config.url, "postgresql://test:test@localhost:5432/test_db");
    assert_eq!(db_config.host, Some("localhost".to_string()));
    assert_eq!(db_config.port, Some(5432));

    // Test API key config loading
    let api_config = config_loader.get_api_key_config("databento").await?;
    assert_eq!(api_config.api_key, "test-databento-key-12345");
    assert_eq!(api_config.endpoint, "wss://test.databento.com");
    assert_eq!(api_config.rate_limit, Some(10));

    // Test JWT config loading
    let jwt_config = config_loader.get_jwt_config().await?;
    assert_eq!(jwt_config.secret, "test-jwt-secret-minimum-32-characters-long");
    assert_eq!(jwt_config.issuer, "test-foxhunt");

    // Test broker config loading
    let broker_config = config_loader.get_broker_config("icmarkets").await?;
    assert_eq!(broker_config.username, "test-ic-user");
    assert_eq!(broker_config.password, "test-ic-password");
    assert_eq!(broker_config.endpoint, "test.icmarkets.com:443");

    // Test caching
    let (total, expired) = config_loader.cache_stats().await;
    assert!(total > 0);
    assert_eq!(expired, 0);

    // Test cache functionality
    config_loader.clear_cache().await;
    let (total_after, _) = config_loader.cache_stats().await;
    assert_eq!(total_after, 0);

    cleanup_test_secrets(&vault_client).await?;

    println!("✅ Vault config loader test passed");
    Ok(())
}

#[tokio::test]
async fn test_environment_variable_fallback() -> Result<()> {
    let vault_client = create_test_vault_client().await?;

    // Don't setup secrets in Vault to test fallback
    let config_loader = VaultConfigLoader::new(
        vault_client.clone(),
        "integration-test".to_string(),
        "test-service".to_string(),
        true, // Enable fallback
    ).await?;

    // Set environment variables
    std::env::set_var("DATABASE_URL", "postgresql://fallback:fallback@localhost:5432/fallback_db");
    std::env::set_var("DATABENTO_API_KEY", "fallback-databento-key");
    std::env::set_var("JWT_SECRET", "fallback-jwt-secret-32-characters");

    // Test fallback to environment variables
    let db_config = config_loader.get_database_config("postgresql").await?;
    assert_eq!(db_config.url, "postgresql://fallback:fallback@localhost:5432/fallback_db");

    let api_config = config_loader.get_api_key_config("databento").await?;
    assert_eq!(api_config.api_key, "fallback-databento-key");

    let jwt_config = config_loader.get_jwt_config().await?;
    assert_eq!(jwt_config.secret, "fallback-jwt-secret-32-characters");

    // Cleanup environment variables
    std::env::remove_var("DATABASE_URL");
    std::env::remove_var("DATABENTO_API_KEY");
    std::env::remove_var("JWT_SECRET");

    println!("✅ Environment variable fallback test passed");
    Ok(())
}

#[tokio::test]
async fn test_error_handling() -> Result<()> {
    let vault_client = create_test_vault_client().await?;

    let config_loader = VaultConfigLoader::new(
        vault_client.clone(),
        "integration-test".to_string(),
        "test-service".to_string(),
        false, // Disable fallback to test error handling
    ).await?;

    // Test reading non-existent secret
    let result = config_loader.get_database_config("nonexistent").await;
    assert!(result.is_err());

    // Test reading non-existent API key
    let result = config_loader.get_api_key_config("nonexistent").await;
    assert!(result.is_err());

    // Test secret field not found
    setup_test_secrets(&vault_client).await?;
    let result = vault_client.read_secret_field("database/postgresql", "nonexistent_field").await;
    assert!(result.is_err());

    cleanup_test_secrets(&vault_client).await?;

    println!("✅ Error handling test passed");
    Ok(())
}

#[tokio::test]
async fn test_secret_rotation() -> Result<()> {
    let vault_client = create_test_vault_client().await?;
    setup_test_secrets(&vault_client).await?;

    let notification_handler = Box::new(vault_migration::LogNotificationHandler);
    let rotation_manager = SecretRotationManager::new(vault_client.clone(), notification_handler);

    // Create rotation policy
    let policy = vault_migration::RotationPolicy {
        secret_path: "authentication/jwt".to_string(),
        rotation_type: vault_migration::RotationType::JwtSigningKey,
        rotation_interval: chrono::Duration::minutes(1),
        advance_notice_hours: 0,
        max_versions: 3,
        enable_automatic_rotation: true,
        require_manual_approval: false,
        pre_rotation_hooks: vec![],
        post_rotation_hooks: vec![],
        rollback_strategy: vault_migration::RollbackStrategy::ImmediateRevert,
    };

    // Set rotation policy
    rotation_manager.set_rotation_policy(policy).await?;

    // Trigger manual rotation
    let rotation_id = rotation_manager.trigger_manual_rotation("authentication/jwt").await?;
    
    // Wait for rotation to complete
    timeout(Duration::from_secs(10), async {
        loop {
            let active_rotations = rotation_manager.get_active_rotations().await;
            if let Some(rotation) = active_rotations.get(&rotation_id.to_string()) {
                if matches!(rotation.status, vault_migration::RotationStatus::Completed) {
                    break;
                }
            }
            tokio::time::sleep(Duration::from_millis(100)).await;
        }
    }).await?;

    // Verify the secret was rotated
    let new_secret = vault_client.read_secret_field("authentication/jwt", "secret").await?;
    assert_ne!(new_secret, "test-jwt-secret-minimum-32-characters-long");
    assert!(new_secret.len() >= 32);

    cleanup_test_secrets(&vault_client).await?;

    println!("✅ Secret rotation test passed");
    Ok(())
}

#[tokio::test]
async fn test_concurrent_access() -> Result<()> {
    let vault_client = create_test_vault_client().await?;
    setup_test_secrets(&vault_client).await?;

    let config_loader = Arc::new(VaultConfigLoader::new(
        vault_client.clone(),
        "integration-test".to_string(),
        "test-service".to_string(),
        true,
    ).await?);

    // Test concurrent access to secrets
    let mut handles = Vec::new();
    for i in 0..10 {
        let loader = config_loader.clone();
        let handle = tokio::spawn(async move {
            let db_config = loader.get_database_config("postgresql").await?;
            assert_eq!(db_config.url, "postgresql://test:test@localhost:5432/test_db");
            
            let api_config = loader.get_api_key_config("databento").await?;
            assert_eq!(api_config.api_key, "test-databento-key-12345");
            
            Result::<(), anyhow::Error>::Ok(())
        });
        handles.push(handle);
    }

    // Wait for all concurrent operations to complete
    for handle in handles {
        handle.await??;
    }

    // Verify cache hit rate is good
    let (total, expired) = config_loader.cache_stats().await;
    assert!(total > 0);
    
    cleanup_test_secrets(&vault_client).await?;

    println!("✅ Concurrent access test passed");
    Ok(())
}

#[tokio::test]
async fn test_service_integration_simulation() -> Result<()> {
    let vault_client = create_test_vault_client().await?;
    setup_test_secrets(&vault_client).await?;

    let config_loader = VaultConfigLoader::new(
        vault_client.clone(),
        "integration-test".to_string(),
        "test-service".to_string(),
        true,
    ).await?;

    // Simulate service startup sequence
    println!("🚀 Simulating service startup...");

    // Load database configuration
    let db_config = config_loader.get_database_config("postgresql").await?;
    println!("✅ Database config loaded: host={}, port={}", 
             db_config.host.unwrap_or("unknown".to_string()), 
             db_config.port.unwrap_or(0));

    // Load API configurations
    let databento_config = config_loader.get_api_key_config("databento").await?;
    println!("✅ Databento API config loaded: endpoint={}, rate_limit={}", 
             databento_config.endpoint, 
             databento_config.rate_limit.unwrap_or(0));

    // Load authentication configuration
    let jwt_config = config_loader.get_jwt_config().await?;
    println!("✅ JWT config loaded: issuer={}, audience={}", 
             jwt_config.issuer, jwt_config.audience);

    // Load broker configuration
    let broker_config = config_loader.get_broker_config("icmarkets").await?;
    println!("✅ Broker config loaded: endpoint={}", broker_config.endpoint);

    // Simulate service health check
    let health_check_passed = simulate_service_health_check(&config_loader).await?;
    assert!(health_check_passed);
    println!("✅ Service health check passed");

    cleanup_test_secrets(&vault_client).await?;

    println!("✅ Service integration simulation test passed");
    Ok(())
}

/// Simulate a service health check that verifies all configurations are loaded
async fn simulate_service_health_check(config_loader: &VaultConfigLoader) -> Result<bool> {
    // Check that all critical secrets can be loaded
    let critical_checks = vec![
        config_loader.get_database_config("postgresql").await.is_ok(),
        config_loader.get_api_key_config("databento").await.is_ok(),
        config_loader.get_jwt_config().await.is_ok(),
        config_loader.get_broker_config("icmarkets").await.is_ok(),
    ];

    let all_passed = critical_checks.into_iter().all(|check| check);
    Ok(all_passed)
}

#[tokio::test]
async fn test_migration_validation() -> Result<()> {
    println!("🧪 Running migration validation tests...");

    // Test 1: Verify all expected secret categories can be loaded
    let vault_client = create_test_vault_client().await?;
    setup_test_secrets(&vault_client).await?;

    let config_loader = VaultConfigLoader::new(
        vault_client.clone(),
        "integration-test".to_string(),
        "test-service".to_string(),
        false, // No fallback for validation
    ).await?;

    // Validate database secrets
    let db_types = vec!["postgresql"];
    for db_type in db_types {
        let config = config_loader.get_database_config(db_type).await?;
        assert!(!config.url.is_empty(), "Database URL should not be empty for {}", db_type);
        println!("✅ Database config validated for: {}", db_type);
    }

    // Validate API key secrets
    let api_providers = vec!["databento"];
    for provider in api_providers {
        let config = config_loader.get_api_key_config(provider).await?;
        assert!(!config.api_key.is_empty(), "API key should not be empty for {}", provider);
        assert!(!config.endpoint.is_empty(), "Endpoint should not be empty for {}", provider);
        println!("✅ API key config validated for: {}", provider);
    }

    // Validate authentication secrets
    let jwt_config = config_loader.get_jwt_config().await?;
    assert!(jwt_config.secret.len() >= 32, "JWT secret should be at least 32 characters");
    assert!(!jwt_config.issuer.is_empty(), "JWT issuer should not be empty");
    println!("✅ JWT config validated");

    // Validate broker credentials
    let brokers = vec!["icmarkets"];
    for broker in brokers {
        let config = config_loader.get_broker_config(broker).await?;
        assert!(!config.username.is_empty() || !config.additional_params.is_empty(), 
                "Broker should have username or additional params for {}", broker);
        assert!(!config.endpoint.is_empty(), "Broker endpoint should not be empty for {}", broker);
        println!("✅ Broker config validated for: {}", broker);
    }

    cleanup_test_secrets(&vault_client).await?;

    println!("✅ Migration validation tests passed");
    Ok(())
}

/// Run all integration tests
#[tokio::main]
async fn main() -> Result<()> {
    println!("🧪 Starting Vault migration integration tests...");

    // Set up test environment
    std::env::set_var("RUST_LOG", "info");
    tracing_subscriber::fmt::init();

    let test_results = vec![
        ("Vault Client Basic Operations", test_vault_client_basic_operations().await),
        ("Vault Config Loader", test_vault_config_loader().await),
        ("Environment Variable Fallback", test_environment_variable_fallback().await),
        ("Error Handling", test_error_handling().await),
        ("Secret Rotation", test_secret_rotation().await),
        ("Concurrent Access", test_concurrent_access().await),
        ("Service Integration Simulation", test_service_integration_simulation().await),
        ("Migration Validation", test_migration_validation().await),
    ];

    let mut passed = 0;
    let mut failed = 0;

    println!("\n📊 Test Results:");
    println!("{}", "=".repeat(60));

    for (test_name, result) in test_results {
        match result {
            Ok(()) => {
                println!("✅ {}", test_name);
                passed += 1;
            }
            Err(e) => {
                println!("❌ {}: {}", test_name, e);
                failed += 1;
            }
        }
    }

    println!("{}", "=".repeat(60));
    println!("📈 Summary: {} passed, {} failed", passed, failed);

    if failed > 0 {
        println!("❌ Some tests failed. Please check the errors above.");
        std::process::exit(1);
    } else {
        println!("🎉 All integration tests passed!");
        println!("✅ Vault migration is ready for deployment!");
    }

    Ok(())
}

#[cfg(test)]
mod tests {
    use super::*;

    #[tokio::test]
    async fn run_all_tests() -> Result<()> {
        main().await
    }
}