package config

import (
	"encoding/json"
	"os"
	"path/filepath"
	"strings"
	"testing"
)

func TestBusinessOAEnvironmentAndRuntimeMerge(t *testing.T) {
	path := filepath.Join(t.TempDir(), "config.yaml")
	if err := os.WriteFile(path, []byte("server:\n  http:\n    addr: ':8000'\n"), 0600); err != nil {
		t.Fatal(err)
	}
	t.Setenv("KRA_BUSINESS_OA_URL", "http://oa.test/api")
	t.Setenv("KRA_BUSINESS_OA_KEY", "test-only-key")
	value, err := Load(path)
	if err != nil {
		t.Fatal(err)
	}
	if value.BusinessOA == nil || value.BusinessOA.URL != "http://oa.test/api" || value.BusinessOA.Key != "test-only-key" {
		t.Fatal("environment-only OA configuration not loaded")
	}
	merged := MergeRuntimeConfig(value, &Config{Admin: &Admin{}})
	merged.BusinessOA.Key = "changed"
	if value.BusinessOA.Key != "test-only-key" {
		t.Fatal("configuration snapshot shared a pointer")
	}
	serialized, err := json.Marshal(value)
	if err != nil || strings.Contains(string(serialized), "test-only-key") {
		t.Fatal("service credential leaked through public configuration")
	}
}