1 files changed, 95 insertions, 0 deletions
diff --git a/internal/config/config_test.go b/internal/config/config_test.go
new file mode 100644
index 0000000..e681508
--- /dev/null
+++ b/internal/config/config_test.go
@@ -0,0 +1,95 @@
+package config
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestLoadAppliesDefaultsAndResolvesSecrets(t *testing.T) {
+	t.Setenv("TEST_UPSTREAM_KEY", "secret")
+	path := writeConfig(t, `{
+  "providers": [{"id":"primary","protocol":"openai","base_url":"https://example.com/v1","api_key_env":"TEST_UPSTREAM_KEY"}],
+  "models": [{"id":"example/model","routes":[{"provider":"primary","upstream_model":"model"}]}]
+}`)
+	cfg, err := Load(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg.Server.Address != ":8080" || cfg.Server.MaxBodyBytes == 0 {
+		t.Fatalf("defaults not applied: %+v", cfg.Server)
+	}
+	if cfg.Providers[0].APIKey != "secret" {
+		t.Fatal("provider secret was not resolved")
+	}
+	if cfg.Models[0].Routes[0].Weight != 1 {
+		t.Fatalf("expected default route weight 1, got %d", cfg.Models[0].Routes[0].Weight)
+	}
+}
+
+func TestLoadRejectsUnknownFieldsAndTrailingData(t *testing.T) {
+	t.Setenv("TEST_UPSTREAM_KEY", "secret")
+	unknown := writeConfig(t, `{"unknown":true}`)
+	if _, err := Load(unknown); err == nil {
+		t.Fatal("expected unknown field error")
+	}
+
+	trailing := writeConfig(t, `{} {}`)
+	if _, err := Load(trailing); err == nil {
+		t.Fatal("expected trailing JSON error")
+	}
+}
+
+func TestLoadControlPlaneModeWithoutStaticRoutes(t *testing.T) {
+	t.Setenv("AIGW_DATABASE_URL", "postgres://aigw:aigw@postgres/aigw")
+	t.Setenv("AIGW_REDIS_URL", "redis://redis:6379/0")
+	t.Setenv("AIGW_CREDENTIAL_KEY", "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
+	t.Setenv("AIGW_ADMIN_TOKEN", "admin-secret")
+	path := writeConfig(t, `{
+  "control_plane": {"enabled":true},
+  "admin": {"enabled":true}
+}`)
+
+	cfg, err := Load(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg.ControlPlane.DatabaseURL == "" || cfg.ControlPlane.RedisURL == "" || cfg.Admin.Token != "admin-secret" {
+		t.Fatalf("control-plane secrets were not resolved: %+v", cfg)
+	}
+	if len(cfg.Providers) != 0 || len(cfg.Models) != 0 {
+		t.Fatal("control-plane mode unexpectedly requires static providers or models")
+	}
+}
+
+func TestLoadControlPlaneModeWithoutRedis(t *testing.T) {
+	t.Setenv("AIGW_DATABASE_URL", "postgres://aigw:aigw@postgres/aigw")
+	t.Setenv("AIGW_REDIS_URL", "")
+	t.Setenv("AIGW_CREDENTIAL_KEY", "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
+	path := writeConfig(t, `{"control_plane":{"enabled":true}}`)
+
+	cfg, err := Load(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if cfg.ControlPlane.RedisURL != "" {
+		t.Fatalf("Redis URL = %q, want empty", cfg.ControlPlane.RedisURL)
+	}
+}
+
+func TestLoadRejectsAdminWithoutControlPlane(t *testing.T) {
+	t.Setenv("AIGW_ADMIN_TOKEN", "admin-secret")
+	path := writeConfig(t, `{"admin":{"enabled":true}}`)
+	if _, err := Load(path); err == nil {
+		t.Fatal("expected admin without control plane to be rejected")
+	}
+}
+
+func writeConfig(t *testing.T, content string) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "config.json")
+	if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}