# Unset required variable
unset DATABASE_URL
unset JWT_SECRET_KEY

# Attempt to start
python -m mcpgateway.main 2>&1 | tee /tmp/startup.log

# Check exit code
echo $?  # Should be 1

# Check error is clear
grep -q "DATABASE_URL" /tmp/startup.log && echo "PASS: Error mentions variable"
grep -q "required" /tmp/startup.log && echo "PASS: Error says required"

# Set invalid port
export PORT="not-a-number"
export DATABASE_URL="sqlite:///test.db"
export JWT_SECRET_KEY="test-secret"

# Attempt to start
python -m mcpgateway.main 2>&1 | tee /tmp/startup.log

grep -q "PORT" /tmp/startup.log && echo "PASS: Error mentions PORT"
grep -q "integer" /tmp/startup.log && echo "PASS: Error mentions expected type"

# Set boolean as string
export RELOAD="true"
export AUTH_REQUIRED="True"
export MCPGATEWAY_UI_ENABLED="1"
export DATABASE_URL="sqlite:///test.db"
export JWT_SECRET_KEY="test-secret"

# Start gateway
python -m mcpgateway.main &
PID=$!
sleep 5

# Verify running
curl -s http://localhost:8000/health | jq '.status'

# Verify settings applied correctly
curl -s http://localhost:8000/api/admin/config \
  -H "Authorization: Bearer $TOKEN" | jq '{reload, auth_required, ui_enabled}'

# Minimal configuration
export DATABASE_URL="sqlite:///test.db"
export JWT_SECRET_KEY="minimal-test-secret"

# Start with minimal config
python -m mcpgateway.main &
PID=$!
sleep 5

# Check defaults
curl -s http://localhost:8000/health | jq .

# Verify defaults
# PORT should default to 8000
curl -s http://localhost:8000/health && echo "PASS: Default port 8000"

# HOST should default to 0.0.0.0 or 127.0.0.1
netstat -tlnp | grep 8000

# Set identifiable secret
export JWT_SECRET_KEY="super-secret-value-12345"
export DATABASE_URL="postgresql://user:secretpassword@localhost/db"

# Start with DEBUG logging
export LOG_LEVEL=DEBUG
python -m mcpgateway.main 2>&1 | tee /tmp/startup.log &
PID=$!
sleep 10
kill $PID

# Search for secret in logs
grep -q "super-secret-value-12345" /tmp/startup.log && \
  echo "FAIL: Secret in logs!" || \
  echo "PASS: Secret not in logs"

grep -q "secretpassword" /tmp/startup.log && \
  echo "FAIL: DB password in logs!" || \
  echo "PASS: DB password not in logs"

# Check for masking
grep -q "***" /tmp/startup.log && echo "PASS: Masking present"

# Test various boolean representations
for val in "true" "True" "TRUE" "1" "yes" "on"; do
  export AUTH_REQUIRED="$val"
  python -c "from mcpgateway.config import get_settings; print(f'{val} -> {get_settings().auth_required}')"
done

for val in "false" "False" "FALSE" "0" "no" "off" ""; do
  export AUTH_REQUIRED="$val"
  python -c "from mcpgateway.config import get_settings; print(f'{val} -> {get_settings().auth_required}')" 2>/dev/null || echo "$val -> error"
done

# Test invalid URLs
export DATABASE_URL="not-a-valid-url"
python -m mcpgateway.main 2>&1 | head -20

export DATABASE_URL="postgresql://missing-host"
python -m mcpgateway.main 2>&1 | head -20

export DATABASE_URL="mysql://unsupported"
python -m mcpgateway.main 2>&1 | head -20

# Extract all env vars from code
grep -r "os.getenv\|os.environ\|settings\." mcpgateway/ | \
  grep -oE '[A-Z_]{3,}' | sort -u > /tmp/code_vars.txt

# Extract vars from .env.example
grep -E "^[A-Z]" .env.example | cut -d= -f1 | sort -u > /tmp/example_vars.txt

# Compare
diff /tmp/code_vars.txt /tmp/example_vars.txt

# Check each .env.example var has description
while read var; do
  grep -B1 "^$var=" .env.example | grep -q "#" && \
    echo "PASS: $var has description" || \
    echo "WARN: $var missing description"
done < /tmp/example_vars.txt