// A password, a token or an API key is the vault's, never a setting (novox/hq issue 342): a value for it in
// the settings file the mesh merges is ignored, the vault's is used, and that is said once, by the key alone.
// Run against the compiled module, the way the runtime loads it.

import { test, mock } from "node:test";
import assert from "node:assert/strict";
import { mkdtempSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";

import { NextcloudClient } from "../dist/client.js";

const SETTING = "one-a-setting-carried";
const VAULT = "the-vault-made-this";

function delivered(settings: Record<string, string>): Record<string, string> {
  const dir = mkdtempSync(join(tmpdir(), "nextcloud-342-"));
  writeFileSync(join(dir, "config.json"), JSON.stringify(settings));
  writeFileSync(join(dir, "vault.secret"), VAULT + "\n");
  return { dir, config: join(dir, "config.json"), vault: join(dir, "vault.secret") };
}

test("the vault's password is used, a setting of it is ignored and said once, without its value", () => {
  const said: string[] = [];
  const err = mock.method(console, "error", (...args: unknown[]) => { said.push(args.join(" ")); });
  try {
    const at = delivered({ password: SETTING });
    const env = { MESH_NEXTCLOUD_CONFIG_FILE: at.config, MESH_NEXTCLOUD_ADMIN_PASSWORD_FILE: at.vault };
    const first = NextcloudClient.fromEnv(env);
    const second = NextcloudClient.fromEnv(env);
    assert.equal((first as any).adminPassword, VAULT);
    assert.equal((second as any).adminPassword, VAULT);
    assert.deepEqual(said, ["the setting password is ignored: it comes from the vault"]);
    assert.ok(!said.join("\n").includes(SETTING), "the setting's value is never said");
  } finally {
    err.mock.restore();
  }
});