// A password, a token or an API key is the vault's, never a setting (novox/hq issue 342): grafana logs in
// with the vault's admin password, a `token` in the settings file is ignored, and that is said once, by the
// key alone. The runtime config keeps both keys protected, so the controller refuses a layer setting either.

import { test, mock } from "node:test";
import assert from "node:assert/strict";
import { mkdtempSync, readFileSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";

import { GrafanaClient } from "../dist/client.js";

const SETTING = "one-a-setting-carried";
const VAULT = "the-vault-made-this";

test("the vault's admin password is used, a token setting is ignored and said once, without its value", () => {
  const said: string[] = [];
  const err = mock.method(console, "error", (...args: unknown[]) => { said.push(args.join(" ")); });
  try {
    const dir = mkdtempSync(join(tmpdir(), "grafana-342-"));
    // What the runtime config holds once the vault filled it, with a token a layer carried beside it.
    writeFileSync(join(dir, "config.json"), JSON.stringify({ user: "admin", password: VAULT, token: SETTING }));
    const env = { MESH_GRAFANA_CONFIG_FILE: join(dir, "config.json") };
    const basic = "Basic " + Buffer.from(`admin:${VAULT}`).toString("base64");
    assert.equal((GrafanaClient.fromEnv(env) as any).authHeader, basic);
    assert.equal((GrafanaClient.fromEnv(env) as any).authHeader, basic);
    assert.deepEqual(said, ["the setting token is ignored: it comes from the vault"]);
    assert.ok(!said.join("\n").includes(SETTING), "the setting's value is never said");
  } finally {
    err.mock.restore();
  }
});

test("the runtime config keeps password and token protected", () => {
  const manifest = JSON.parse(readFileSync(new URL("../module.json", import.meta.url), "utf8")) as {
    resources: { id: string; protected?: string[] }[];
  };
  const runtime = manifest.resources.find((r) => r.id === "runtime-config");
  assert.deepEqual(runtime?.protected, ["password", "token"]);
});