package main

import (
	"os"
	"path/filepath"
	"testing"
)

func manifest(t *testing.T, root, module, resources string) {
	t.Helper()
	dir := filepath.Join(root, "modules", module)
	if err := os.MkdirAll(dir, 0o755); err != nil {
		t.Fatal(err)
	}
	body := `{"module":"` + module + `","resources":[` + resources + `]}`
	if err := os.WriteFile(filepath.Join(dir, "module.json"), []byte(body), 0o644); err != nil {
		t.Fatal(err)
	}
}

func TestASecretASettingCouldReplaceIsRefused(t *testing.T) {
	root := t.TempDir()
	// Refused: the key holds the vault's secret and nothing keeps a layer off it.
	manifest(t, root, "a", `{"id":"cfg","type":"file","merge":"json","content":"{\"password\": \"${secret:admin}\"}"}`)
	// Refused: nested below a key the file takes.
	manifest(t, root, "b", `{"id":"cfg","type":"file","merge":"json","takes-settings":["server"],`+
		`"content":"{\"server\": {\"secret_key\": \"${secret:s}\", \"port\": 1}}"}`)
	// Kept: protected.
	manifest(t, root, "c", `{"id":"cfg","type":"file","merge":"json","protected":["password"],`+
		`"content":"{\"password\": \"${secret:admin}\", \"user\": \"admin\"}"}`)
	// Kept: the file names its keys, and not this one.
	manifest(t, root, "d", `{"id":"cfg","type":"file","merge":"json","takes-settings":["ui"],`+
		`"content":"{\"token\": \"${secret:t}\", \"ui\": {}}"}`)
	// Kept: a file that does not merge takes no setting.
	manifest(t, root, "e", `{"id":"cfg","type":"file","content":"{\"token\": \"${secret:t}\"}"}`)
	// Refused: protecting another key does not protect this one; a list element counts too.
	manifest(t, root, "f", `{"id":"cfg","type":"file","merge":"json","protected":["user"],`+
		`"content":"{\"users\": [{\"password\": \"${secret:p}\"}]}"}`)
	found, err := Check(root)
	if err != nil {
		t.Fatal(err)
	}
	want := []string{"a cfg password", "b cfg server.secret_key", "f cfg users[0].password"}
	if len(found) != len(want) {
		t.Fatalf("found %v, want %v", found, want)
	}
	for i, f := range found {
		if f.String() != want[i] {
			t.Fatalf("found %v, want %v", found, want)
		}
	}
}

func TestTheKnownListOnlyShrinks(t *testing.T) {
	found := []Finding{{"b", "cfg", "server.secret_key"}, {"a", "cfg", "password"}}
	refused, stale := Judge(found, map[string]bool{"b cfg server.secret_key": true, "gone cfg token": true})
	if len(refused) != 1 || refused[0].String() != "a cfg password" {
		t.Fatalf("refused %v", refused)
	}
	if len(stale) != 1 || stale[0] != "gone cfg token" {
		t.Fatalf("stale %v", stale)
	}
}

func TestTheCatalogueHoldsNoSecretASettingCouldReplace(t *testing.T) {
	found, err := Check("../..")
	if err != nil {
		t.Fatal(err)
	}
	known, err := Known("known")
	if err != nil {
		t.Fatal(err)
	}
	refused, stale := Judge(found, known)
	if len(refused) > 0 || len(stale) > 0 {
		t.Fatalf("refused %v, stale %v", refused, stale)
	}
}