// A password, a token or an API key is the vault's, never a setting (novox/hq issue 342): a value for it in
// the settings file the mesh merges is ignored, the vault's is used, and that is said once, by the key alone.
// Run against the compiled module, the way the runtime loads it.

import { test, mock } from "node:test";
import assert from "node:assert/strict";
import { mkdtempSync, writeFileSync } from "node:fs";
import { tmpdir } from "node:os";
import { join } from "node:path";

import { GiteaClient } from "../dist/client.js";
import { ConfiguredToken, MintedToken } from "../dist/token.js";

const SETTING = "one-a-setting-carried";
const VAULT = "the-vault-made-this";

function delivered(settings: Record<string, string>): Record<string, string> {
  const dir = mkdtempSync(join(tmpdir(), "gitea-342-"));
  writeFileSync(join(dir, "config.json"), JSON.stringify(settings));
  writeFileSync(join(dir, "vault.secret"), VAULT + "\n");
  return { dir, config: join(dir, "config.json"), vault: join(dir, "vault.secret") };
}

test("the vault's token is used, a setting of it is ignored and said once, without its value", () => {
  const said: string[] = [];
  const err = mock.method(console, "error", (...args: unknown[]) => { said.push(args.join(" ")); });
  try {
    const at = delivered({ token: SETTING });
    const env = { MESH_GITEA_CONFIG_FILE: at.config, MESH_GITEA_URL: "http://127.0.0.1:1", MESH_GITEA_ADMIN_USER: "mesh-admin", MESH_GITEA_ADMIN_PASSWORD_FILE: at.vault, MESH_GITEA_STATE_DIR: at.dir };
    const first = GiteaClient.fromEnv(env);
    const second = GiteaClient.fromEnv(env);
    // No token from the setting: the module mints its own with the vault's admin account.
    assert.ok((first as any).tokens instanceof MintedToken);
    assert.ok((second as any).tokens instanceof MintedToken);
    assert.ok(!((first as any).tokens instanceof ConfiguredToken));
    assert.deepEqual(said, ["the setting token is ignored: it comes from the vault"]);
    assert.ok(!said.join("\n").includes(SETTING), "the setting's value is never said");
  } finally {
    err.mock.restore();
  }
});