package main

import (
	"os"
	"path/filepath"
	"testing"
)

// A file has a trailing newline and a password does not.
//
// The failure this prevents is the worst kind to diagnose: the credential is delivered, the
// machine applies it, everything reports success, and authentication fails one byte from correct
// somewhere else entirely.
func TestATrailingNewlineIsNotPartOfTheSecret(t *testing.T) {
	dir := t.TempDir()
	path := filepath.Join(dir, "password")
	if err := os.WriteFile(path, []byte("the-database-password\n"), 0o600); err != nil {
		t.Fatal(err)
	}
	got, err := valueFor("anchor", "umami", "database", path)
	if err != nil {
		t.Fatal(err)
	}
	if asSupplied(got) != "the-database-password" {
		t.Fatalf("read %q", got)
	}
}

// A password may contain spaces, and they are the operator's.
//
// Trimming both ends is the obvious thing and it is wrong: a value chosen with a leading space is
// a value the mesh would silently deliver as a different one.
func TestOnlyLineEndingsAreRemoved(t *testing.T) {
	dir := t.TempDir()
	path := filepath.Join(dir, "password")
	if err := os.WriteFile(path, []byte("  spaces matter  \n"), 0o600); err != nil {
		t.Fatal(err)
	}
	got, err := valueFor("anchor", "umami", "database", path)
	if err != nil {
		t.Fatal(err)
	}
	if asSupplied(got) != "  spaces matter  " {
		t.Fatalf("the value was altered beyond its line ending: %q", got)
	}
}

// A file that is not there is said plainly, rather than becoming an empty secret.
func TestAMissingFileIsRefused(t *testing.T) {
	if _, err := valueFor("anchor", "umami", "database",
		filepath.Join(t.TempDir(), "absent")); err == nil {
		t.Fatal("a missing file produced a value")
	}
}

// The command refuses what it cannot act on, rather than acting on part of it.
func TestTheArgumentsAreRequired(t *testing.T) {
	for _, args := range [][]string{
		{},
		{"accept"},
		{"accept", "anchor"},
		{"accept", "anchor", "umami"},
		{"give", "anchor", "umami", "database"},
	} {
		if err := secretCommand(t.Context(), args); err == nil {
			t.Errorf("%v was accepted", args)
		}
	}
}