package cmd

import (
	"errors"
	"strings"
	"testing"

	"github.com/Pingu-Studio/MaidnCLI/internal/config"
)

func TestCreateForgejoRegistryTokenRequiresConfig(t *testing.T) {
	originalConfigPath, originalCreate := bootstrapConfigPath, bootstrapCreateForgejoRegistryToken
	defer func() {
		bootstrapConfigPath = originalConfigPath
		bootstrapCreateForgejoRegistryToken = originalCreate
	}()
	bootstrapConfigPath = ""
	bootstrapCreateForgejoRegistryToken = true
	if err := runBootstrap(nil, nil); err == nil {
		t.Fatal("--create-forgejo-registry-token accepted a missing --config")
	}
}

func TestSeedForgejoOperationalCredentialsUsesEncryptedUpsertBoundary(t *testing.T) {
	original := upsertOperationalSecret
	t.Cleanup(func() { upsertOperationalSecret = original })
	cfg := config.Config{
		Git:  config.GitConfig{Username: "webhook-bot", Token: "test-pat"},
		SOPS: config.SOPSConfig{OperationalSecretsPath: "secrets.sops.yaml", AgeKeyPath: "age-key.txt"},
	}
	type call struct{ path, key, value string }
	var calls []call
	upsertOperationalSecret = func(secretsPath, ageKeyPath, path, key, value string) error {
		if secretsPath != cfg.SOPS.OperationalSecretsPath || ageKeyPath != cfg.SOPS.AgeKeyPath {
			t.Fatal("credential upsert used unexpected secret paths")
		}
		calls = append(calls, call{path, key, value})
		return nil
	}

	if err := seedForgejoOperationalCredentials(cfg); err != nil {
		t.Fatal(err)
	}
	if len(calls) != 2 || calls[0] != (call{"cicd/forgejo", "username", cfg.Git.Username}) || calls[1] != (call{"cicd/forgejo", "token", cfg.Git.Token}) {
		t.Fatal("configured Forgejo credentials were not passed only to the encrypted upsert boundary")
	}
}

func TestSeedForgejoOperationalCredentialsHidesTokenOnUpsertFailure(t *testing.T) {
	original := upsertOperationalSecret
	t.Cleanup(func() { upsertOperationalSecret = original })
	cfg := config.Config{Git: config.GitConfig{Username: "webhook-bot", Token: "test-pat"}}
	upsertOperationalSecret = func(_, _, _, key, _ string) error {
		if key == "token" {
			return errors.New("unavailable")
		}
		return nil
	}

	err := seedForgejoOperationalCredentials(cfg)
	if err == nil || !strings.Contains(err.Error(), "save Forgejo token for webhook registration") || strings.Contains(err.Error(), cfg.Git.Token) {
		t.Fatal("credential upsert failure was not clear and token-safe")
	}
}