package secrets

import (
	"errors"
	"os"
	"path/filepath"
	"testing"

	secretcontracts "git.cin.su/m/Assistant/contracts/secrets"
)

func TestFileResolverResolvesSecretInsideRoot(t *testing.T) {
	root := t.TempDir()
	path := filepath.Join(root, "interaction_db_password")
	if err := os.WriteFile(path, []byte("strong-secret\n"), 0o600); err != nil {
		t.Fatal(err)
	}

	resolver, err := NewFileResolver(root)
	if err != nil {
		t.Fatal(err)
	}
	got, err := resolver.ResolveFile(secretcontracts.SecretFileRef{
		CredentialRef: "credential://domovoy/interaction/db-password/v1",
		Purpose:       secretcontracts.SecretPurposeDatabasePassword,
		Consumer:      secretcontracts.RuntimeConsumerCore,
		Path:          path,
	})
	if err != nil {
		t.Fatal(err)
	}
	if got != "strong-secret" {
		t.Fatalf("unexpected secret value")
	}
}

func TestFileResolverRejectsPathOutsideRoot(t *testing.T) {
	root := t.TempDir()
	outside := filepath.Join(t.TempDir(), "secret")
	if err := os.WriteFile(outside, []byte("secret"), 0o600); err != nil {
		t.Fatal(err)
	}

	resolver, err := NewFileResolver(root)
	if err != nil {
		t.Fatal(err)
	}
	_, err = resolver.ResolveFile(secretcontracts.SecretFileRef{
		CredentialRef: "credential://domovoy/interaction/db-password/v1",
		Purpose:       secretcontracts.SecretPurposeDatabasePassword,
		Consumer:      secretcontracts.RuntimeConsumerCore,
		Path:          outside,
	})
	if !errors.Is(err, ErrPathOutsideRoot) {
		t.Fatalf("expected ErrPathOutsideRoot, got %v", err)
	}
}

func TestFileResolverRejectsEmptyCredentialRef(t *testing.T) {
	root := t.TempDir()
	path := filepath.Join(root, "secret")
	if err := os.WriteFile(path, []byte("secret"), 0o600); err != nil {
		t.Fatal(err)
	}

	resolver, err := NewFileResolver(root)
	if err != nil {
		t.Fatal(err)
	}
	_, err = resolver.ResolveFile(secretcontracts.SecretFileRef{
		Purpose:  secretcontracts.SecretPurposeDatabasePassword,
		Consumer: secretcontracts.RuntimeConsumerCore,
		Path:     path,
	})
	if !errors.Is(err, ErrEmptyCredentialRef) {
		t.Fatalf("expected ErrEmptyCredentialRef, got %v", err)
	}
}