import { assert, assertEquals, assertRejects, assertThrows } from "@std/assert";
import { writeFile } from "node:fs/promises";
import { dirname, join } from "node:path";
import { piAuthStore, resolveConfigValue } from "./auth.ts";
import { tempDir } from "@berry/util";

async function store(run: (path: string) => Promise<void>) {
  await using temporary = await tempDir({ prefix: "berry-auth-" });
  const dir = temporary.path;
  await run(join(dir, "auth.json"));
}

Deno.test("reads see what another process wrote, and what this one modified", () =>
  store(async (path) => {
    const auth = piAuthStore(path);
    assertEquals(await auth.list(), []);
    // pi, writing the file itself
    await writeFile(path, JSON.stringify({ a: { type: "api_key", key: "from pi" } }, null, 2));
    assertEquals(await auth.read("a"), { type: "api_key", key: "from pi" });

    await auth.modify("b", () => Promise.resolve({ type: "api_key", key: "from berry" }));
    assertEquals(await auth.list(), [{ providerId: "a", type: "api_key" }, {
      providerId: "b",
      type: "api_key",
    }]);
    await auth.delete("a");
    assertEquals(await auth.read("a"), undefined);
    assertEquals(await piAuthStore(path).read("b"), { type: "api_key", key: "from berry" });
  }));

Deno.test("command-based API keys fail without executing their command", () =>
  store(async (path) => {
    const marker = join(dirname(path), "command-ran");
    const command = `!touch ${JSON.stringify(marker)}`;
    await writeFile(path, JSON.stringify({ a: { type: "api_key", key: command } }));
    const auth = piAuthStore(path);
    const error = await assertRejects(
      () => auth.read("a"),
      Error,
      "Command-based API keys are disabled",
    );
    assert(!error.message.includes(command));
    await assertRejects(() => Deno.stat(marker), Deno.errors.NotFound);
    await auth.modify("a", () => Promise.resolve({ type: "api_key", key: "literal" }));
    assertEquals(await auth.read("a"), { type: "api_key", key: "literal" });
  }));

Deno.test("config values reject command syntax and keep literal and environment forms", () => {
  for (const config of ["!", "!echo secret", "!false"]) {
    assertThrows(() => resolveConfigValue(config), Error, "Command-based API keys are disabled");
  }
  assertEquals(resolveConfigValue("literal"), "literal");
  assertEquals(resolveConfigValue("$TOKEN", { TOKEN: "secret" }), "secret");
  assertEquals(resolveConfigValue("prefix-${TOKEN}", { TOKEN: "secret" }), "prefix-secret");
  assertEquals(resolveConfigValue("$$literal"), "$literal");
  assertEquals(resolveConfigValue("$!literal"), "!literal");
  assertEquals(resolveConfigValue("$TOKEN", { TOKEN: "!literal" }), "!literal");
  const missing = `BERRY_AUTH_TEST_${crypto.randomUUID().replaceAll("-", "_")}`;
  assertEquals(resolveConfigValue(`$${missing}`), undefined);
});

Deno.test("the auth store still resolves API keys from configured environment values", () =>
  store(async (path) => {
    const credential = { type: "api_key" as const, key: "${TOKEN}", env: { TOKEN: "secret" } };
    await writeFile(path, JSON.stringify({ a: credential }));
    assertEquals(await piAuthStore(path).read("a"), { ...credential, key: "secret" });
  }));