package localtools_test

import (
	"context"
	"testing"

	"git.d-ma.be/mathias/gitea-mcp/internal/localtools"
	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

// The estate's own secret-handling rule: never place a literal secret in a
// command's argv — it lands in process listings and any transcript of the
// command. OpSecretStore feeds the token to `op` via stdin instead.

func TestOpSecretStore_PassesValueViaStdinNeverArgv(t *testing.T) {
	var gotStdin string
	var gotArgs []string
	s := localtools.OpSecretStore{
		Vault: "AgentSecrets",
		Run: func(_ context.Context, stdin string, args ...string) error {
			gotStdin = stdin
			gotArgs = args
			return nil
		},
	}

	ref, err := s.Store(context.Background(), "gitea-dispatch-bot-ci-readonly", "tok_the_actual_secret_value")

	require.NoError(t, err)
	assert.Equal(t, "op://AgentSecrets/gitea-dispatch-bot-ci-readonly/credential", ref)
	assert.Equal(t, "tok_the_actual_secret_value", gotStdin)
	for _, a := range gotArgs {
		assert.NotContains(t, a, "tok_the_actual_secret_value",
			"the secret value must never appear as a literal argv element")
	}
	assert.Contains(t, gotArgs, "--vault=AgentSecrets")
	assert.Contains(t, gotArgs, "--title=gitea-dispatch-bot-ci-readonly")
}

func TestOpSecretStore_PropagatesRunError(t *testing.T) {
	s := localtools.OpSecretStore{
		Vault: "AgentSecrets",
		Run: func(_ context.Context, _ string, _ ...string) error {
			return assert.AnError
		},
	}

	_, err := s.Store(context.Background(), "x", "y")

	require.Error(t, err)
}