package secret

import (
	"encoding/base64"
	"os"
	"path/filepath"
	"testing"
)

func TestKeyringWrapRoundTrip(t *testing.T) {
	k, err := NewKeyring(randBytes(32))
	if err != nil {
		t.Fatal(err)
	}
	wrapped, err := k.Wrap("vault-1", "the-vault-password")
	if err != nil {
		t.Fatal(err)
	}
	if wrapped == "the-vault-password" {
		t.Fatal("the secret was stored in the clear")
	}
	got, err := k.Unwrap("vault-1", wrapped)
	if err != nil || got != "the-vault-password" {
		t.Fatalf("unwrap = %q, %v", got, err)
	}
}

func TestWrappedSecretIsBoundToItsVault(t *testing.T) {
	k, _ := NewKeyring(randBytes(32))
	wrapped, _ := k.Wrap("vault-1", "secret")
	if _, err := k.Unwrap("vault-2", wrapped); err == nil {
		t.Fatal("a secret wrapped for one vault opened under another id")
	}
}

func TestAnotherMasterKeyCannotUnwrap(t *testing.T) {
	a, _ := NewKeyring(randBytes(32))
	b, _ := NewKeyring(randBytes(32))
	wrapped, _ := a.Wrap("v", "secret")
	if _, err := b.Unwrap("v", wrapped); err == nil {
		t.Fatal("a different master key opened the secret")
	}
}

func TestLoadKeyringCreatesThenReusesTheKeyFile(t *testing.T) {
	t.Setenv(MasterKeyEnv, "")
	path := filepath.Join(t.TempDir(), "keys", "master.key")
	first, err := LoadKeyring(path)
	if err != nil {
		t.Fatal(err)
	}
	fi, err := os.Stat(path)
	if err != nil {
		t.Fatal(err)
	}
	if fi.Mode().Perm() != 0o600 {
		t.Fatalf("master key file mode = %v", fi.Mode().Perm())
	}
	wrapped, _ := first.Wrap("v", "secret")
	second, err := LoadKeyring(path)
	if err != nil {
		t.Fatal(err)
	}
	if got, err := second.Unwrap("v", wrapped); err != nil || got != "secret" {
		t.Fatalf("reloaded keyring: %q, %v", got, err)
	}
}

func TestLoadKeyringPrefersTheEnvironment(t *testing.T) {
	key := randBytes(32)
	t.Setenv(MasterKeyEnv, base64.StdEncoding.EncodeToString(key))
	path := filepath.Join(t.TempDir(), "master.key")
	k, err := LoadKeyring(path)
	if err != nil {
		t.Fatal(err)
	}
	if _, err := os.Stat(path); !os.IsNotExist(err) {
		t.Fatal("a key file was written although the environment supplied the key")
	}
	direct, _ := NewKeyring(key)
	wrapped, _ := direct.Wrap("v", "secret")
	if got, _ := k.Unwrap("v", wrapped); got != "secret" {
		t.Fatal("the environment key was not the one used")
	}
}

func TestLoadKeyringRejectsAShortKey(t *testing.T) {
	t.Setenv(MasterKeyEnv, base64.StdEncoding.EncodeToString([]byte("too short")))
	if _, err := LoadKeyring(""); err == nil {
		t.Fatal("a short master key was accepted")
	}
}