'use strict';

const fs = require('fs');
const os = require('os');
const path = require('path');
const test = require('node:test');
const assert = require('node:assert/strict');

const {
  getSecretBackupCandidatePaths,
  getSecretBackupPath,
  readSecretBackup,
  writeSecretBackup,
} = require('../src/services/resilientSecretStore');

test('secret backup survives outside the repository with owner-only permissions', async (context) => {
  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'shujuku3-secret-test-'));
  const filePath = path.join(directory, 'secrets.json');
  const previousPath = process.env.SHUJUKU3_SECRET_STORE_PATH;
  const previousLegacyPath = process.env.SHUJUKU3_LEGACY_SECRET_STORE_PATH;
  process.env.SHUJUKU3_SECRET_STORE_PATH = filePath;
  process.env.SHUJUKU3_LEGACY_SECRET_STORE_PATH = path.join(directory, 'legacy.json');
  context.after(() => {
    if (previousPath === undefined) delete process.env.SHUJUKU3_SECRET_STORE_PATH;
    else process.env.SHUJUKU3_SECRET_STORE_PATH = previousPath;
    if (previousLegacyPath === undefined) delete process.env.SHUJUKU3_LEGACY_SECRET_STORE_PATH;
    else process.env.SHUJUKU3_LEGACY_SECRET_STORE_PATH = previousLegacyPath;
    fs.rmSync(directory, { recursive: true, force: true });
  });

  await writeSecretBackup('selection_similar_products_api_key', 'durable-test-secret');

  assert.equal(getSecretBackupPath(), filePath);
  assert.deepEqual(getSecretBackupCandidatePaths(), [filePath, path.join(directory, 'legacy.json')]);
  assert.equal(readSecretBackup('selection_similar_products_api_key'), 'durable-test-secret');
  assert.equal(fs.statSync(filePath).mode & 0o777, 0o600);
});

test('secret reader recovers from the legacy home backup when the shared file is absent', async (context) => {
  const directory = fs.mkdtempSync(path.join(os.tmpdir(), 'shujuku3-secret-legacy-test-'));
  const primaryPath = path.join(directory, 'shared', 'secrets.json');
  const legacyPath = path.join(directory, 'legacy', 'secrets.json');
  const previousPath = process.env.SHUJUKU3_SECRET_STORE_PATH;
  const previousLegacyPath = process.env.SHUJUKU3_LEGACY_SECRET_STORE_PATH;
  context.after(() => {
    if (previousPath === undefined) delete process.env.SHUJUKU3_SECRET_STORE_PATH;
    else process.env.SHUJUKU3_SECRET_STORE_PATH = previousPath;
    if (previousLegacyPath === undefined) delete process.env.SHUJUKU3_LEGACY_SECRET_STORE_PATH;
    else process.env.SHUJUKU3_LEGACY_SECRET_STORE_PATH = previousLegacyPath;
    fs.rmSync(directory, { recursive: true, force: true });
  });

  process.env.SHUJUKU3_SECRET_STORE_PATH = legacyPath;
  process.env.SHUJUKU3_LEGACY_SECRET_STORE_PATH = legacyPath;
  await writeSecretBackup('selection_similar_products_api_key', 'legacy-durable-secret');

  process.env.SHUJUKU3_SECRET_STORE_PATH = primaryPath;
  assert.equal(readSecretBackup('selection_similar_products_api_key'), 'legacy-durable-secret');
});