#!/usr/bin/env bash

if [[ "$(uname -s)" != "Linux" ]] || ! sudo -n true 2>/dev/null; then
  echo "skipping: bootstrap secret file tests require Linux and passwordless sudo"
  exit 0
fi

secret_value="mise-bootstrap-secret-7f9d3a"
secret_env="MISE_BOOTSTRAP_TEST_SECRET"
managed_file="$PWD/secret.conf"
static_file="$PWD/static.conf"
static_dir="$PWD/static-dir"
managed_owner="$(id -un)"
managed_group="$(id -gn)"

unset "$secret_env"
cat <<EOF >mise.toml
[bootstrap.secrets]
cache_token = { env = "$secret_env", description = "Cache token" }

[bootstrap.files."$managed_file"]
content = 'token={{ secret(name="cache_token") }}'
template = true
owner = "$managed_owner"
group = "$managed_group"
mode = "0600"

[bootstrap.files."$static_file"]
content = "static"
owner = "$managed_owner"
group = "$managed_group"

[bootstrap.directories."$static_dir"]
owner = "$managed_owner"
group = "$managed_group"
EOF

# Missing inputs fail before the target is changed, while status remains safe.
assert_fail "mise bootstrap files apply --yes" "required bootstrap secrets are unavailable"
assert_fail "mise bootstrap --dry-run" "required bootstrap secrets are unavailable"
assert_fail "test -e $managed_file"
assert_contains "mise bootstrap secrets status" "missing"
assert_contains "mise bootstrap secrets status --json" "\"env\": \"$secret_env\""
assert_contains "mise bootstrap status" "missing"
assert_contains "mise bootstrap status" "$managed_file"
assert_contains "mise bootstrap status" "$static_file"
assert_contains "mise bootstrap status" "$static_dir"
assert_contains "mise bootstrap status" "unknown"
assert_fail "mise bootstrap status --missing"
assert_contains "mise bootstrap files status" "$managed_file"
assert_contains "mise bootstrap files status" "$static_file"
assert_contains "mise bootstrap files status" "$static_dir"
assert_contains "mise bootstrap files status" "unknown"
assert_fail "mise bootstrap files status --missing"
assert_contains "mise bootstrap plan" "$managed_file"
assert_contains "mise bootstrap plan" "$static_file"
assert_contains "mise bootstrap plan" "$static_dir"
assert_contains "mise bootstrap plan" "unknown"
assert_fail "mise bootstrap plan --detailed-exitcode"
assert_succeed "mise bootstrap --only repos --dry-run"

# Plans, dry runs, and status expose only logical names and availability.
assert_contains "$secret_env=$secret_value mise bootstrap secrets status" "available"
assert_not_contains "$secret_env=$secret_value mise bootstrap secrets status --json" "$secret_value"
assert_not_contains "$secret_env=$secret_value mise bootstrap plan 2>&1" "$secret_value"
assert_not_contains "$secret_env=$secret_value mise bootstrap files apply --dry-run --yes 2>&1" "$secret_value"

assert_succeed "$secret_env=$secret_value mise bootstrap files apply --yes"
assert "cat $managed_file" "token=$secret_value"
assert_succeed "$secret_env=$secret_value mise bootstrap files status --missing"

# Template rendering is opt-in; literal template syntax is otherwise preserved.
cat <<EOF >mise.toml
[bootstrap.files."$managed_file"]
content = '{{ secret(name="not_declared") }}'
owner = "$managed_owner"
group = "$managed_group"
mode = "0600"
EOF
assert_succeed "mise bootstrap files apply --yes"
assert "cat $managed_file" '{{ secret(name="not_declared") }}'

cat <<EOF >mise.toml
[bootstrap.files."$managed_file"]
state = "absent"
EOF
assert_succeed "mise bootstrap files apply --yes"
assert_fail "test -e $managed_file"

# Declared inputs are required only when a selected template consumes them.
unused_secret_env="MISE_BOOTSTRAP_UNUSED_SECRET"
unset "$unused_secret_env"
cat <<EOF >mise.toml
[bootstrap.secrets]
cache_token = "$secret_env"
unused_token = "$unused_secret_env"

[bootstrap.files."$managed_file"]
content = 'token={{ secret(name="cache_token") }}'
template = true
owner = "$managed_owner"
group = "$managed_group"
mode = "0600"
EOF
assert_succeed "$secret_env=$secret_value mise bootstrap files apply --yes"
assert "cat $managed_file" "token=$secret_value"
assert_contains "$secret_env=$secret_value mise bootstrap status" "$managed_file"
assert_not_contains "$secret_env=$secret_value mise bootstrap status" "unused_token"
assert_succeed "$secret_env=$secret_value mise bootstrap status --missing"
assert_fail "$secret_env=$secret_value mise bootstrap secrets status --missing" "unused_token"
