#!/usr/bin/env bash
# shellcheck disable=SC2016
require_cmd git
origin="$PWD/secret-scan-origin.git"
git init -q --bare -b main "$origin"

printf 'alias ll=ls\n' >~/.shellrc
assert_succeed "mise dot track ~/.shellrc"
assert_succeed "mise dot origin set file://$origin --sync manual --yes"
assert_succeed "mise dot sync"
published=$(git --git-dir="$origin" rev-parse main)

# A token the file name filter cannot see blocks the sync, and its value is never printed.
printf 'alias ll=ls\nexport DEPLOY_TOKEN=abcdefghijkl1234\n' >~/.shellrc
assert_succeed "mise dot save"
assert_fail "mise dot sync 2>&1" 'line 2 of home/.shellrc'
refusal=$(mise dot sync 2>&1 || true)
[[ $refusal != *abcdefghijkl1234* ]] || fail "the refusal printed the secret"
assert "git --git-dir=$origin rev-parse main" "$published"

# Removing it from the file does not remove it from the saved versions.
printf 'alias ll=ls\n' >~/.shellrc
assert_succeed "mise dot save"
assert_fail "mise dot sync 2>&1" 'looks like a secret'
assert "git --git-dir=$origin rev-parse main" "$published"

# The existing opt-out publishes it, and then it stops blocking later syncs.
assert_succeed "mise dot sync --allow-plaintext-history"
printf 'alias ll=ls\nalias la="ls -a"\n' >~/.shellrc
assert_succeed "mise dot save"
assert_succeed "mise dot sync"
