#!/usr/bin/env bash
# Backend options and an install_env can carry secrets under any name or shape. They are
# never written to a snapshot; prune keeps every installation of such a tool instead.
export MISE_EXPERIMENTAL=1
export MISE_INSTALL_LAYOUT=identity

mkdir -p project elsewhere
echo '[tools]
dummy = { version = "{{env.PRUNE_VERSION}}", install_env = { API_TOKEN = "{{env.SECRET}}" } }' >project/mise.toml
assert "PRUNE_VERSION=1.0.0 SECRET=hunter2-s3cret mise -C project install"
assert "mise install dummy@3.0.0"

assert_not_contains "cat $MISE_DATA_DIR/installs/.mise/snapshots/*.toml" "hunter2-s3cret"
assert_not_contains "cat $MISE_DATA_DIR/installs/.mise/snapshots/*.toml" "API_TOKEN"
assert "mise -C elsewhere ls --prunable --json >prunable.json"
assert "jq -e 'has(\"dummy\") | not' prunable.json"
assert "stat -c %a $MISE_DATA_DIR/installs/.mise/snapshots/*.toml" "600"
assert "stat -c %a $MISE_DATA_DIR/installs/.mise/snapshots" "700"

# A secret under a name nothing would flag, nested in a table, is kept out too.
mkdir -p other
cat >other/mise.toml <<'EOT'
[tools]
tiny = { version = "{{env.PRUNE_VERSION}}", headers = { Authorization = "Bearer s3cret-header-value" }, api_key = "k3y-value" }
EOT
assert "PRUNE_VERSION=2.0.0 mise -C other install"
assert_not_contains "cat $MISE_DATA_DIR/installs/.mise/snapshots/*.toml" "s3cret-header-value"
assert_not_contains "cat $MISE_DATA_DIR/installs/.mise/snapshots/*.toml" "k3y-value"
