#!/usr/bin/env bash

# Secret values stay out of logs, state, caches and files that outlive the task.

mkdir -p "$HOME/bin"
printf '#!/usr/bin/env bash\nexec python3 "%s" "$@"\n' "$TEST_ROOT/helpers/scripts/fnox_stub.py" >"$HOME/bin/fnox"
chmod +x "$HOME/bin/fnox"
export PATH="$HOME/bin:$PATH"
export FNOX_STUB_LOG="$PWD/fnox-calls.jsonl"

cat >mise.toml <<'TOML'
[secrets.fnox]

[tasks.deploy]
secrets = ["DEPLOY_KEY", "PEM_KEY"]
run = 'echo "key=$DEPLOY_KEY"; echo "$PEM_KEY"'

[tasks.extra]
secrets = ["DEPLOY_KEY"]
run = '''
printf %s "${EXTRA_KEY-unset}" >extra.out
if [ "${SIGNING_KEY-unset}" = signing-s3cr3t-0008 ]; then printf leaked >signing.out; else printf ok >signing.out; fi
'''

[tasks.gcp]
secrets = ["GCP_SA_JSON"]
run = '''
printf %s "$GCP_SA_JSON" >p.txt
grep -q gcp-s3cr3t-0006 "$GCP_SA_JSON" || exit 3
[ "$(stat -c %a "$GCP_SA_JSON" 2>/dev/null || stat -f %Lp "$GCP_SA_JSON")" = 600 ] || exit 4
'''

[tasks.optional]
secrets = ["OPTIONAL_TOKEN"]
run = 'printf %s "${OPTIONAL_TOKEN-unset}" >optional.out'
TOML

MISE_DEBUG=1 MISE_LOG_FILE=$PWD/log mise run deploy </dev/null >/dev/null 2>&1
assert_not_contains "cat log" "s3cr3t"
if grep -rq s3cr3t "$MISE_STATE_DIR" "$MISE_CACHE_DIR" 2>/dev/null; then fail "secret on disk"; fi

# garbage from fnox is reported without its content
assert_fail_contains "FNOX_STUB_MODE=garbage mise run deploy </dev/null" "could not parse"
assert_not_contains "FNOX_STUB_MODE=garbage mise run deploy </dev/null 2>&1 || true" "s3cr3t"

# keys fnox was not asked for are dropped
assert_contains "FNOX_STUB_MODE=extra mise run extra </dev/null 2>&1" "were not requested"
assert "cat extra.out" "unset"
assert "cat signing.out" "ok"

# file secrets are private and removed
assert_succeed "mise run gcp </dev/null"
# shellcheck disable=SC2016
assert_fail 'test -e "$(cat p.txt)"'

# a key with no value is left unset
assert_succeed "mise run optional </dev/null"
assert "cat optional.out" "unset"
