#!/usr/bin/env bash

# A task that lists secrets is no longer inert config: its file needs trust.

export MISE_TRUSTED_CONFIG_PATHS=""
unset CI GITHUB_ACTIONS GITHUB_ACTION 2>/dev/null || true

assert_no_trust_marker() {
  local found
  found=$(find "$MISE_STATE_DIR/trusted-configs" -mindepth 1 \( -type f -o -type l \) 2>/dev/null || true)
  [[ -z $found ]] || fail "$1 (found trust markers: $found)"
}

mkdir -p project
cd project || exit 1

cat >mise.toml <<'TOML'
[tasks.hi]
run = "echo hi"
TOML
assert_contains "MISE_YES=0 mise tasks ls" "hi"
assert_no_trust_marker "a tasks-only config is safe"

cat >mise.toml <<'TOML'
[tasks.hi]
run = "echo hi"
secrets = ["DEPLOY_KEY"]
TOML
output=$(MISE_YES=0 mise tasks ls 2>&1 || true)
grep -q "not trusted" <<<"$output" || fail "expected a trust error, got: $output"
assert_no_trust_marker "a task that lists secrets must not be trusted silently"

# a file task include whose header lists secrets
cat >mise.toml <<'TOML'
min_version = "2024.1.1"
TOML
mkdir -p mise-tasks
printf '#!/usr/bin/env bash\n#MISE description="plain"\necho hi\n' >mise-tasks/ft
chmod +x mise-tasks/ft
assert_contains "MISE_YES=0 mise tasks ls" "ft"
printf '#!/usr/bin/env bash\n#MISE "secrets"=["DEPLOY_KEY"]\necho hi\n' >mise-tasks/ft
output=$(MISE_YES=0 mise tasks ls 2>&1 || true)
grep -q "not trusted" <<<"$output" || fail "expected a trust error for the include, got: $output"
assert_no_trust_marker "an included task that lists secrets must not be trusted silently"
