#!/usr/bin/env bash

# Tera v1's built-in get_env() reads the live process env; mise replaces it so
# inherited secrets stay invisible to templates there too.
export MISE_TERA_V1=true __MISE_SECRET_KEYS=FOO FOO=inherited-s3cr3t-9
cat >mise.toml <<'TOML'
[env]
BAR = "{{ get_env(name='FOO', default='hidden') }}"
TOML
assert_contains "mise env -s bash" "hidden"
assert_not_contains "mise env -s bash" "inherited-s3cr3t-9"
cat >mise.toml <<'TOML'
[env]
BAR = "{{ get_env(name='FOO') }}"
TOML
assert_fail "mise env -s bash"
