import { describe, expect, it } from "vitest";
import { assertEnvVarPolicy, resolveTemplate } from "../src/envtemplate.js";

describe("resolveTemplate", () => {
  it("classifies literals as non-secret and ${…} as secret", () => {
    const r = resolveTemplate(
      "PORT=3000\nMAILGUN_KEY=${MAILGUN_KEY}\n# comment\n\n",
      {
        MAILGUN_KEY: "mk-123",
      },
    );
    expect(r.vars.PORT).toEqual({ value: "3000", secret: false });
    expect(r.vars.MAILGUN_KEY).toEqual({ value: "mk-123", secret: true });
  });
  it("throws on a missing secret, naming key and placeholder", () => {
    expect(() => resolveTemplate("API_KEY=${NOPE}", {})).toThrow(
      /NOPE.*API_KEY|API_KEY.*NOPE/,
    );
  });
  it("throws on malformed lines with the line number", () => {
    expect(() => resolveTemplate("PORT=3000\nnot a line", {})).toThrow(
      /line 2/,
    );
  });
});

describe("assertEnvVarPolicy", () => {
  const withFlag = { vars: { ALLOW_SEED: { value: "false", secret: false } } };
  const banAllow = ["^ALLOW_"];

  it("refuses when a forbidden var is PRESENT, even set false", () => {
    expect(() =>
      assertEnvVarPolicy("prod", { "core-api": withFlag }, banAllow),
    ).toThrow(/ALLOW_SEED.*core-api.*off.*absent/s);
  });
  it("allows the same env where the policy is not declared", () => {
    expect(() =>
      assertEnvVarPolicy("staging", { "core-api": withFlag }, undefined),
    ).not.toThrow();
  });
  it("is a pattern, not a fixed list — it catches unforeseen siblings", () => {
    const future = {
      vars: { ALLOW_WIPE_EVERYTHING: { value: "true", secret: false } },
    };
    expect(() =>
      assertEnvVarPolicy("prod", { worker: future }, banAllow),
    ).toThrow(/ALLOW_WIPE_EVERYTHING/);
  });
  it("leaves vars that do not match the pattern alone", () => {
    const ok = { vars: { PORT: { value: "3000", secret: false } } };
    expect(() =>
      assertEnvVarPolicy("prod", { "core-api": ok }, banAllow),
    ).not.toThrow();
  });
});