package secure

import (
	"context"
	"encoding/base64"
	"path/filepath"
	"testing"
	"time"

	"provenance/internal/storage"
)

func TestVault(t *testing.T) {
	store, err := storage.Open(filepath.Join(t.TempDir(), "secrets.db"))
	if err != nil {
		t.Fatal(err)
	}
	defer store.Close()
	vault, err := New(store, base64.StdEncoding.EncodeToString(make([]byte, KeyBytes)))
	if err != nil {
		t.Fatal(err)
	}
	ctx := context.Background()
	if err := vault.Put(ctx, "kind", "id", []byte("private-token"), time.Now().Add(time.Hour)); err != nil {
		t.Fatal(err)
	}
	sealed, err := store.Get(ctx, "kind", "id")
	if err != nil {
		t.Fatal(err)
	}
	if string(sealed) == "private-token" {
		t.Fatal("stored plaintext")
	}
	if err := store.Put(ctx, "kind", "other", sealed, time.Now().Add(time.Hour)); err != nil {
		t.Fatal(err)
	}
	if _, err := vault.Get(ctx, "kind", "other"); err == nil {
		t.Fatal("accepted relocated ciphertext")
	}
	sealed[len(sealed)-1] ^= 1
	if err := store.Put(ctx, "kind", "id", sealed, time.Now().Add(time.Hour)); err != nil {
		t.Fatal(err)
	}
	if _, err := vault.Get(ctx, "kind", "id"); err == nil {
		t.Fatal("accepted modified ciphertext")
	}
}