package backup

import (
	"context"
	"os"
	"path/filepath"
	"strings"
	"testing"
)

func TestSensitiveArchiveKeysAreRejected(t *testing.T) {
	for _, raw := range []string{`{"before_diff":{"api_token":"value"}}`, `{"configuration":{"password":"value"}}`, `{"authorization":"Bearer value"}`} {
		if !containsSensitiveKey([]byte(raw)) {
			t.Fatalf("sensitive key was not detected in %s", raw)
		}
	}
	if containsSensitiveKey([]byte(`{"display_name":"Pulse","configuration_ref":"source/ref"}`)) {
		t.Fatal("safe reference fields were rejected")
	}
}

func TestManagerListReturnsEmptyForMissingDirectory(t *testing.T) {
	directory := filepath.Join(t.TempDir(), "backups")
	results, err := (Manager{Directory: directory}).List(context.Background())
	if err != nil {
		t.Fatal(err)
	}
	if len(results) != 0 {
		t.Fatalf("results = %d, want 0", len(results))
	}
}

func TestManagerCreateRequiresConfiguredPoolAndDirectory(t *testing.T) {
	if _, err := (Manager{}).Create(context.Background()); err != ErrNotConfigured {
		t.Fatalf("error = %v, want ErrNotConfigured", err)
	}
}

func TestPruneKeepsConfiguredRetentionAndSidecars(t *testing.T) {
	directory := t.TempDir()
	for _, name := range []string{"pulse-backup-00000001.zip", "pulse-backup-00000002.zip", "pulse-backup-00000003.zip"} {
		if err := os.WriteFile(filepath.Join(directory, name), []byte(name), 0o600); err != nil {
			t.Fatal(err)
		}
		if err := os.WriteFile(filepath.Join(directory, name+".sha256"), []byte("checksum"), 0o600); err != nil {
			t.Fatal(err)
		}
	}
	if err := (Manager{Directory: directory, Retention: 2}).prune(context.Background(), filepath.Join(directory, "pulse-backup-00000003.zip")); err != nil {
		t.Fatal(err)
	}
	if _, err := os.Stat(filepath.Join(directory, "pulse-backup-00000001.zip")); !os.IsNotExist(err) {
		t.Fatalf("old backup still exists: %v", err)
	}
	if _, err := os.Stat(filepath.Join(directory, "pulse-backup-00000001.zip.sha256")); !os.IsNotExist(err) {
		t.Fatalf("old sidecar still exists: %v", err)
	}
	if strings.TrimSpace(string(mustRead(t, filepath.Join(directory, "pulse-backup-00000003.zip.sha256")))) != "checksum" {
		t.Fatal("kept sidecar was changed")
	}
}

func mustRead(t *testing.T, path string) []byte {
	t.Helper()
	value, err := os.ReadFile(path)
	if err != nil {
		t.Fatal(err)
	}
	return value
}