package service

import (
	"strings"
	"testing"

	"browser.local/platform/repo"
)

func TestConfiguredSecretEnvelopeIsOpaqueAndRestartStable(t *testing.T) {
	const key = "test-secret-envelope-key-at-least-32-characters"
	const plain = "raw-component-secret"
	svc := NewCoreService(repo.NewMemoryStore())
	if err := svc.ConfigureSecretEnvelopeKey(key); err != nil {
		t.Fatalf("configure envelope: %v", err)
	}
	encrypted, err := svc.encryptRuntimeKey(plain)
	if err != nil {
		t.Fatalf("seal secret: %v", err)
	}
	if strings.Contains(encrypted, plain) || !strings.HasPrefix(encrypted, "enc:v1:") {
		t.Fatalf("unexpected envelope ciphertext %q", encrypted)
	}
	restarted := NewCoreService(repo.NewMemoryStore())
	if err := restarted.ConfigureSecretEnvelopeKey(key); err != nil {
		t.Fatalf("configure restarted envelope: %v", err)
	}
	decrypted, err := restarted.decryptRuntimeKey(encrypted)
	if err != nil || decrypted != plain {
		t.Fatalf("open restarted envelope: plain=%q err=%v", decrypted, err)
	}
	if _, err := NewCoreService(repo.NewMemoryStore()).decryptRuntimeKey(encrypted); err == nil {
		t.Fatal("development fallback must not decrypt a custom-key envelope")
	}
}

func TestSecretEnvelopeRejectsShortConfiguredKey(t *testing.T) {
	svc := NewCoreService(repo.NewMemoryStore())
	if err := svc.ConfigureSecretEnvelopeKey("too-short"); err == nil {
		t.Fatal("expected short secret envelope key rejection")
	}
}