use assert_cmd::prelude::*;
use std::process::Command;

fn relicario(dir: &tempfile::TempDir) -> Command {
    let mut cmd = Command::cargo_bin("relicario").unwrap();
    cmd.current_dir(dir.path());
    cmd
}

/// Full round-trip: init a vault with a key file, then add + get an item using
/// RELICARIO_KEYFILE.
#[test]
fn init_keyfile_then_unlock_keyfile_round_trips() {
    let dir = tempfile::tempdir().unwrap();

    // init with a key file
    relicario(&dir)
        .args(["init", "--key-file", "vault.relkey"])
        .env("RELICARIO_TEST_PASSPHRASE", "correct horse")
        .assert()
        .success();

    // add an item using the generated key file
    relicario(&dir)
        .args(["add", "login", "--title", "gh", "--username", "octocat", "--password", "hunter2"])
        .env("RELICARIO_TEST_PASSPHRASE", "correct horse")
        .env("RELICARIO_KEYFILE", dir.path().join("vault.relkey"))
        .assert()
        .success();

    // get the item — distinctive username must appear in stdout
    relicario(&dir)
        .args(["get", "gh", "--show"])
        .env("RELICARIO_TEST_PASSPHRASE", "correct horse")
        .env("RELICARIO_KEYFILE", dir.path().join("vault.relkey"))
        .assert()
        .success()
        .stdout(predicates::str::contains("octocat"));
}

/// Unit-level: init with --key-file writes the .relkey armor, records
/// second_factor=keyfile in params.json, and gitignores the key file.
#[test]
fn init_keyfile_writes_relkey_and_keyfile_params() {
    let dir = tempfile::tempdir().unwrap();
    relicario(&dir)
        .args(["init", "--key-file", "vault.relkey"])
        .env("RELICARIO_TEST_PASSPHRASE", "correct horse")
        .assert()
        .success();

    // .relkey exists and is armored
    let relkey = std::fs::read_to_string(dir.path().join("vault.relkey")).unwrap();
    assert!(
        relkey.starts_with("relicario-keyfile-v1\n"),
        "relkey must be armored: {relkey}"
    );

    // params.json records the keyfile hint (parse — robust to pretty-print spacing)
    let params: serde_json::Value = serde_json::from_str(
        &std::fs::read_to_string(dir.path().join(".relicario/params.json")).unwrap(),
    )
    .unwrap();
    assert_eq!(params["second_factor"], "keyfile");

    // SECURITY: the in-the-clear .relkey must be gitignored
    let gitignore = std::fs::read_to_string(dir.path().join(".gitignore")).unwrap();
    assert!(
        gitignore.contains("vault.relkey"),
        ".relkey must be gitignored: {gitignore}"
    );
}