package app

import (
	"bytes"
	"encoding/json"
	"testing"

	"github.com/stretchr/testify/require"
)

func TestProviderAppConfigSecretDecryptFallsBackToLegacyKey(t *testing.T) {
	t.Parallel()

	primaryKey := bytes.Repeat([]byte{1}, 32)
	legacyKey := bytes.Repeat([]byte{2}, 32)
	ciphertext, err := EncryptCredential(legacyKey, "legacy-secret")
	require.NoError(t, err)

	stored, err := json.Marshal(struct {
		Storage    string `json:"_storage"`
		Ciphertext string `json:"ciphertext"`
	}{
		Storage:    appCredentialStorageScheme,
		Ciphertext: ciphertext,
	})
	require.NoError(t, err)

	store := New(nil, Options{
		AppCredentialStorageKey:        primaryKey,
		LegacyAppCredentialStorageKeys: [][]byte{legacyKey},
	})

	plaintext, err := store.decryptGiteaAppConfigSecret(string(stored))
	require.NoError(t, err)
	require.Equal(t, "legacy-secret", plaintext)
}

func TestStoredAppCredentialsDecryptFallsBackToLegacyKey(t *testing.T) {
	t.Parallel()

	primaryKey := bytes.Repeat([]byte{1}, 32)
	legacyKey := bytes.Repeat([]byte{2}, 32)
	stored, err := EncryptStoredCredentialsJSON(legacyKey, []byte(`{"token":"legacy-token"}`))
	require.NoError(t, err)

	store := New(nil, Options{
		AppCredentialStorageKey:        primaryKey,
		LegacyAppCredentialStorageKeys: [][]byte{legacyKey},
	})

	plaintext, err := store.decryptStoredAppCredentialsJSON(stored)
	require.NoError(t, err)
	require.JSONEq(t, `{"token":"legacy-token"}`, string(plaintext))
}