import { expect, test } from "vite-plus/test";
import { decryptCredential, encryptCredential, parseCredentials } from "./credentials.ts";

const MASTER_KEY = "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8";
const OTHER_KEY = "AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE";
const NONCE = Uint8Array.from({ length: 12 }, (_, index) => index + 32);
const ENCRYPTED = "v1:ICEiIyQlJicoKSor:oV_FAgnsN3p1FyegJxwGVdyjfyPio6qDeSUwbA";

test("decrypts a known AES-256-GCM credential", async () => {
  expect(await decryptCredential(ENCRYPTED, MASTER_KEY)).toBe("secret-token");
});

test("encrypts a credential with a fresh supplied nonce", async () => {
  expect(await encryptCredential("secret-token", MASTER_KEY, NONCE)).toStrictEqual(ENCRYPTED);
});

test("rejects a credential encrypted by another master key", async () => {
  await expect(() => decryptCredential(ENCRYPTED, OTHER_KEY)).rejects.toThrow();
});

test("rejects a credential with a nonstandard nonce", async () => {
  await expect(() =>
    decryptCredential("v1:AA:oV_FAgnsN3p1FyegJxwGVdyjfyPio6qDeSUwbA", MASTER_KEY),
  ).rejects.toThrow("nonce must be 12 bytes");
});

test("decrypts the central reviewer token and ordered profiles", async () => {
  expect(
    await parseCredentials(
      JSON.stringify({
        "reviewer-token": ENCRYPTED,
        profiles: [
          { type: "codex", model: "gpt-custom" },
          { type: "claude", token: ENCRYPTED },
          { type: "opencode", token: ENCRYPTED },
        ],
      }),
      MASTER_KEY,
    ),
  ).toStrictEqual({
    reviewerToken: "secret-token",
    profiles: [
      { type: "codex", model: "gpt-custom" },
      {
        type: "claude",
        model: "claude-sonnet-5",
        token: "secret-token",
      },
      {
        type: "opencode",
        model: "openrouter/qwen/qwen3.8-27b",
        token: "secret-token",
      },
    ],
  });
});

test("rejects malformed central credentials", async () => {
  await expect(() => parseCredentials('{"profiles": []}', MASTER_KEY)).rejects.toThrow(
    "reviewer-token",
  );
  await expect(() =>
    parseCredentials(
      JSON.stringify({ "reviewer-token": ENCRYPTED, profiles: [{ type: "claude" }] }),
      MASTER_KEY,
    ),
  ).rejects.toThrow("profiles[0].token");
});