import { assertEquals, assertRejects } from "jsr:@std/assert@1";
import {
  decryptCredential,
  encryptCredential,
  parseCredentials,
} from "./credentials.ts";

const MASTER_KEY = "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8";
const OTHER_KEY = "AQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAQE";
const NONCE = Uint8Array.from({ length: 12 }, (_, index) => index + 32);
const ENCRYPTED = "v1:ICEiIyQlJicoKSor:oV_FAgnsN3p1FyegJxwGVdyjfyPio6qDeSUwbA";

Deno.test("decrypts a known AES-256-GCM credential", async () => {
  assertEquals(
    await decryptCredential(ENCRYPTED, MASTER_KEY),
    "secret-token",
  );
});

Deno.test("encrypts a credential with a fresh supplied nonce", async () => {
  assertEquals(
    await encryptCredential("secret-token", MASTER_KEY, NONCE),
    ENCRYPTED,
  );
});

Deno.test("rejects a credential encrypted by another master key", async () => {
  await assertRejects(() => decryptCredential(ENCRYPTED, OTHER_KEY));
});

Deno.test("rejects a credential with a nonstandard nonce", async () => {
  await assertRejects(
    () =>
      decryptCredential(
        "v1:AA:oV_FAgnsN3p1FyegJxwGVdyjfyPio6qDeSUwbA",
        MASTER_KEY,
      ),
    Error,
    "nonce must be 12 bytes",
  );
});

Deno.test("decrypts the central reviewer token and ordered profiles", async () => {
  assertEquals(
    await parseCredentials(
      `
reviewer-token: ${ENCRYPTED}
profiles:
  - type: claude
    token: ${ENCRYPTED}
  - type: codex
    model: gpt-custom
`,
      MASTER_KEY,
    ),
    {
      reviewerToken: "secret-token",
      profiles: [
        {
          type: "claude",
          model: "claude-sonnet-5",
          token: "secret-token",
        },
        { type: "codex", model: "gpt-custom" },
      ],
    },
  );
});

Deno.test("rejects malformed central credentials", async () => {
  await assertRejects(
    () => parseCredentials("profiles: []", MASTER_KEY),
    Error,
    "reviewer-token",
  );
  await assertRejects(
    () =>
      parseCredentials(
        `reviewer-token: ${ENCRYPTED}\nprofiles:\n  - type: claude`,
        MASTER_KEY,
      ),
    Error,
    "profiles[0].token",
  );
});