import { describe, expect, it } from 'vitest';
import { grantedSecrets, parseSecretsFile } from '../src/secrets.js';

describe('parseSecretsFile', () => {
  it('reads grants keyed by repository', () => {
    const grants = parseSecretsFile(
      JSON.stringify({
        'alice.example.com/proj': { NPM_TOKEN: 'npm-abc' },
        'did:plc:abc/other': { SITE_TOKEN: 'tok', GHCR_TOKEN: 'ghcr' },
      }),
    );
    expect(grants['alice.example.com/proj']).toEqual({ NPM_TOKEN: 'npm-abc' });
    expect(Object.keys(grants['did:plc:abc/other'])).toEqual([
      'SITE_TOKEN',
      'GHCR_TOKEN',
    ]);
  });

  it('rejects malformed files', () => {
    expect(() => parseSecretsFile('{')).toThrow(/invalid JSON/);
    expect(() => parseSecretsFile('[]')).toThrow(/must be a JSON object/);
    expect(() => parseSecretsFile('{"a/b": "tok"}')).toThrow(
      /a\/b must be an object/,
    );
    expect(() => parseSecretsFile('{"a/b": {"T": 1}}')).toThrow(
      /a\/b\.T must be a string/,
    );
  });
});

describe('grantedSecrets', () => {
  const granted = { NPM_TOKEN: 'npm-abc', SITE_TOKEN: 'tok' };

  it('returns only what the workflow declares', () => {
    expect(grantedSecrets(granted, ['NPM_TOKEN'])).toEqual({
      NPM_TOKEN: 'npm-abc',
    });
  });

  it('omits a declared name with no grant', () => {
    expect(grantedSecrets(granted, ['NPM_TOKEN', 'MISSING'])).toEqual({
      NPM_TOKEN: 'npm-abc',
    });
  });

  it('returns nothing for a repository with no grants', () => {
    expect(grantedSecrets(undefined, ['NPM_TOKEN'])).toEqual({});
  });

  it('returns nothing when the workflow declares nothing', () => {
    expect(grantedSecrets(granted, [])).toEqual({});
  });
});