import { test } from 'node:test';
import assert from 'node:assert/strict';
import { spawnSync } from 'node:child_process';
import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
import { dirname, join, resolve } from 'node:path';
import { loadSystem } from '../src/config.mjs';
import { tmp } from './helpers.mjs';

const repo = resolve(import.meta.dirname, '../../..');
const configScript = join(repo, 'scripts/mosaic-config.mjs');
const cli = join(repo, 'packages/cli/src/cli.mjs');
const secret = 'sk-test-NOT-A-SECRET-1234';
function fixture(t) {
  const root = tmp(t, 'jr-'), home = join(root, 'home');
  const file = join(home, '.config/mosaic-redacttest/config.json');
  const env = { PATH: process.env.PATH, HOME: home, TMPDIR: process.env.TMPDIR, LANG: 'C.UTF-8', MOSAIC_CONFIG: file };
  const run = (script, ...args) => spawnSync(process.execPath, [script, ...args], { env, cwd: repo, encoding: 'utf8' });
  const boot = () => {
    const result = run(configScript, 'bootstrap', '--instance', 'redacttest');
    assert.equal(result.status, 0, result.stderr);
  };
  return { root, file, env, run, boot };
}
function redacted(result, file, status) {
  assert.equal(result.status, status, result.stderr);
  assert.equal(result.stdout, '');
  assert.ok(result.stderr.includes(file), result.stderr);
  assert.match(result.stderr, /not valid JSON/);
  assert.doesNotMatch(result.stderr, /sk-test|Unexpected token/);
}

test('system config parse refusal and CLI relay omit parser bytes', t => {
  const f = fixture(t);
  mkdirSync(dirname(f.file), { recursive: true }); writeFileSync(f.file, secret);
  redacted(f.run(configScript, 'validate', '--instance', 'redacttest'), f.file, 2);
  assert.throws(() => loadSystem({ env: f.env, instance: 'redacttest' }), error => {
    assert.equal(error.exitCode, 3);
    assert.ok(error.message.includes(f.file));
    assert.match(error.message, /not valid JSON/);
    assert.doesNotMatch(error.message, /sk-test|Unexpected token/);
    return true;
  });
  redacted(f.run(cli, 'org', 'config', 'validate', 'alpha'), f.file, 3);
});

test('named instance marker parse refusal omits parser bytes', t => {
  const f = fixture(t); f.boot();
  const { dataRoot } = JSON.parse(readFileSync(f.file, 'utf8'));
  const marker = join(dataRoot, 'instance.json'); writeFileSync(marker, secret);
  redacted(f.run(configScript, 'validate', '--instance', 'redacttest'), marker, 3);
});

for (const operation of ['validate', 'create', 'update']) test(`org ${operation} document refusal omits parser bytes`, t => {
  const f = fixture(t); f.boot();
  const file = join(f.root, 'alpha.json'); writeFileSync(file, secret);
  const args = operation === 'validate' ? ['validate', file]
    : [operation, 'alpha', '--from', file, ...(operation === 'update' ? ['--if-revision', '1'] : [])];
  redacted(f.run(cli, 'org', ...args), file, 2);
});