package deviceauth

import (
	"context"
	"errors"
	"os"
	"path/filepath"
	"strings"
	"testing"
)

func TestDirectorySecretResolverReadsPerDeviceSecretAndObservesRotation(t *testing.T) {
	root := t.TempDir()
	path := filepath.Join(root, "terminal-001")
	first := strings.Repeat("a", 40)
	if err := os.WriteFile(path, []byte(first+"\n"), 0o600); err != nil {
		t.Fatal(err)
	}
	resolver, err := NewDirectorySecretResolver(root)
	if err != nil {
		t.Fatal(err)
	}
	secret, err := resolver.Resolve(context.Background(), "device-secret://terminal-001")
	if err != nil || string(secret) != first {
		t.Fatalf("secret=%q err=%v", secret, err)
	}
	second := strings.Repeat("b", 48)
	if err := os.WriteFile(path, []byte(second), 0o600); err != nil {
		t.Fatal(err)
	}
	secret, err = resolver.Resolve(context.Background(), "device-secret://terminal-001")
	if err != nil || string(secret) != second {
		t.Fatalf("rotated secret=%q err=%v", secret, err)
	}
}

func TestDirectorySecretResolverRejectsUnsafeOrInvalidReferences(t *testing.T) {
	root := t.TempDir()
	if err := os.WriteFile(filepath.Join(root, "short"), []byte("too-short"), 0o600); err != nil {
		t.Fatal(err)
	}
	resolver, err := NewDirectorySecretResolver(root)
	if err != nil {
		t.Fatal(err)
	}
	for _, reference := range []string{
		"local-dev://terminal-1", "device-secret://../outside", "device-secret://nested/file", "device-secret://short", "device-secret://missing",
	} {
		if _, err := resolver.Resolve(context.Background(), reference); !errors.Is(err, ErrCredentialInvalid) {
			t.Fatalf("Resolve(%q) error=%v", reference, err)
		}
	}
}

func TestDirectorySecretResolverRequiresExistingAbsoluteDirectory(t *testing.T) {
	if _, err := NewDirectorySecretResolver("relative/secrets"); err == nil {
		t.Fatal("relative directory must be rejected")
	}
}