import assert from "node:assert/strict";
import test from "node:test";
import { decryptSecret, encryptSecret, isEncryptedSecret } from "../src/secrets.js";

test("database secrets are encrypted and can be decrypted", () => {
  process.env.SECRET_ENCRYPTION_KEY = "test-secret-key";

  const encrypted = encryptSecret("zammad-token-with-specials-!$%&/()=?");

  assert.equal(isEncryptedSecret(encrypted), true);
  assert.notEqual(encrypted, "zammad-token-with-specials-!$%&/()=?");
  assert.equal(decryptSecret(encrypted), "zammad-token-with-specials-!$%&/()=?");
});

test("plain legacy secrets are read as-is until migration encrypts them", () => {
  assert.equal(decryptSecret("legacy-token"), "legacy-token");
  assert.equal(decryptSecret(null), null);
});

test("already encrypted secrets are not encrypted twice", () => {
  process.env.SECRET_ENCRYPTION_KEY = "test-secret-key";

  const encrypted = encryptSecret("zammad-token");

  assert.equal(encryptSecret(encrypted), encrypted);
});