//! `pic config --effective` — masked secret resolution against the manifest.

use std::fs;

use predicates::prelude::*;
use tempfile::TempDir;

use crate::common;
use crate::common::cleanup::AppGuard;

#[ignore = "needs DATABASE_URL pointing at a running Postgres"]
#[test]
fn config_effective_masks_and_classifies_secrets() {
    let Some(fx) = common::fixture_or_skip() else {
        return;
    };
    let env = common::admin_env(fx);
    let slug = common::unique_slug("config");
    common::pic_as(&env)
        .args(["apps", "create", &slug])
        .assert()
        .success();
    let _guard = AppGuard::new(&env.url, &env.token, &slug);

    let dir = TempDir::new().unwrap();
    let manifest_path = dir.path().join("picloud.toml");
    fs::write(
        &manifest_path,
        format!("[app]\nslug = \"{slug}\"\nname = \"Cfg\"\n\n[secrets]\nnames = [\"API_KEY\"]\n"),
    )
    .unwrap();

    // Declared but not pushed → masked + flagged unset; value never shown.
    common::pic_as(&env)
        .args(["config", "--effective", "--file"])
        .arg(&manifest_path)
        .assert()
        .success()
        .stdout(predicate::str::contains("API_KEY"))
        .stdout(predicate::str::contains("<unset>"))
        .stdout(predicate::str::contains("not pushed"));

    // Push it → now masked as <set> / managed, still never the value.
    common::pic_as(&env)
        .args(["secrets", "set", "--app", &slug, "API_KEY"])
        .write_stdin("super-secret-value")
        .assert()
        .success();
    common::pic_as(&env)
        .args(["config", "--effective", "--file"])
        .arg(&manifest_path)
        .assert()
        .success()
        .stdout(predicate::str::contains("<set>"))
        .stdout(predicate::str::contains("managed"))
        .stdout(predicate::str::contains("super-secret-value").not());
}