package secret

import (
	"bytes"
	"encoding/base64"
	"testing"
)

func TestVaultAuthenticatedEncryption(t *testing.T) {
	v, err := NewVault(base64.StdEncoding.EncodeToString(bytes.Repeat([]byte{7}, 32)))
	if err != nil {
		t.Fatal(err)
	}
	first, err := v.Encrypt("private-api-key", "model_primary")
	if err != nil {
		t.Fatal(err)
	}
	second, err := v.Encrypt("private-api-key", "model_primary")
	if err != nil {
		t.Fatal(err)
	}
	if bytes.Equal(first, second) || bytes.Contains(first, []byte("private-api-key")) {
		t.Fatal("encryption lacks nonce or exposes secret")
	}
	value, err := v.Decrypt(first, "model_primary")
	if err != nil || value != "private-api-key" {
		t.Fatal("decrypt failed")
	}
	if _, err := v.Decrypt(first, "model_backup"); err == nil {
		t.Fatal("cross-configuration ciphertext accepted")
	}
	first[len(first)-1] ^= 1
	if _, err := v.Decrypt(first, "model_primary"); err == nil {
		t.Fatal("tampered ciphertext accepted")
	}
	empty, _ := NewVault("")
	if _, err := empty.Encrypt("secret", "model_primary"); err == nil {
		t.Fatal("missing master key accepted")
	}
	if _, err := NewVault("invalid"); err == nil {
		t.Fatal("invalid master key accepted")
	}
}