package db_test

import (
	"context"
	"database/sql"
	"errors"
	"path/filepath"
	"testing"

	"github.com/kanootoko/codevault/internal/db"
)

func openTestDB(t *testing.T) *sql.DB {
	t.Helper()
	sqlDB, err := db.Open(filepath.Join(t.TempDir(), "test.db"))
	if err != nil {
		t.Fatalf("could not open test db: %v", err)
	}
	t.Cleanup(func() { _ = sqlDB.Close() })
	return sqlDB
}

func TestSecretsRepository_SetOwnership(t *testing.T) {
	ctx := context.Background()
	secrets := db.NewSecretsRepository(openTestDB(t))

	if err := secrets.Set(ctx, "code1", "value1", "alice"); err != nil {
		t.Fatalf("alice's initial set failed: %v", err)
	}

	if err := secrets.Set(ctx, "code1", "value2", "alice"); err != nil {
		t.Fatalf("alice's overwrite failed: %v", err)
	}
	value, err := secrets.Get(ctx, "code1")
	if err != nil {
		t.Fatalf("get failed: %v", err)
	}
	if value != "value2" {
		t.Fatalf("expected value2, got %q", value)
	}

	err = secrets.Set(ctx, "code1", "value3", "bob")
	if !errors.Is(err, db.ErrForbidden) {
		t.Fatalf("expected ErrForbidden for bob, got %v", err)
	}
	value, err = secrets.Get(ctx, "code1")
	if err != nil {
		t.Fatalf("get failed: %v", err)
	}
	if value != "value2" {
		t.Fatalf("expected value to remain value2 after forbidden write, got %q", value)
	}
}