<?php

use App\Services\Secrets\SecretCipher;

it('round-trips a value with a raw base64 key', function () {
    config()->set('admin_access.secrets_key', base64_encode(random_bytes(32)));

    $cipher = app(SecretCipher::class);

    expect($cipher->decrypt($cipher->encrypt('hunter2')))->toBe('hunter2');
});

it('accepts the base64: prefix as well, because the documented generator omits it', function () {
    config()->set('admin_access.secrets_key', 'base64:'.base64_encode(random_bytes(32)));

    $cipher = app(SecretCipher::class);

    expect($cipher->decrypt($cipher->encrypt('hunter2')))->toBe('hunter2');
});

it('refuses rather than silently falling back to APP_KEY', function () {
    config()->set('admin_access.secrets_key', '');

    expect(fn () => app(SecretCipher::class)->encrypt('x'))
        ->toThrow(RuntimeException::class, 'SECRETS_KEY');

    expect(app(SecretCipher::class)->isUsable())->toBeFalse();
});

it('refuses a key that is not 32 bytes', function () {
    config()->set('admin_access.secrets_key', 'zu-kurz');

    expect(fn () => app(SecretCipher::class)->encrypt('x'))
        ->toThrow(RuntimeException::class, '32 bytes');
});