<?php

use App\Services\Secrets\SecretCipher;
use App\Support\OperatingMode;
use App\Support\Settings;
use Illuminate\Support\Facades\DB;

/**
 * Die Migration rät nicht.
 *
 * Der Stripe-Schlüssel sagt selbst, wohin er gehört: `sk_test_` ist ein
 * Testschlüssel, unabhängig davon, in welchem Feld er gerade liegt. Ihn stumpf
 * als „Live" einzusortieren, würde eine Installation, die erkennbar im
 * Testbetrieb läuft, beim ersten Kauf echtes Geld abbuchen lassen.
 */
function runSlotMigration(): void
{
    (require base_path('database/migrations/2026_08_01_090000_give_every_secret_a_test_slot.php'))->up();
}

it('files a stripe test key in the test slot and switches the mode', function () {
    DB::table('app_secrets')->insert([
        'key' => 'stripe.secret',
        // SecretVault::put() always encrypts with SecretCipher (its own
        // SECRETS_KEY), never with the app's default APP_KEY-based encrypt()
        // helper — so a row built with the latter is not a value this
        // migration would ever actually meet, only one that looks unreadable.
        'value' => app(SecretCipher::class)->encrypt('sk_test_abc'),
        'created_at' => now(), 'updated_at' => now(),
    ]);

    runSlotMigration();

    expect(DB::table('app_secrets')->where('key', 'stripe.secret:test')->exists())->toBeTrue();
    expect(DB::table('app_secrets')->where('key', 'stripe.secret:live')->exists())->toBeFalse();
    expect(Settings::get(OperatingMode::SETTING))->toBe('test');
});

it('files a stripe live key in the live slot and leaves the mode alone', function () {
    DB::table('app_secrets')->insert([
        'key' => 'stripe.secret',
        'value' => app(SecretCipher::class)->encrypt('sk_live_abc'),
        'created_at' => now(), 'updated_at' => now(),
    ]);

    runSlotMigration();

    expect(DB::table('app_secrets')->where('key', 'stripe.secret:live')->exists())->toBeTrue();
    expect(OperatingMode::current())->toBe(OperatingMode::Live);
});

it('files every other credential in the live slot', function () {
    DB::table('app_secrets')->insert([
        'key' => 'dns.token',
        'value' => app(SecretCipher::class)->encrypt('whatever'),
        'created_at' => now(), 'updated_at' => now(),
    ]);

    runSlotMigration();

    expect(DB::table('app_secrets')->where('key', 'dns.token:live')->exists())->toBeTrue();
    expect(DB::table('app_secrets')->where('key', 'dns.token')->exists())->toBeFalse();
});

it('leaves an installation with no stripe key on live', function () {
    runSlotMigration();

    expect(OperatingMode::current())->toBe(OperatingMode::Live);
});