package config

import "testing"

func TestSecretRoundTripAndIsolation(t *testing.T) {
	first := &Config{EncryptionKey: []byte("01234567890123456789012345678901")}
	second := &Config{EncryptionKey: []byte("abcdefghijklmnopqrstuvwxyz123456")}
	ciphertext, err := first.EncryptSecret("umami-secret")
	if err != nil {
		t.Fatal(err)
	}
	if ciphertext == "umami-secret" || ciphertext == "" {
		t.Fatalf("secret was not encrypted: %q", ciphertext)
	}
	plaintext, err := first.DecryptSecret(ciphertext)
	if err != nil || plaintext != "umami-secret" {
		t.Fatalf("round trip failed: %q, %v", plaintext, err)
	}
	if _, err := second.DecryptSecret(ciphertext); err == nil {
		t.Fatal("ciphertext decrypted with the wrong key")
	}
	cleared, err := first.EncryptSecret("")
	if err != nil || cleared != "" {
		t.Fatalf("empty secret should clear storage: %q, %v", cleared, err)
	}
}