using Microsoft.AspNetCore.DataProtection;
using w4c_workflows.Services.Credentials;
using Xunit;

namespace w4c_workflows.Tests;

public class CredentialCipherTests
{
    [Fact]
    public void Round_trips_and_does_not_expose_the_plaintext()
    {
        var cipher = new DataProtectionCredentialCipher(new EphemeralDataProtectionProvider());
        const string secret = """{"token":"super-secret-value"}""";

        var ciphertext = cipher.Protect(secret);

        Assert.NotEqual(secret, ciphertext);
        Assert.DoesNotContain("super-secret-value", ciphertext);
        Assert.Equal(secret, cipher.Unprotect(ciphertext));
    }

    [Fact]
    public void Ciphertext_from_a_different_key_ring_cannot_be_unprotected()
    {
        var a = new DataProtectionCredentialCipher(new EphemeralDataProtectionProvider());
        var b = new DataProtectionCredentialCipher(new EphemeralDataProtectionProvider());
        var ciphertext = a.Protect("""{"token":"x"}""");

        Assert.ThrowsAny<Exception>(() => b.Unprotect(ciphertext));
    }
}