#!/usr/bin/env bash

# A token templated into an http tool's URL from the environment stays out of
# mise.lock, which is meant to be committed. The lockfile names the artifact
# without the credentials that fetch it.

export MISE_LOCKFILE=1
export RELEASES_TOKEN=rt_lockfile_s3cret

cat <<'EOF' >mise.toml
[tools."http:lockcreds-test"]
version = "1.0.0"
url = "https://ci:{{ env.RELEASES_TOKEN }}@releases.example.com/tool-{{ version }}.tar.gz"
EOF

touch mise.lock
mise lock --platform linux-x64,macos-arm64

assert_not_contains "cat mise.lock" "rt_lockfile_s3cret"
assert_contains "cat mise.lock" 'url = "https://releases.example.com/tool-1.0.0.tar.gz"'

# A token in the URL's query string cannot be recorded without it, so mise.lock
# refuses the URL, whether `mise lock` or an install writes the entry.
cat <<'EOF' >mise.toml
[tools."http:lockcreds-test"]
version = "1.0.0"
url = "https://releases.example.com/tool-{{ version }}.tar.gz?private_token={{ env.RELEASES_TOKEN }}"
EOF
rm -f mise.lock
touch mise.lock
assert_fail "mise lock --platform linux-x64" "private_token"
assert_not_contains "cat mise.lock" "rt_lockfile_s3cret"

mkdir -p pkg/bin
printf '#!/bin/sh\necho lockcreds\n' >pkg/bin/lockcreds-test
chmod +x pkg/bin/lockcreds-test
tar -czf tool.tar.gz -C pkg bin
start_http_server
cat <<EOF >mise.toml
[tools."http:lockcreds-test"]
version = "1.0.0"
url = "http://127.0.0.1:$HTTP_PORT/tool.tar.gz?private_token={{ env.RELEASES_TOKEN }}"
bin_path = "bin"
EOF
rm -f mise.lock
touch mise.lock
assert_fail "mise install" "private_token"
assert_not_contains "cat mise.lock" "rt_lockfile_s3cret"
