#!/usr/bin/env bash

# `mise doctor` output is meant to be pasted into issues, so the credentials
# mise reads from its own environment variables and settings are hidden there,
# and in `mise settings`, whatever the variable is called.

export MISE_SOPS_AGE_KEY=AGE-SECRET-KEY-1SOPSE2ESECRET
export MISE_AGE_KEY=AGE-SECRET-KEY-1AGEE2ESECRET
export MISE_TASK_CACHE_REMOTE_TOKEN=rtc_e2e_secret
export MISE_FORGEJO_TOKEN=fj_e2e_secret
export MISE_GITHUB_TOKEN=ghp_e2e_secret

for secret in AGE-SECRET-KEY-1SOPSE2ESECRET AGE-SECRET-KEY-1AGEE2ESECRET rtc_e2e_secret fj_e2e_secret ghp_e2e_secret; do
  assert_not_contains "mise doctor 2>&1 || true" "$secret"
  assert_not_contains "mise doctor -J 2>&1 || true" "$secret"
done
assert_contains "mise doctor 2>&1 || true" "MISE_FORGEJO_TOKEN"

assert_not_contains "mise settings get sops.age_key" "AGE-SECRET-KEY-1SOPSE2ESECRET"
assert_not_contains "mise settings --all" "AGE-SECRET-KEY-1SOPSE2ESECRET"

# A redacted value that is also JSON syntax leaves the JSON report valid.
cat >mise.toml <<'EOF'
[env]
FLAG = { value = "false", redact = true }
EOF
assert_succeed "(mise doctor -J 2>/dev/null || true) | jq -e 'has(\"activated\")'"
rm mise.toml
