#!/usr/bin/env bash

cat <<EOF >mise.toml
redactions = ["SECRET"]
[env]
SECRET = "my_secret"

[tasks.a]
run = 'echo secret: \$SECRET'
EOF

assert "mise run a" "secret: [redacted]"

# Test config-level redact=false exclusions survive task context construction
cat <<'TOML' >mise.toml
redactions = ["*TOKEN*"]
[env]
TEST_TOKEN = { value = "e", redact = false }

[tasks.a]
run = 'echo "secret value:$TEST_TOKEN"'
TOML
assert "mise run a" "secret value:e"

# Test a task-level redact=true assignment overrides a config-level exclusion
cat <<'TOML' >mise.toml
redactions = ["*TOKEN*"]
[env]
TEST_TOKEN = { value = "e", redact = false }

[tasks.a]
run = 'echo "secret:$TEST_TOKEN"'
env.TEST_TOKEN = { value = "task_secret", redact = true }
TOML
assert "mise run a" "secret:[redacted]"

cat <<EOF >mise.toml
redactions = ["secret"]
[tasks.a]
run = 'echo secret: {{ vars.secret }}'

[vars]
secret = "my_secret"
EOF
assert "mise run a" "secret: [redacted]"

cat <<EOF >mise.toml
redactions = ["SECRET*"]
[env]
SECRET_FOO = "my_secret_wild"

[tasks.a]
run = 'echo secret: \$SECRET_FOO'
EOF
assert "mise run a" "secret: [redacted]"

cat <<'TOML' >mise.toml
redactions = ["*_KEY"]
[env]
DISABLE_FEEDBACK_SURVEY = "1"

[tasks.a]
run = 'echo "version 1.2.3"'
TOML
assert "mise run a" "version 1.2.3"

cat <<EOF >mise.toml
[env]
SECRET= {value = "my_secret", redact = true}

[tasks.a]
run = 'echo secret: \$SECRET'
EOF
assert "mise run a" "secret: [redacted]"

echo '{ "SECRET": "my_secret" }' >.env.json
cat <<EOF >mise.toml
[env]
_.file = {path = ".env.json", redact = true}

[tasks.a]
run = 'echo secret: \$SECRET'
EOF
assert "mise run a" "secret: [redacted]"

cat <<'TOML' >mise.toml
[env]
EMPTY_SECRET = { value = "", redact = true }

[tasks.empty_redaction]
run = 'echo "Hello $EMPTY_SECRET"'
TOML
assert "mise run empty_redaction" "Hello "

cat <<'TOML' >mise.toml
[env]
SECRET_WITH_TOOLS = { value = "tools_secret", tools = true, redact = true }

[tasks.a]
run = 'echo secret: $SECRET_WITH_TOOLS'
TOML
assert "mise run a" "secret: [redacted]"

# Test task-specific env._.file with redactions pattern
echo '{ "NOTIFY_AVATAR": "task_file_secret" }' >.env.json
cat <<'TOML' >mise.toml
redactions = ["NOTIFY_*"]
[tasks.a]
run = "echo secret: $NOTIFY_AVATAR"
env._.file = ".env.json"
TOML
assert "mise run a" "secret: [redacted]"

# Test task-specific env._.file with redact=true
echo '{ "TASK_SECRET": "task_secret_val" }' >.env.json
cat <<'TOML' >mise.toml
[tasks.a]
run = "echo secret: $TASK_SECRET"
env._.file = {path = ".env.json", redact = true}
TOML
assert "mise run a" "secret: [redacted]"

# Overlapping values: the longest match wins
cat <<'TOML' >mise.toml
redactions = ["SHORT", "LONG"]
[env]
SHORT = "abc"
LONG = "xxabcSECRETPART"
[tasks.a]
run = 'echo "long:$LONG"'
TOML
assert "mise run a" "long:[redacted]"

# A shebang script runs from a temporary file holding the rendered value, so
# only the user may enter its directory, whatever the umask
cat <<'TOML' >mise.toml
[env]
TOKEN = { value = "my_token", redact = true }
[tasks.a]
run = """
#!/usr/bin/env bash
: {{ env.TOKEN }}
ls -ld "$(dirname "$0")" | cut -c1-10
"""
TOML
assert "umask 022 && mise run a" "drwx------"

# Task output is redacted line by line, so each line of a multi-line value is
# redacted, and so is a value read from a file that ends in a newline
printf 'npm_fileToken_8d2e41b7\n' >npm_token.txt
cat <<'TOML' >mise.toml
[env]
DEPLOY_KEY = { value = "-----BEGIN KEY-----\nb3BlbnNzaC1rZXktdjEAAAA\nQyNTUxOQAAACDfakefake\n-----END KEY-----", redact = true }
NPM_TOKEN = { value = "{{ read_file(path='npm_token.txt') }}", redact = true }
[tasks.a]
run = 'printenv DEPLOY_KEY NPM_TOKEN'
TOML
assert_not_contains "mise run a" "b3BlbnNzaC1rZXktdjEAAAA"
assert_not_contains "mise run a" "QyNTUxOQAAACDfakefake"
assert_not_contains "mise run a" "npm_fileToken_8d2e41b7"
