<?php

app_require('classes/replication_secret_box.php');
app_require('classes/replication_bootstrap_config.php');

use classes\replication_bootstrap_config;
use classes\replication_secret_box;

beforeEach(function (): void {
    $this->previousEncryptionKey = $GLOBALS['ENCRYPTION_KEY'] ?? null;
    $GLOBALS['ENCRYPTION_KEY'] = 'unit-test-replication-encryption-key';
});

afterEach(function (): void {
    if ($this->previousEncryptionKey === null) {
        unset($GLOBALS['ENCRYPTION_KEY']);
        return;
    }
    $GLOBALS['ENCRYPTION_KEY'] = $this->previousEncryptionKey;
});

it('encrypts replication secrets without storing plaintext', function (): void {
    $secret = replication_secret_box::encrypt('replica-password');

    expect($secret)->toStartWith('twsec:v1:');
    expect($secret)->not->toContain('replica-password');
    expect(replication_secret_box::decrypt($secret))->toBe('replica-password');
});

it('builds active database and redis config from encrypted bootstrap snapshots', function (): void {
    $snapshot = [
        'active' => [
            'database' => [
                'host' => 'mysql-replica.internal',
                'port' => 3307,
                'database' => 'truckwash',
                'user' => 'app',
                'password_secret' => replication_secret_box::encrypt('db-secret'),
                'ssl_mode' => 'REQUIRED',
            ],
            'redis' => [
                'host' => 'redis-replica.internal',
                'port' => 6380,
                'database' => 2,
                'user' => 'default',
                'password_secret' => replication_secret_box::encrypt('redis-secret'),
            ],
            'minio' => [
                'endpoint' => 'https://minio-replica.internal:9000',
                'access_key' => 'minio-access',
                'secret_key_secret' => replication_secret_box::encrypt('minio-secret'),
                'buckets' => ['attachments', 'uploads'],
            ],
        ],
    ];

    expect(replication_bootstrap_config::activeDatabaseConfigFromSnapshot($snapshot['active']['database']))->toMatchArray([
        'host' => 'mysql-replica.internal',
        'port' => 3307,
        'database' => 'truckwash',
        'user' => 'app',
        'password' => 'db-secret',
        'ssl_mode' => 'REQUIRED',
    ]);
    expect(replication_bootstrap_config::activeRedisConfigFromSnapshot($snapshot['active']['redis']))->toMatchArray([
        'host' => 'redis-replica.internal',
        'port' => 6380,
        'database' => 2,
        'user' => 'default',
        'password' => 'redis-secret',
    ]);
    expect(replication_bootstrap_config::activeMinioConfigFromSnapshot($snapshot['active']['minio']))->toMatchArray([
        'endpoint' => 'https://minio-replica.internal:9000',
        'access_key' => 'minio-access',
        'secret_key' => 'minio-secret',
        'buckets' => ['attachments', 'uploads'],
    ]);
});
