import { describe, expect, test } from 'bun:test';
import { auditServicesCredentials } from './services-credentials';

describe('auditServicesCredentials', () => {
  test('no findings when every service decrypts', async () => {
    const result = await auditServicesCredentials({
      results: [
        {
          serviceId: 'home-proxmox',
          name: 'Home Proxmox',
          providerName: 'proxmox',
          error: null,
        },
        { serviceId: 'do', name: 'DigitalOcean', providerName: 'digitalocean', error: null },
      ],
    });
    expect(result).toEqual([]);
  });

  test('blocked finding per failing service', async () => {
    const result = await auditServicesCredentials({
      results: [
        {
          serviceId: 'home-proxmox',
          name: 'Home Proxmox',
          providerName: 'proxmox',
          error: 'Failed to decrypt: bad authentication tag',
        },
      ],
    });
    expect(result).toHaveLength(1);
    expect(result[0]).toMatchObject({
      category: 'services_credentials',
      severity: 'blocked',
      code: 'service_credentials_invalid',
      subject: 'home-proxmox',
      actionable: false,
    });
    expect(result[0].message).toContain('Home Proxmox');
    expect(result[0].message).toContain('proxmox');
    expect(result[0].details).toContain('bad authentication tag');
    expect(result[0].remediation).toContain('celilo service set-credentials home-proxmox');
  });

  test('mixed report — only failures produce findings', async () => {
    const result = await auditServicesCredentials({
      results: [
        { serviceId: 'good', name: 'Good', providerName: 'proxmox', error: null },
        { serviceId: 'bad', name: 'Bad', providerName: 'proxmox', error: 'oops' },
      ],
    });
    expect(result.map((f) => f.subject)).toEqual(['bad']);
  });
});