package main

import (
	"bytes"
	"errors"
	"strings"
	"testing"
	"time"

	"git.kebcloud.no/keb/lazysecrets/internal/provider"
	"git.kebcloud.no/keb/lazysecrets/internal/provider/fake"
)

func TestExpiring(t *testing.T) {
	providers := []provider.Provider{fake.Azure(0), fake.Databricks(0)}
	now := time.Date(2026, 10, 1, 0, 0, 0, 0, time.UTC)
	var out, errs bytes.Buffer
	err := expiring(providers, expiringOpts{days: 30, timeout: time.Minute, now: now}, &out, &errs)
	if !errors.Is(err, errExpiring) {
		t.Fatalf("err %v (want errExpiring: something listed)", err)
	}
	lines := strings.Split(strings.TrimSpace(out.String()), "\n")
	if len(lines) != 2 || !strings.HasPrefix(lines[1], "expired  2026-03-01  certificate  kv-app-prod  old-tls") ||
		!strings.Contains(lines[1], "lazysecrets://azure/kv-app-prod.vault.azure.net/certificates/old-tls") {
		t.Errorf("out:\n%s", out.String())
	}
	if !strings.Contains(errs.String(), "kv-restricted: can't list ") || strings.Count(errs.String(), "kv-restricted") != 1 {
		t.Errorf("unreadable vaults not said:\n%s", errs.String())
	}

	// Further ahead, the soonest first.
	out.Reset()
	expiring(providers, expiringOpts{days: 400, timeout: time.Minute, now: now}, &out, &errs)
	if got := strings.Count(out.String(), "\n"); got != 4 || !strings.Contains(out.String(), "app-tls") {
		t.Errorf("400 days:\n%s", out.String())
	}

	// Nothing listed, but not everything checked.
	errs.Reset()
	err = expiring(providers, expiringOpts{days: 0, timeout: time.Minute, now: time.Date(2020, 1, 1, 0, 0, 0, 0, time.UTC)}, &out, &errs)
	if !errors.Is(err, errIncomplete) {
		t.Errorf("err %v, want errIncomplete", err)
	}

	if _, err := parseExpiring([]string{"--days", "-1"}, 30); err == nil {
		t.Error("negative days accepted")
	}
}