#!/usr/bin/env bash

secret_root="$PWD/secret-root"
secret_target="$PWD/root-secret.conf"
mkdir -p "$secret_root"
echo '{{ secret(name="root_only_secret") }}' >"$secret_root/secret.tmpl"

cat <<EOF >mise.toml
[bootstrap]
config_roots = ["secret-root"]
EOF

cat <<EOF >"$secret_root/mise.toml"
[bootstrap.secrets]
root_only_secret = "MISE_ROOT_ONLY_SECRET"

[dotfiles]
"$secret_target" = { source = "secret.tmpl", mode = "template" }
EOF

# Secrets declared only in a selected bootstrap root are available to that
# root's dotfile templates and appear in aggregate status.
assert_succeed "MISE_ROOT_ONLY_SECRET=from-root-secret mise bootstrap dotfiles apply --yes"
assert "cat '$secret_target'" "from-root-secret"
assert_contains "MISE_ROOT_ONLY_SECRET=from-root-secret mise bootstrap status" "root_only_secret"

# Independent roots may repeat the same declaration, but must reject a secret
# name that points at a different environment variable.
second_root="$PWD/second-root"
mkdir -p "$second_root"
cat <<EOF >mise.toml
[bootstrap]
config_roots = ["secret-root", "second-root"]
EOF
cat <<EOF >"$second_root/mise.toml"
[bootstrap.secrets]
root_only_secret = "MISE_ROOT_ONLY_SECRET"
EOF
assert_succeed "MISE_ROOT_ONLY_SECRET=from-root-secret mise bootstrap status --json | jq -e '[.secrets[] | select(.name == \"root_only_secret\")] | length == 1'"

cat <<EOF >"$second_root/mise.toml"
[bootstrap.secrets]
root_only_secret = "MISE_DIFFERENT_SECRET"
EOF
assert_fail "mise bootstrap status" "conflicting bootstrap secret declarations for root_only_secret"
assert_fail "mise bootstrap status" "$secret_root/mise.toml"
assert_fail "mise bootstrap status" "$second_root/mise.toml"
