#!/usr/bin/env bash

export MISE_GITHUB_TOKEN=credential-test-token
export GIT_TERMINAL_PROMPT=0
export GIT_CONFIG_NOSYSTEM=1
export GIT_CONFIG_GLOBAL=/dev/null

assert_contains "printf 'protocol=https\nhost=github.com\n\n' | git -c credential.helper= -c 'credential.https://github.com.helper=!mise token github --git-credential' credential fill" "password=credential-test-token"
assert_contains "printf 'protocol=https\nhost=github.com\n\n' | mise token github --git-credential get" "username=x-access-token"
assert_contains "printf 'protocol=https\nhost=github.com:443\n\n' | git -c credential.helper= -c 'credential.https://github.com:443.helper=!mise token github --git-credential' credential fill" "password=credential-test-token"

# Unrelated malformed project files must not prevent authentication.
printf '[invalid' >.miserc.toml
printf '[invalid' >mise.toml
assert_contains "printf 'protocol=https\nhost=github.com\n\n' | mise token github --git-credential get" "password=credential-test-token"
printf '' >.miserc.toml
printf '' >mise.toml
for host in github.com.evil.example example.com github.com:8443; do
  assert_not_contains "printf 'protocol=https\nhost=$host\n\n' | mise token github --git-credential get" "credential-test-token"
done
assert_not_contains "printf 'protocol=http\nhost=github.com\n\n' | mise token github --git-credential get" "credential-test-token"
assert_not_contains "printf 'protocol=https\nhost=github.com\n\n' | mise token github --git-credential store" "credential-test-token"
assert_not_contains "printf 'protocol=https\nhost=github.com\n\n' | mise token github --git-credential erase" "credential-test-token"

# Broken operator-owned miserc files must not block an environment token.
export MISE_SYSTEM_CONFIG_DIR="$HOME/system-mise"
mkdir -p "$MISE_CONFIG_DIR" "$MISE_SYSTEM_CONFIG_DIR"
printf '[invalid' >"$MISE_CONFIG_DIR/miserc.toml"
printf '[invalid' >"$MISE_SYSTEM_CONFIG_DIR/miserc.toml"
assert_contains "printf 'protocol=https\nhost=github.com\n\n' | mise token github --git-credential get" "password=credential-test-token"
printf '' >"$MISE_CONFIG_DIR/miserc.toml"
printf '' >"$MISE_SYSTEM_CONFIG_DIR/miserc.toml"

# The helper must not invoke Git's helpers again when no mise token exists.
unset MISE_GITHUB_TOKEN GITHUB_TOKEN GITHUB_API_TOKEN
assert_not_contains "printf 'protocol=https\nhost=github.com\n\n' | mise token github --git-credential get" "password="

export MISE_GITHUB_USE_GIT_CREDENTIALS=1
export GIT_CONFIG_GLOBAL="$PWD/gitconfig"
git config --file "$GIT_CONFIG_GLOBAL" credential.helper '!echo password=recursive-helper-token'
assert_not_contains "printf 'protocol=https\nhost=github.com\n\n' | mise token github --git-credential get" "recursive-helper-token"

# A credential command that calls Git must not reenter the helper either.
export MISE_GITHUB_CREDENTIAL_COMMAND='echo invoked > credential-command-invoked; git credential fill'
assert_not_contains "printf 'protocol=https\nhost=github.com\n\n' | mise token github --git-credential get" "password="
assert "test ! -e credential-command-invoked"

# OAuth configured in operator-owned files must also work from a broken project.
unset MISE_GITHUB_CREDENTIAL_COMMAND
MOCK_PORT_FILE="$HOME/credential-oauth-port"
MOCK_GITHUB_OAUTH_PORT_FILE="$MOCK_PORT_FILE" python3 "$ROOT/e2e/fixtures/mock-github-oauth.py" &
MOCK_PID=$!
trap 'kill "$MOCK_PID" 2>/dev/null || true' EXIT
for _ in {1..100}; do
  [[ -f $MOCK_PORT_FILE ]] && break
  sleep 0.1
done
MOCK_PORT=$(cat "$MOCK_PORT_FILE")
mkdir -p "$MISE_CONFIG_DIR"
cat >"$MISE_CONFIG_DIR/config.toml" <<EOF
[settings.github]
oauth_client_id = "Iv1.mock"
oauth_auth_url = "http://127.0.0.1:$MOCK_PORT/login"
oauth_open_browser = false
EOF
assert_contains "mise token github --oauth --raw" "ghu-native-oauth-token"
printf '[invalid' >.miserc.toml
printf '[invalid' >mise.toml
assert_contains "printf 'protocol=https\nhost=github.com\n\n' | mise token github --git-credential get" "password=ghu-native-oauth-token"

# Operator-owned miserc may select an environment-specific global auth config.
mv "$MISE_CONFIG_DIR/config.toml" "$MISE_CONFIG_DIR/config.work.toml"
printf 'env = ["work"]\n' >"$MISE_CONFIG_DIR/miserc.toml"
assert_contains "printf 'protocol=https\nhost=github.com\n\n' | mise token github --git-credential get" "password=ghu-native-oauth-token"

# Ignore a broken system layer while preserving valid global environment selection.
printf '[invalid' >"$MISE_SYSTEM_CONFIG_DIR/miserc.toml"
assert_contains "printf 'protocol=https\nhost=github.com\n\n' | mise token github --git-credential get" "password=ghu-native-oauth-token"
# Also preserve valid system selection when the higher-priority global file is broken.
printf 'env = ["work"]\n' >"$MISE_SYSTEM_CONFIG_DIR/miserc.toml"
printf '[invalid' >"$MISE_CONFIG_DIR/miserc.toml"
assert_contains "printf 'protocol=https\nhost=github.com\n\n' | mise token github --git-credential get" "password=ghu-native-oauth-token"
