package secrets

import (
	"os"
	"testing"
)

// Against a real Vault or OpenBao: LLMGW_TEST_VAULT_ADDR and VAULT_TOKEN, a
// KV v2 secret secret/llmgw-test with field dsn, and a transit key
// llmgw-test.
func TestARealVault(t *testing.T) {
	addr := os.Getenv("LLMGW_TEST_VAULT_ADDR")
	if addr == "" {
		t.Skip("set LLMGW_TEST_VAULT_ADDR (and VAULT_TOKEN) to run against a real Vault")
	}
	ctx := t.Context()
	if err := Configure(Vault{Addr: addr}); err != nil {
		t.Fatal(err)
	}
	if v, err := ReadString(ctx, "vault:secret/llmgw-test#dsn"); err != nil || v != "postgres://real" {
		t.Errorf("kv: %q %v", v, err)
	}
	s, err := NewSealer(ctx, "vault-transit:llmgw-test")
	if err != nil {
		t.Fatal(err)
	}
	sealed, err := s.Seal(ctx, []byte("engine-key"))
	if err != nil {
		t.Fatal(err)
	}
	if got, err := s.Open(ctx, sealed); err != nil || string(got) != "engine-key" {
		t.Errorf("transit: %q %v", got, err)
	}
}