package security

import (
	"encoding/base64"
	"testing"
)

func TestCredentialKeyringDecryptsPreviousAndReencryptsWithPrimary(t *testing.T) {
	primary := base64.StdEncoding.EncodeToString([]byte("01234567890123456789012345678901"))
	previous := base64.StdEncoding.EncodeToString([]byte("abcdefghijklmnopqrstuvwxyzabcdef"))
	oldCipher, err := NewCredentialCipher(previous)
	if err != nil {
		t.Fatal(err)
	}
	legacy, err := oldCipher.Encrypt("provider-secret")
	if err != nil {
		t.Fatal(err)
	}
	keyring, err := NewCredentialKeyring(primary, []string{previous})
	if err != nil {
		t.Fatal(err)
	}
	if got, err := keyring.Decrypt(legacy); err != nil || got != "provider-secret" {
		t.Fatalf("decrypt previous key: got %q, err %v", got, err)
	}
	rotated, err := keyring.Encrypt("provider-secret")
	if err != nil {
		t.Fatal(err)
	}
	if string(rotated[:4]) != "AGK1" {
		t.Fatalf("expected versioned credential envelope, got %q", rotated[:4])
	}
	if got, err := keyring.Decrypt(rotated); err != nil || got != "provider-secret" {
		t.Fatalf("decrypt primary key: got %q, err %v", got, err)
	}
}