#!/usr/bin/env bats
# Tests for the built orca binary's CLI surface (P08, REQ-087). Verifies
# that the new commands shipped in P00-P07 (--help, version, cache show,
# acl list, secrets list) work against the built binary so a packaging
# regression (missing subcommand, broken flag parsing) surfaces in the
# bash gate before a release ships.
#
# The binary is built by `make build` to bin/orca. These tests skip
# gracefully if the binary is absent (e.g. a fresh checkout that has
# not run make).

load test_helper

# ORCA_BIN resolves to the built binary at <repo>/bin/orca. SCRIPTS_DIR
# is the scripts/ dir (set by test_helper), so the repo root is its
# parent.
ORCA_BIN="$SCRIPTS_DIR/../bin/orca"

# skip_if_no_orca skips the test if the built binary is missing. This
# keeps the bats gate green on a fresh checkout that has not run `make
# build`; `make test` builds first, so CI always exercises these.
skip_if_no_orca() {
	if [ ! -x "$ORCA_BIN" ]; then
		skip "bin/orca not built — run 'make build' (skipping CLI tests)"
	fi
}

@test "orca --help exits 0 and lists subcommands" {
	skip_if_no_orca
	run "$ORCA_BIN" --help
	assert_status 0 "$status"
	assert_contains "$output" "orca"
	assert_contains "$output" "init"
	assert_contains "$output" "job"
	assert_contains "$output" "node"
	assert_contains "$output" "ns"
	assert_contains "$output" "secrets"
	assert_contains "$output" "acl"
	assert_contains "$output" "cache"
}

@test "orca version prints version line" {
	skip_if_no_orca
	run "$ORCA_BIN" version
	assert_status 0 "$status"
	assert_contains "$output" "orca version"
	assert_contains "$output" "git commit"
	assert_contains "$output" "build time"
}

@test "orca version --json emits valid JSON" {
	skip_if_no_orca
	run "$ORCA_BIN" version --json
	assert_status 0 "$status"
	assert_json_field "$output" "version"
	assert_json_field "$output" "git_commit"
	assert_json_field "$output" "build_time"
}

@test "orca cache show exits 0 against an empty cache" {
	skip_if_no_orca
	HOME_SANDBOX="$(mktemp -d)"
	export ORCA_HOME="$HOME_SANDBOX"
	run "$ORCA_BIN" cache show
	assert_status 0 "$status"
	assert_contains "$output" "Cache is empty"
	rm -rf "$HOME_SANDBOX"
}

@test "orca cache show --json against an empty cluster emits null" {
	skip_if_no_orca
	HOME_SANDBOX="$(mktemp -d)"
	export ORCA_HOME="$HOME_SANDBOX"
	run "$ORCA_BIN" cache show --json
	assert_status 0 "$status"
	assert_contains "$output" "null"
	rm -rf "$HOME_SANDBOX"
}

@test "orca acl list on an empty cluster prints no entries" {
	skip_if_no_orca
	HOME_SANDBOX="$(mktemp -d)"
	export ORCA_HOME="$HOME_SANDBOX"
	run "$ORCA_BIN" acl list
	assert_status 0 "$status"
	assert_contains "$output" "No ACL entries"
	rm -rf "$HOME_SANDBOX"
}

@test "orca acl list --json on an empty cluster emits empty array" {
	skip_if_no_orca
	HOME_SANDBOX="$(mktemp -d)"
	export ORCA_HOME="$HOME_SANDBOX"
	run "$ORCA_BIN" acl list --json
	assert_status 0 "$status"
	assert_contains "$output" "[]"
	rm -rf "$HOME_SANDBOX"
}

# gen_master_key <path> writes 32 random bytes to path with mode 0600
# (the orca master key format). Uses /dev/urandom via dd.
gen_master_key() {
	local path="$1"
	mkdir -p "$(dirname "$path")"
	dd if=/dev/urandom of="$path" bs=32 count=1 2>/dev/null
	chmod 0600 "$path"
}

@test "orca secrets list on an empty namespace reports no secrets" {
	skip_if_no_orca
	HOME_SANDBOX="$(mktemp -d)"
	export ORCA_HOME="$HOME_SANDBOX"
	mkdir -p "$ORCA_HOME/cluster" "$ORCA_HOME/testns"
	gen_master_key "$ORCA_HOME/cluster/master.key"
	run "$ORCA_BIN" secrets list testns
	assert_status 0 "$status"
	assert_contains "$output" "No secrets found"
	rm -rf "$HOME_SANDBOX"
}

@test "orca unknown subcommand exits non-zero" {
	skip_if_no_orca
	run "$ORCA_BIN" bogus-subcommand
	[ "$status" -ne 0 ]
}

@test "orca --json flag is accepted on the root command" {
	skip_if_no_orca
	run "$ORCA_BIN" version --json
	assert_status 0 "$status"
	assert_contains "$output" "\"version\""
}