//! Master-key startup checks use only temporary host storage and synthetic keys.
use sausage::cred::{Caller, Cred};
use std::os::unix::fs::PermissionsExt;
#[test]
fn missing_key_in_populated_store_is_not_replaced() {
    let dir = tempfile::tempdir().unwrap();
    let c = Cred::open(dir.path()).unwrap();
    c.create_item(serde_json::from_value(serde_json::json!({"name":"stored","rules":[],"validate_js":null,"transform_js":"","fields":[]})).unwrap(), &Caller::default(), c.unlocked().unwrap()).unwrap();
    drop(c);
    std::fs::remove_file(dir.path().join("cred.key")).unwrap();
    assert!(Cred::open(dir.path()).is_err());
    assert!(!dir.path().join("cred.key").exists());
}
#[test]
fn wrong_master_key_fails_at_open_even_without_secret_fields() {
    let dir = tempfile::tempdir().unwrap();
    drop(Cred::open(dir.path()).unwrap());
    std::fs::write(dir.path().join("cred.key"), [7u8; 32]).unwrap();
    assert!(Cred::open(dir.path()).is_err());
}
#[test]
fn permissive_key_is_refused_and_new_host_directory_is_private() {
    let dir = tempfile::tempdir().unwrap();
    let host = dir.path().join("host");
    drop(Cred::open(&host).unwrap());
    assert_eq!(
        std::fs::metadata(&host).unwrap().permissions().mode() & 0o777,
        0o700
    );
    let key = host.join("cred.key");
    std::fs::set_permissions(&key, std::fs::Permissions::from_mode(0o644)).unwrap();
    assert!(Cred::open(&host).is_err());
}