#!/bin/sh
set -eu

YAZA_TEST_CLI=${YAZA_TEST_CLI:-yaza}
TEMP_DIR=$(mktemp -d "${TMPDIR:-/tmp}/yaza-secret-token.XXXXXX")
trap 'rm -rf "$TEMP_DIR"' EXIT HUP INT TERM

fail() {
    printf 'FAIL %s\n' "$1" >&2
    exit 1
}

first_token=$("$YAZA_TEST_CLI" secret token) || fail 'token generation command failed'
second_token=$("$YAZA_TEST_CLI" secret token) || fail 'second token generation command failed'

for generated_token in "$first_token" "$second_token"; do
    [ "${#generated_token}" -eq 64 ] || fail 'generated token was not 64 hexadecimal characters'
    case "$generated_token" in
        *[!0123456789abcdef]*) fail 'generated token contained a non-hexadecimal character' ;;
    esac
done

[ "$first_token" != "$second_token" ] || fail 'two consecutive generated tokens were identical'

if "$YAZA_TEST_CLI" secret token extra >"$TEMP_DIR/usage.log" 2>&1; then
    fail 'token command unexpectedly accepted extra arguments'
fi
grep -F 'Usage: yaza secret token' "$TEMP_DIR/usage.log" >/dev/null || fail 'invalid token command did not show usage'

printf 'YAZA CSPRNG token generation smoke passed.\n'