from pathlib import Path
import re


ROOT = Path(__file__).resolve().parents[1]


def test_vault_cache_is_a_persistent_named_volume():
    compose = (ROOT / "compose.yaml").read_text()
    assert "vault-cache:/data/vault-cache" in compose
    assert "volumes:\n  vault-cache:" in compose


def test_vault_sync_uses_protected_environment_instead_of_embedded_password():
    script = (ROOT / "vault-sync.sh").read_text()
    assert '.vault-sync.env' in script
    assert not re.search(r'export BW_PASSWORD=["\'](?!\$)', script)
    assert 'BW_CLIENTID' in script
    assert 'BW_CLIENTSECRET' in script
    assert 'bw login --apikey' in script
    assert 'bw unlock --passwordenv BW_PASSWORD' in script


def test_vault_sync_runtime_files_are_not_tracked():
    gitignore = (ROOT / ".gitignore").read_text().splitlines()
    assert ".vault-sync.env" in gitignore
    assert "vault-sync.log" in gitignore