package cli //nolint:testpackage // exercises the unexported command constructor

import (
	"strings"
	"testing"

	"github.com/spf13/pflag"
)

// TestRestoreCommandDoesNotTakeKeyAsArgument guards the fix for the age
// key being echoed on the command line: restore must take the key only
// from the environment, never as a flag value, and its help must show the
// file-based form rather than a literal key that would land in shell
// history.
func TestRestoreCommandDoesNotTakeKeyAsArgument(t *testing.T) {
	t.Parallel()

	cmd := newSnapshotRestoreCommand()

	cmd.Flags().VisitAll(func(f *pflag.Flag) {
		lower := strings.ToLower(f.Name)
		for _, banned := range []string{"key", "secret", "age", "identity"} {
			if strings.Contains(lower, banned) {
				t.Errorf("restore must not accept the key as a flag; found --%s", f.Name)
			}
		}
	})

	help := cmd.Long
	if strings.Contains(help, "AGE-SECRET-KEY-") {
		t.Error("restore help must not show a literal age private key to type")
	}

	if !strings.Contains(help, "$(cat ") {
		t.Error("restore help should read the key from a file, e.g. $(cat ...)")
	}
}