/**
 * Which argv the injector wrapper wraps, by server shape.
 *
 * Getting this wrong is SILENT: wrapCommand returns undefined, the wrapper is
 * skipped, the agent still renders /vault/secrets/<name>, nothing sources it,
 * and the server starts with empty credentials. Observed live on docmost and
 * my-home-assistant, which carry a `command` but no `entrypoint`.
 */
import { describe, it, expect } from 'vitest';
import { ServerIdentityService } from '../src/services/server-identity.service.js';
import type { SecretBackendService } from '../src/services/secret-backend.service.js';

const svc = new ServerIdentityService(
  {} as unknown as SecretBackendService,
  { namespace: 'mcpctl-servers', ensure: async () => undefined, remove: async () => undefined },
);

const withSecret = { env: [{ name: 'T', valueFrom: { secretRef: { name: 'creds', key: 'K' } } }] };
/** The wrapper is `sh -c <script> arg0 arg1...`; argv starts at index 3. */
const argvOf = (r: string[] | undefined): string[] | undefined => r?.slice(3);

describe('wrapCommand argv by server shape', () => {
  it('prepends the node runner entrypoint for a package server', () => {
    const r = svc.wrapCommand({ ...withSecret, packageName: '@leval/mcp-grafana', runtime: 'node', entrypoint: null } as never, ['@leval/mcp-grafana']);
    expect(argvOf(r)).toEqual(['npx', '-y', '@leval/mcp-grafana']);
  });

  it('prepends uvx for a python package server', () => {
    const r = svc.wrapCommand({ ...withSecret, packageName: 'mcp-searxng', runtime: 'python', entrypoint: null } as never, ['mcp-searxng']);
    expect(argvOf(r)).toEqual(['uvx', 'mcp-searxng']);
  });

  it('uses an image server\'s command verbatim — prepending anything breaks it', () => {
    // The docmost/home-assistant regression: this used to return undefined.
    const r = svc.wrapCommand({ ...withSecret, packageName: null, entrypoint: null } as never, ['node', 'build/index.js']);
    expect(argvOf(r)).toEqual(['node', 'build/index.js']);
  });

  it('falls back to the declared entrypoint for an image server with no command', () => {
    const r = svc.wrapCommand({ ...withSecret, packageName: null, entrypoint: ['/usr/local/bin/gitea-mcp'] } as never, undefined);
    expect(argvOf(r)).toEqual(['/usr/local/bin/gitea-mcp']);
  });

  it('returns undefined when there is genuinely nothing to run', () => {
    expect(svc.wrapCommand({ ...withSecret, packageName: null, entrypoint: null } as never, undefined)).toBeUndefined();
  });

  it('returns undefined for a server with no secret refs', () => {
    expect(svc.wrapCommand({ env: [], packageName: 'p', runtime: 'node', entrypoint: null } as never, ['p'])).toBeUndefined();
  });

  it('always sources before exec, whatever the shape', () => {
    const r = svc.wrapCommand({ ...withSecret, packageName: null, entrypoint: null } as never, ['node', 'x.js']);
    expect(r?.[0]).toBe('/bin/sh');
    expect(r?.[2]).toContain('. /vault/secrets/creds');
    expect(r?.[2]).toContain('exec "$0" "$@"');
  });
});