// ---------------------------------------------------------------------------
// The one-time API key crosses the account API as `Redacted` on both sides.
//
// This is a WRITE path in the sense that matters: the server ENCODES the
// secret into the response body. `Redacted`'s toString/toJSON render the
// literal "<redacted>", so a regression to `Schema.String` on the provider side
// would not throw — it would ship that literal to the console, and the user
// would only find out when the key they copied failed to authenticate. So the
// assertion is on the encoded bytes, not just on the wrapper type.
// ---------------------------------------------------------------------------

import { describe, expect, it } from "@effect/vitest";
import { Effect, Redacted, Schema } from "effect";

import { CreatedApiKeyResponse } from "./api";

// Synthetic, and asserted by exact match, so "<redacted>" cannot pass for it.
const KEY_SECRET = "synthetic-one-time-key";

const summary = {
  id: "api_key_123",
  name: "Local CLI",
  obfuscatedValue: "exk_...1234",
  createdAt: "2026-01-01T00:00:00.000Z",
  updatedAt: "2026-01-01T00:00:00.000Z",
  lastUsedAt: null,
};

describe("CreatedApiKeyResponse", () => {
  it.effect("encodes the real secret into the response body", () =>
    Effect.gen(function* () {
      const encoded = yield* Schema.encodeUnknownEffect(CreatedApiKeyResponse)({
        ...summary,
        value: Redacted.make(KEY_SECRET),
      });

      // The bytes on the wire are the key itself — the failure a missed unwrap
      // on this path produces is the literal "<redacted>" reaching the console.
      expect(encoded.value).toBe(KEY_SECRET);
      expect(encoded.obfuscatedValue).toBe(summary.obfuscatedValue);
    }),
  );

  it.effect("decodes the body back into Redacted, so serializing it exposes nothing", () =>
    Effect.gen(function* () {
      const decoded = yield* Schema.decodeUnknownEffect(CreatedApiKeyResponse)({
        ...summary,
        value: KEY_SECRET,
      });

      expect(Redacted.isRedacted(decoded.value)).toBe(true);

      // What a log line, a span attribute, or an error payload would produce.
      const serialized = JSON.stringify(decoded);
      expect(serialized).not.toContain(KEY_SECRET);
      expect(serialized).toContain("<redacted>");

      // …and the wrapper still holds the real key, so the check above is
      // redaction rather than a dropped value.
      expect(Redacted.value(decoded.value)).toBe(KEY_SECRET);
    }),
  );
});