package secrets

import (
	"context"
	"errors"
	"testing"
)

func TestSqliteManagerRefusesAKeyThatIsNotAnIdentifier(t *testing.T) {
	manager, err := NewSQLiteManager(":memory:")
	if err != nil {
		t.Fatal(err)
	}
	for _, key := range []string{"not a key!", "has-dash", "1starts_with_digit", "dotted.key", ""} {
		err := manager.AddSecret(context.Background(), createTestSecret("did:plc:foo", key, "value", "did:plc:user"))
		if !errors.Is(err, ErrInvalidKeyIdent) {
			t.Errorf("AddSecret(%q) = %v, want ErrInvalidKeyIdent", key, err)
		}
	}
	stored, err := manager.GetSecretsLocked(context.Background(), RepoIdentifier("did:plc:foo"))
	if err != nil || len(stored) != 0 {
		t.Fatalf("refused keys left %d secrets behind (%v)", len(stored), err)
	}
}