cufflink-cli 0.22.0

use super::services::{self, Deployed};
use super::version::{self, PlatformVersion};
use crate::config::CliConfig;
use crate::project_config::ProjectConfig;
use cufflink_types::features::CONFIG_APPLY;
use cufflink_types::ServiceMode;
use serde::{Deserialize, Serialize};
use std::collections::{BTreeMap, HashMap};

async fn get_service_id(config: &CliConfig) -> eyre::Result<String> {
    services::built_here(config, &config.http_client())
        .await
        .map(|service| service.id)
}

/// List all config values for the current service
pub async fn list(env: Option<&str>) -> eyre::Result<()> {
    let config = CliConfig::load_with_env(env)?;

    if let Some(ref name) = config.env_name {
        println!("Environment: {}", name);
    }

    let service_id = get_service_id(&config).await?;

    let client = config.http_client();
    let resp = config
        .auth_request(
            &client,
            reqwest::Method::GET,
            &format!("{}/api/services/{}/config", config.api_url, service_id),
        )
        .send()
        .await?;

    if resp.status().is_success() {
        let body: serde_json::Value = resp.json().await?;
        if let Some(configs) = body["configs"].as_array() {
            if configs.is_empty() {
                println!("No configuration values set.");
            } else {
                use comfy_table::{presets::NOTHING, Table, TableComponent};

                let mut table = Table::new();
                table.load_preset(NOTHING);
                table.set_style(TableComponent::HeaderLines, '-');
                table.set_style(TableComponent::MiddleHeaderIntersections, ' ');
                table.set_header(vec!["KEY", "VALUE", "SECRET"]);

                for c in configs {
                    let secret = if c["is_secret"].as_bool() == Some(true) {
                        "yes"
                    } else {
                        "no"
                    };
                    table.add_row(vec![
                        c["key"].as_str().unwrap_or(""),
                        c["value"].as_str().unwrap_or(""),
                        secret,
                    ]);
                }

                println!("{table}");
            }
        }
    } else {
        let status = resp.status();
        let body = resp.text().await.unwrap_or_default();
        eyre::bail!("Failed to list config ({}): {}", status, body);
    }

    Ok(())
}

/// Set a config value
pub async fn set(key: &str, value: &str, is_secret: bool, env: Option<&str>) -> eyre::Result<()> {
    let config = CliConfig::load_with_env(env)?;

    if let Some(ref name) = config.env_name {
        println!("Environment: {}", name);
    }

    let service_id = get_service_id(&config).await?;

    let payload = serde_json::json!({
        "key": key,
        "value": value,
        "is_secret": is_secret,
    });

    let client = config.http_client();
    let resp = config
        .auth_request(
            &client,
            reqwest::Method::PUT,
            &format!("{}/api/services/{}/config", config.api_url, service_id),
        )
        .json(&payload)
        .send()
        .await?;

    if resp.status().is_success() {
        println!("Config '{}' set successfully", key);
    } else {
        let status = resp.status();
        let body = resp.text().await.unwrap_or_default();
        eyre::bail!("Failed to set config ({}): {}", status, body);
    }

    Ok(())
}

/// Delete a config value
pub async fn delete(key: &str, env: Option<&str>) -> eyre::Result<()> {
    let config = CliConfig::load_with_env(env)?;

    if let Some(ref name) = config.env_name {
        println!("Environment: {}", name);
    }

    let service_id = get_service_id(&config).await?;

    let client = config.http_client();
    let resp = config
        .auth_request(
            &client,
            reqwest::Method::DELETE,
            &format!(
                "{}/api/services/{}/config/{}",
                config.api_url, service_id, key
            ),
        )
        .send()
        .await?;

    if resp.status().is_success() {
        println!("Config '{}' deleted", key);
    } else {
        let status = resp.status();
        let body = resp.text().await.unwrap_or_default();
        eyre::bail!("Failed to delete config ({}): {}", status, body);
    }

    Ok(())
}

#[derive(Clone, PartialEq, Eq, Serialize)]
struct Entry {
    key: String,
    value: String,
    is_secret: bool,
}

/// Every value an environment declares, each key once and in key order.
/// A key in both `[config]` and `[secrets]` is the secret, which is what
/// writing one after the other ended at.
fn declared(configs: &HashMap<String, String>, secrets: HashMap<String, String>) -> Vec<Entry> {
    configs
        .iter()
        .map(|(key, value)| (key.clone(), (value.clone(), false)))
        .chain(secrets.into_iter().map(|(key, value)| (key, (value, true))))
        .collect::<BTreeMap<_, _>>()
        .into_iter()
        .map(|(key, (value, is_secret))| Entry {
            key,
            value,
            is_secret,
        })
        .collect()
}

/// What the platform answers an apply: the keys it added, changed, removed
/// and left as they were, or would for a dry run.
#[derive(Debug, Default, PartialEq, Eq, Deserialize)]
struct ConfigDiff {
    #[serde(default)]
    added: Vec<String>,
    #[serde(default)]
    changed: Vec<String>,
    #[serde(default)]
    removed: Vec<String>,
    #[serde(default)]
    unchanged: Vec<String>,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
enum Tense {
    Done,
    Pending,
}

impl ConfigDiff {
    fn differs(&self) -> bool {
        [&self.added, &self.changed, &self.removed]
            .iter()
            .any(|keys| !keys.is_empty())
    }

    /// A line for each key that differs: never a value.
    fn lines(&self) -> Vec<String> {
        [
            ("+", &self.added),
            ("~", &self.changed),
            ("-", &self.removed),
        ]
        .into_iter()
        .flat_map(|(mark, keys)| keys.iter().map(move |key| format!("  {mark} {key}")))
        .collect()
    }

    fn summary(&self, tense: Tense) -> String {
        let [added, changed, removed] = match tense {
            Tense::Done => ["added", "changed", "removed"],
            Tense::Pending => ["to add", "to change", "to remove"],
        };
        format!(
            "{} {added}, {} {changed}, {} {removed}, {} unchanged",
            self.added.len(),
            self.changed.len(),
            self.removed.len(),
            self.unchanged.len()
        )
    }
}

/// A check that found the platform's config differing from what the
/// environment declares. The CLI exits with [`Drifted::EXIT_CODE`] for it,
/// and 1 for a check that failed.
#[derive(Debug)]
pub struct Drifted {
    pub service: String,
}

impl Drifted {
    pub const EXIT_CODE: u8 = 2;
}

impl std::fmt::Display for Drifted {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        write!(
            f,
            "the config of {} differs from what Cufflink.toml declares; \
             `cufflink config apply` brings the platform to it",
            self.service
        )
    }
}

impl std::error::Error for Drifted {}

#[derive(Debug, Clone, Copy, Default, PartialEq, Eq)]
pub struct ApplyFlags {
    /// Remove the keys the environment does not declare.
    pub prune: bool,
    /// Change nothing, and fail with [`Drifted`] if an apply would.
    pub check: bool,
}

/// The name of the environment a config command reads, which the project
/// declares: the one given, else the project's default.
fn environment(project: &ProjectConfig, env: Option<&str>) -> eyre::Result<String> {
    let name = project
        .env_name(env)
        .ok_or_else(|| eyre::eyre!("No environment specified"))?;
    project.get_env(&name).map(|_| name)
}

/// A vault entry nobody maps is almost always a mapping someone forgot to
/// add, and it fails in the least helpful way available: silently, with a
/// green deploy.
fn unreferenced_warning(unreferenced: &[String], env_name: &str) -> Option<String> {
    let example = unreferenced.first()?;
    let names: String = unreferenced
        .iter()
        .map(|name| format!("    - {name}\n"))
        .collect();
    Some(format!(
        "\n  WARNING: {} secret(s) in the '{env_name}' vault are not mapped in \
         [environments.{env_name}.secrets] and will NOT be synced:\n{names}  \
         Add a mapping (e.g. MY_ENV_VAR = \"{example}\") or delete the entry if it is stale.\n",
        unreferenced.len()
    ))
}

/// Under `--prune` a mapping someone forgot is a key about to be removed,
/// so it stops the apply.
fn unreferenced_refusal(unreferenced: &[String], env_name: &str) -> Option<String> {
    (!unreferenced.is_empty()).then(|| {
        format!(
            "{} secret(s) in the '{env_name}' vault are not mapped in \
             [environments.{env_name}.secrets]: {}. With --prune a forgotten mapping is a key \
             removed from the platform: map each, or delete the vault entry if it is stale.",
            unreferenced.len(),
            unreferenced.join(", ")
        )
    })
}

/// The set the environment declares, its secrets read from the vault:
/// everything a config command reads before it asks the platform anything.
/// A vault entry nothing maps is warned of, and stops a set that is to
/// `prune`.
fn declared_by(project: &ProjectConfig, env_name: &str, prune: bool) -> eyre::Result<Vec<Entry>> {
    let env_config = project.get_env(env_name)?;
    let unreferenced = unreferenced_vault_secrets(project, env_name, &env_config.secrets);
    if let Some(refusal) = prune
        .then(|| unreferenced_refusal(&unreferenced, env_name))
        .flatten()
    {
        eyre::bail!(refusal);
    }
    if let Some(warning) = unreferenced_warning(&unreferenced, env_name) {
        eprintln!("{warning}");
    }
    resolve_secret_refs(project, env_name, &env_config.secrets)
        .map(|secrets| declared(&env_config.config, secrets))
}

async fn asked_to_apply(
    config: &CliConfig,
    client: &reqwest::Client,
    service_id: &str,
    entries: &[Entry],
    prune: bool,
    dry_run: bool,
) -> eyre::Result<reqwest::Response> {
    Ok(config
        .auth_request(
            client,
            reqwest::Method::POST,
            &format!("{}/api/services/{service_id}/config/apply", config.api_url),
        )
        .json(&serde_json::json!({"entries": entries, "prune": prune, "dry_run": dry_run}))
        .send()
        .await?)
}

/// The difference an apply answered. A 405 is a replica that predates
/// `config_apply` taking the request after a newer one advertised it.
async fn diff_of(answer: reqwest::Response) -> eyre::Result<ConfigDiff> {
    if answer.status() == reqwest::StatusCode::METHOD_NOT_ALLOWED {
        eyre::bail!(
            "Failed to apply config (405 Method Not Allowed): the replica that answered \
             predates config_apply; is a platform upgrade in progress?"
        );
    }
    Ok(serde_json::from_value(
        super::json_answer(answer, "apply config").await?,
    )?)
}

async fn applied(
    config: &CliConfig,
    client: &reqwest::Client,
    service_id: &str,
    entries: &[Entry],
    prune: bool,
    dry_run: bool,
) -> eyre::Result<ConfigDiff> {
    diff_of(asked_to_apply(config, client, service_id, entries, prune, dry_run).await?).await
}

/// The config a platform that predates `config_apply` is given: a request
/// for each key, and none removed.
async fn put_each(
    config: &CliConfig,
    client: &reqwest::Client,
    service_id: &str,
    entries: &[Entry],
) -> eyre::Result<()> {
    let url = format!("{}/api/services/{service_id}/config", config.api_url);
    for entry in entries {
        let resp = config
            .auth_request(client, reqwest::Method::PUT, &url)
            .json(entry)
            .send()
            .await?;
        if !resp.status().is_success() {
            let status = resp.status();
            let body = resp.text().await.unwrap_or_default();
            eyre::bail!(
                "Failed to sync {} '{}' ({status}): {body}",
                if entry.is_secret { "secret" } else { "config" },
                entry.key
            );
        }
    }
    let secrets = entries.iter().filter(|entry| entry.is_secret).count();
    println!(
        "  Synced {} config(s) and {} secret(s)",
        entries.len() - secrets,
        secrets
    );
    Ok(())
}

/// What a check prints of `diff`, the last line a count of every key.
/// Without `prune` the platform was not asked about the keys the
/// environment does not declare, and a check that found no difference
/// says so.
fn check_report(service: &str, diff: &ConfigDiff, prune: bool) -> Vec<String> {
    match (diff.differs(), prune) {
        (true, _) => std::iter::once(format!("Config of {service} differs from Cufflink.toml:"))
            .chain(diff.lines())
            .chain([format!("  {}", diff.summary(Tense::Pending))])
            .collect(),
        (false, true) => vec![format!(
            "Config of {service} matches Cufflink.toml ({} key(s))",
            diff.unchanged.len()
        )],
        (false, false) => vec![format!(
            "Config of {service} holds what Cufflink.toml declares ({} key(s)); keys it does \
             not declare are not checked without --prune",
            diff.unchanged.len()
        )],
    }
}

/// What an apply prints of the `diff` it made. A web app and a native
/// service are given their config when they start, so one that runs keeps
/// what it started with.
fn apply_report(service: &Deployed, diff: &ConfigDiff) -> Vec<String> {
    let restarts = match &service.mode {
        Some(mode @ (ServiceMode::Web | ServiceMode::Native)) if diff.differs() => Some(format!(
            "  {} is a {} service: a process that is running reads this config when it next \
             starts",
            service.name,
            mode.as_str()
        )),
        _ => None,
    };
    std::iter::once(format!(
        "Applied config to {}: {}",
        service.name,
        diff.summary(Tense::Done)
    ))
    .chain(diff.lines())
    .chain(restarts)
    .collect()
}

/// What a pruning apply says before it removes anything. What it then
/// reports is what it removed: a key set in between is in that report.
fn removal_notice(
    service: &str,
    env_name: &str,
    declares: usize,
    removed: &[String],
) -> Vec<String> {
    let nothing_declared = (declares == 0).then(|| {
        format!(
            "[environments.{env_name}] declares no config: --prune removes every key of {service}"
        )
    });
    let removing = (!removed.is_empty()).then(|| {
        format!(
            "Removing {} key(s) of {service} that [environments.{env_name}] does not declare: {}",
            removed.len(),
            removed.join(", ")
        )
    });
    nothing_declared.into_iter().chain(removing).collect()
}

/// `config apply --service` names the service where there are no sources
/// to build its name from; it does not send a project's config and secrets
/// to another service, whose code could then read them, nor check or prune
/// that service's against them.
fn foreign_refusal(project: &ProjectConfig, service: &str) -> Option<String> {
    project.foreign_to(service).map(|foreign| {
        format!(
            "--service {service} is not this project's service: {}",
            foreign.refusal("is not applied to, or checked against,", "Run")
        )
    })
}

/// What `config apply` says to a platform that cannot apply a set. A
/// plain apply is what `config sync` does there; a check and a prune are
/// not.
fn unsupported(platform: &PlatformVersion, flags: ApplyFlags) -> String {
    let remedy = match flags.check || flags.prune {
        true => {
            "Upgrade the platform: an older one can neither check a config nor remove a key \
             (`cufflink config sync` only adds and changes)."
        }
        false => "Upgrade the platform, or use `cufflink config sync`.",
    };
    format!(
        "platform {} cannot apply a config as one set (needs {CONFIG_APPLY}). {remedy}",
        platform.label()
    )
}

/// Bring the config of `service` to `entries` as one set, or with
/// `check` only say what that would change.
async fn apply_to(
    config: &CliConfig,
    client: &reqwest::Client,
    service: &Deployed,
    env_name: &str,
    entries: &[Entry],
    flags: ApplyFlags,
) -> eyre::Result<()> {
    let print = |lines: Vec<String>| lines.iter().for_each(|line| println!("{line}"));
    if flags.check || flags.prune {
        let pending = applied(config, client, &service.id, entries, flags.prune, true).await?;
        if flags.check {
            print(check_report(&service.name, &pending, flags.prune));
            return match pending.differs() {
                true => Err(Drifted {
                    service: service.name.clone(),
                }
                .into()),
                false => Ok(()),
            };
        }
        print(removal_notice(
            &service.name,
            env_name,
            entries.len(),
            &pending.removed,
        ));
    }
    let diff = applied(config, client, &service.id, entries, flags.prune, false).await?;
    print(apply_report(service, &diff));
    Ok(())
}

/// `cufflink config apply`: the config of Cufflink.toml and its vault as
/// one set, in one transaction on the platform.
pub async fn apply(
    flags: ApplyFlags,
    service: Option<&str>,
    env: Option<&str>,
) -> eyre::Result<()> {
    let config = CliConfig::load_with_env(env)?;
    if let Some(ref name) = config.env_name {
        println!("Environment: {}", name);
    }
    let project =
        ProjectConfig::find_and_load()?.ok_or_else(|| eyre::eyre!("No Cufflink.toml found"))?;
    apply_from(&config, &project, flags, service, env).await
}

/// [`apply`] of what `project` declares. A `service` the project is
/// foreign to is refused before the vault is read or anything is sent.
async fn apply_from(
    config: &CliConfig,
    project: &ProjectConfig,
    flags: ApplyFlags,
    service: Option<&str>,
    env: Option<&str>,
) -> eyre::Result<()> {
    let env_name = environment(project, env)?;
    if let Some(refusal) = service.and_then(|service| foreign_refusal(project, service)) {
        eyre::bail!(refusal);
    }
    let entries = declared_by(project, &env_name, flags.prune)?;
    let client = config.http_client();
    let platform = version::asked(config, &client).await?;
    if !platform.offers(CONFIG_APPLY) {
        eyre::bail!(unsupported(&platform, flags));
    }
    let service = services::acted_on(config, &client, service).await?;
    apply_to(config, &client, &service, &env_name, &entries, flags).await
}

/// Sync configs and secrets from Cufflink.toml to the platform
pub async fn sync(env: Option<&str>) -> eyre::Result<()> {
    let config = CliConfig::load_with_env(env)?;

    if let Some(ref name) = config.env_name {
        println!("Environment: {}", name);
    }

    let service_id = get_service_id(&config).await?;

    let project =
        ProjectConfig::find_and_load()?.ok_or_else(|| eyre::eyre!("No Cufflink.toml found"))?;
    let env_name = environment(&project, env)?;
    let platform = version::asked(&config, &config.http_client()).await?;

    sync_to_platform(&config, &service_id, &project, &env_name, &platform).await
}

/// Bring the config of the service on `platform` to what the environment
/// declares, removing nothing: as one set where the platform can apply
/// one, else key by key. Nothing is asked for an environment that
/// declares nothing. Used by both `config sync` and `deploy`.
pub async fn sync_to_platform(
    cli_config: &CliConfig,
    service_id: &str,
    project: &ProjectConfig,
    env_name: &str,
    platform: &PlatformVersion,
) -> eyre::Result<()> {
    let entries = declared_by(project, env_name, false)?;
    if entries.is_empty() {
        return Ok(());
    }
    synced(
        cli_config,
        &cli_config.http_client(),
        service_id,
        &entries,
        platform,
    )
    .await
}

/// While a platform is being upgraded, a replica that advertises
/// `config_apply` can answer `/api/version` and one that predates it the
/// apply: its route for the path takes only `DELETE`, so it answers 405
/// and is written to key by key, as it would have been asked to.
async fn synced(
    config: &CliConfig,
    client: &reqwest::Client,
    service_id: &str,
    entries: &[Entry],
    platform: &PlatformVersion,
) -> eyre::Result<()> {
    if !platform.offers(CONFIG_APPLY) {
        return put_each(config, client, service_id, entries).await;
    }
    let answer = asked_to_apply(config, client, service_id, entries, false, false).await?;
    if answer.status() == reqwest::StatusCode::METHOD_NOT_ALLOWED {
        return put_each(config, client, service_id, entries).await;
    }
    let diff = diff_of(answer).await?;
    println!("  Applied config: {}", diff.summary(Tense::Done));
    diff.lines().iter().for_each(|line| println!("  {line}"));
    Ok(())
}

/// Vault entries this environment's `[environments.<env>.secrets]` block never
/// references, and so will never be synced.
///
/// The mirror image of this — a mapping naming a vault key that doesn't exist —
/// already fails loudly in [`resolve_secret_refs`]. This direction was silent:
/// the value simply never reaches the platform, the deploy reports success
/// because there was nothing to do, and the service fails at runtime looking
/// like anything but a configuration problem. Worst case is an environment with
/// no mappings at all, where the vault is never even opened.
///
/// Returns names only; nothing here decrypts.
pub(crate) fn unreferenced_vault_secrets(
    project: &ProjectConfig,
    env_name: &str,
    secret_refs: &HashMap<String, String>,
) -> Vec<String> {
    let Some(stored) = super::secrets_cmd::vault_secret_names(project, env_name) else {
        return Vec::new();
    };
    let referenced: std::collections::HashSet<&str> =
        secret_refs.values().map(String::as_str).collect();
    let mut unused: Vec<String> = stored
        .into_iter()
        .filter(|name| !referenced.contains(name.as_str()))
        .collect();
    unused.sort();
    unused
}

/// Resolve `secret_refs` (mapping `config_key → "group:name"`) against the
/// local securestore vault for the given environment. Returns a flat
/// `config_key → resolved_value` map.
fn resolve_secret_refs(
    project: &ProjectConfig,
    env_name: &str,
    secret_refs: &HashMap<String, String>,
) -> eyre::Result<HashMap<String, String>> {
    if secret_refs.is_empty() {
        return Ok(HashMap::new());
    }
    let store = super::secrets_cmd::load_store(project, env_name)?;
    let mut out = HashMap::with_capacity(secret_refs.len());
    for (config_key, store_name) in secret_refs {
        let value: String = store.get(store_name).map_err(|e| {
            eyre::eyre!(
                "Secret '{}' not found in securestore for '{}': {}",
                store_name,
                env_name,
                e
            )
        })?;
        out.insert(config_key.clone(), value);
    }
    Ok(out)
}

/// Resolve a service's declared `[config]` + `[secrets]` for an environment
/// into a flat env-var map. Plain config values pass through unchanged;
/// secret references like `"google_maps:api_key"` are resolved against the
/// local securestore vault.
///
/// This is the canonical "what env vars does this service declare for this
/// environment?" lookup. Use it anywhere you need ground-truth env values
/// (build-time injection, doctor commands, dry-run output, etc.) — the
/// platform's `GET /config` masks `is_secret=true` values and is unsuitable
/// for paths that need actual values.
pub fn resolve_local_envs(
    project: &ProjectConfig,
    env_name: &str,
) -> eyre::Result<HashMap<String, String>> {
    let env = project.get_env(env_name)?;
    let mut out = env.config.clone();
    out.extend(resolve_secret_refs(project, env_name, &env.secrets)?);
    Ok(out)
}

#[cfg(test)]
mod tests {
    use super::super::stub::answering;
    use super::*;
    use crate::project_config::EnvironmentConfig;
    use securestore::{KeySource, SecretsManager};
    use tempfile::TempDir;

    fn make_project_with_vault(env_name: &str) -> (TempDir, ProjectConfig) {
        let tmp = tempfile::tempdir().unwrap();
        let project_dir = tmp.path().to_path_buf();
        let secrets_dir = project_dir.join("secrets");
        std::fs::create_dir_all(&secrets_dir).unwrap();

        // Mirrors `secrets init`: generate a fresh key, export it, then
        // build the vault against that key path so subsequent `load_store`
        // can decrypt without `CUFFLINK_SECRETS_KEY` being set.
        let key_path = secrets_dir.join(format!("{}.key", env_name));
        let vault_path = secrets_dir.join(format!("{}.json", env_name));
        let store_for_key = SecretsManager::new(KeySource::Csprng).unwrap();
        store_for_key.export_key(&key_path).unwrap();

        let mut store = SecretsManager::new(KeySource::Path(&key_path)).unwrap();
        store.set("google_maps:api_key", "AIzaSyTEST");
        store.set("postmark:api_key", "pm-test-token");
        store.save_as(&vault_path).unwrap();

        let project = ProjectConfig {
            service: Default::default(),
            environments: HashMap::new(),
            project_dir,
        };
        (tmp, project)
    }

    fn env_with(config: &[(&str, &str)], secrets: &[(&str, &str)]) -> EnvironmentConfig {
        EnvironmentConfig {
            api_url: "http://localhost:8080".to_string(),
            tenant: "default".to_string(),
            api_key_env: None,
            api_key: None,
            keycloak_url: None,
            keycloak_realm: None,
            keycloak_client_id: None,
            config: config
                .iter()
                .map(|(k, v)| (k.to_string(), v.to_string()))
                .collect(),
            secrets: secrets
                .iter()
                .map(|(k, v)| (k.to_string(), v.to_string()))
                .collect(),
        }
    }

    // The vault built by `make_project_with_vault` holds exactly
    // google_maps:api_key and postmark:api_key.

    #[test]
    fn reports_vault_secrets_no_mapping_references() {
        // The STA-1016 failure: the value sits in the vault, nothing maps it,
        // the deploy syncs nothing and says nothing, and the service fails at
        // runtime looking like anything but a config problem.
        let (_tmp, project) = make_project_with_vault("prod");
        let refs = HashMap::from([(
            "GOOGLE_MAPS_KEY".to_string(),
            "google_maps:api_key".to_string(),
        )]);
        assert_eq!(
            unreferenced_vault_secrets(&project, "prod", &refs),
            vec!["postmark:api_key".to_string()]
        );
    }

    #[test]
    fn reports_every_secret_when_the_env_maps_none() {
        // The worst version, and the one that hit payments-service in prod: no
        // [environments.prod.secrets] block at all, so the vault is never even
        // opened and every secret is missing from the platform.
        let (_tmp, project) = make_project_with_vault("prod");
        let mut all = unreferenced_vault_secrets(&project, "prod", &HashMap::new());
        all.sort();
        assert_eq!(
            all,
            vec![
                "google_maps:api_key".to_string(),
                "postmark:api_key".to_string()
            ]
        );
    }

    #[test]
    fn says_nothing_when_every_secret_is_mapped() {
        let (_tmp, project) = make_project_with_vault("prod");
        let refs = HashMap::from([
            ("A".to_string(), "google_maps:api_key".to_string()),
            ("B".to_string(), "postmark:api_key".to_string()),
        ]);
        assert!(unreferenced_vault_secrets(&project, "prod", &refs).is_empty());
    }

    #[test]
    fn says_nothing_when_there_is_no_vault_for_the_env() {
        // A service with no secrets in an env is a normal, deliberate state —
        // warning there would train people to ignore the warning.
        let (_tmp, project) = make_project_with_vault("prod");
        assert!(unreferenced_vault_secrets(&project, "demo", &HashMap::new()).is_empty());
    }

    fn pairs(pairs: &[(&str, &str)]) -> HashMap<String, String> {
        pairs
            .iter()
            .map(|(key, value)| (key.to_string(), value.to_string()))
            .collect()
    }

    fn entry(key: &str, value: &str, is_secret: bool) -> Entry {
        Entry {
            key: key.into(),
            value: value.into(),
            is_secret,
        }
    }

    fn keys(keys: &[&str]) -> Vec<String> {
        keys.iter().map(|key| key.to_string()).collect()
    }

    fn diff(added: &[&str], changed: &[&str], removed: &[&str], unchanged: &[&str]) -> ConfigDiff {
        ConfigDiff {
            added: keys(added),
            changed: keys(changed),
            removed: keys(removed),
            unchanged: keys(unchanged),
        }
    }

    fn answer(diff: &ConfigDiff, applied: bool) -> Option<(u16, serde_json::Value)> {
        Some((
            200,
            serde_json::json!({
                "added": diff.added, "changed": diff.changed, "removed": diff.removed,
                "unchanged": diff.unchanged, "applied": applied,
            }),
        ))
    }

    fn service(mode: Option<ServiceMode>) -> Deployed {
        Deployed {
            name: "notes".into(),
            id: "7".into(),
            mode,
            current_version: 3,
        }
    }

    fn wasm() -> Deployed {
        service(Some(ServiceMode::Wasm))
    }

    fn platform(version: &str, supports: &[&str]) -> PlatformVersion {
        PlatformVersion {
            api_version: 1,
            platform_version: Some(version.into()),
            supports: keys(supports),
        }
    }

    const APPLY: &str = "POST /api/services/7/config/apply";
    const PUT: &str = "PUT /api/services/7/config";
    const CHECK: ApplyFlags = ApplyFlags {
        prune: false,
        check: true,
    };
    const PRUNE: ApplyFlags = ApplyFlags {
        prune: true,
        check: false,
    };

    /// What each request said of `prune` and `dry_run`.
    fn asked_to(bodies: &[serde_json::Value]) -> Vec<(bool, bool)> {
        bodies
            .iter()
            .map(|body| (body["prune"] == true, body["dry_run"] == true))
            .collect()
    }

    #[test]
    fn a_key_is_declared_once_and_a_secret_wins() {
        let declared = declared(
            &pairs(&[
                ("ZONE", "eu"),
                ("TOKEN", "from-config"),
                ("API_URL", "https://x"),
            ]),
            pairs(&[("TOKEN", "from-vault"), ("KEY", "k")]),
        );
        assert!(
            declared
                == [
                    entry("API_URL", "https://x", false),
                    entry("KEY", "k", true),
                    entry("TOKEN", "from-vault", true),
                    entry("ZONE", "eu", false),
                ],
            "each key once, in key order, the secret over the config of its name"
        );
        assert!(super::declared(&HashMap::new(), HashMap::new()).is_empty());
    }

    #[test]
    fn a_diff_is_printed_as_its_keys_and_counts() {
        let some = diff(&["NEW"], &["URL", "ZONE"], &["OLD"], &["A", "B"]);
        assert!(some.differs());
        assert_eq!(some.lines(), ["  + NEW", "  ~ URL", "  ~ ZONE", "  - OLD"]);
        assert_eq!(
            some.summary(Tense::Done),
            "1 added, 2 changed, 1 removed, 2 unchanged"
        );
        assert_eq!(
            some.summary(Tense::Pending),
            "1 to add, 2 to change, 1 to remove, 2 unchanged"
        );
        let none = diff(&[], &[], &[], &["A"]);
        assert!(!none.differs());
        assert!(none.lines().is_empty());
        let read: ConfigDiff =
            serde_json::from_value(serde_json::json!({"added": ["A"], "applied": true}))
                .expect("an answer");
        assert_eq!(read, diff(&["A"], &[], &[], &[]));
    }

    #[test]
    fn a_check_says_whether_the_config_matches_how_it_differs_and_what_it_did_not_look_at() {
        let same = diff(&[], &[], &[], &["A", "B"]);
        assert_eq!(
            check_report("notes", &same, true),
            ["Config of notes matches Cufflink.toml (2 key(s))"]
        );
        assert_eq!(
            check_report("notes", &same, false),
            [
                "Config of notes holds what Cufflink.toml declares (2 key(s)); keys it does not \
              declare are not checked without --prune"
            ]
        );
        for prune in [true, false] {
            assert_eq!(
                check_report("notes", &diff(&["NEW"], &[], &["OLD"], &["A"]), prune),
                [
                    "Config of notes differs from Cufflink.toml:",
                    "  + NEW",
                    "  - OLD",
                    "  1 to add, 0 to change, 1 to remove, 1 unchanged",
                ]
            );
        }
    }

    #[test]
    fn an_apply_says_what_it_did_and_when_a_running_process_reads_it() {
        let changed = diff(&[], &["URL"], &[], &["A"]);
        for mode in [Some(ServiceMode::Wasm), Some(ServiceMode::Crud), None] {
            assert_eq!(
                apply_report(&service(mode), &changed),
                [
                    "Applied config to notes: 0 added, 1 changed, 0 removed, 1 unchanged",
                    "  ~ URL",
                ]
            );
        }
        for (mode, named) in [(ServiceMode::Web, "web"), (ServiceMode::Native, "native")] {
            let restarting = service(Some(mode));
            assert_eq!(
                apply_report(&restarting, &changed)
                    .last()
                    .map(String::as_str),
                Some(
                    format!(
                        "  notes is a {named} service: a process that is running reads this \
                         config when it next starts"
                    )
                    .as_str()
                )
            );
            assert_eq!(
                apply_report(&restarting, &diff(&[], &[], &[], &["A"])),
                ["Applied config to notes: 0 added, 0 changed, 0 removed, 1 unchanged"],
                "nothing changed, so nothing waits for a restart"
            );
        }
    }

    #[test]
    fn an_unmapped_vault_secret_is_a_warning_and_a_refusal_to_prune() {
        let unmapped = keys(&["postmark:api_key", "stripe:key"]);
        assert_eq!(
            unreferenced_warning(&unmapped, "prod").as_deref(),
            Some(
                "\n  WARNING: 2 secret(s) in the 'prod' vault are not mapped in \
                 [environments.prod.secrets] and will NOT be synced:\n    \
                 - postmark:api_key\n    - stripe:key\n  \
                 Add a mapping (e.g. MY_ENV_VAR = \"postmark:api_key\") or delete the entry \
                 if it is stale.\n"
            )
        );
        assert_eq!(
            unreferenced_refusal(&unmapped, "prod").as_deref(),
            Some(
                "2 secret(s) in the 'prod' vault are not mapped in [environments.prod.secrets]: \
                 postmark:api_key, stripe:key. With --prune a forgotten mapping is a key \
                 removed from the platform: map each, or delete the vault entry if it is stale."
            )
        );
        assert_eq!(unreferenced_warning(&[], "prod"), None);
        assert_eq!(unreferenced_refusal(&[], "prod"), None);
    }

    #[test]
    fn what_is_declared_is_read_whole_before_the_platform_is_asked_anything() {
        let (_tmp, mut project) = make_project_with_vault("prod");
        project.environments.insert(
            "prod".to_string(),
            env_with(
                &[("ZONE", "eu"), ("TOKEN", "from-config")],
                &[("TOKEN", "google_maps:api_key")],
            ),
        );
        let declared = declared_by(&project, "prod", false).expect("declared");
        assert!(
            declared
                == [
                    entry("TOKEN", "AIzaSyTEST", true),
                    entry("ZONE", "eu", false)
                ],
            "the vault's value for a key in both sections; the unmapped entry is only warned of"
        );
        assert_eq!(
            declared_by(&project, "prod", true)
                .err()
                .map(|refused| refused.to_string()),
            unreferenced_refusal(&keys(&["postmark:api_key"]), "prod"),
            "a set that is to prune is refused for it, before the vault is opened"
        );

        project.environments.insert(
            "prod".to_string(),
            env_with(&[("ZONE", "eu")], &[("TOKEN", "missing:secret")]),
        );
        assert!(declared_by(&project, "prod", false)
            .err()
            .is_some_and(|missing| missing.to_string().contains("missing:secret")));
    }

    #[tokio::test]
    async fn a_sync_writes_nothing_when_the_vault_lacks_a_secret_or_nothing_is_declared() {
        let (_tmp, mut project) = make_project_with_vault("prod");
        project.environments.insert(
            "prod".to_string(),
            env_with(&[("ZONE", "eu")], &[("TOKEN", "missing:secret")]),
        );
        project
            .environments
            .insert("empty".to_string(), env_with(&[], &[]));
        let (config, asked) = answering(Vec::new()).await;
        let applying = platform("0.30.0", &["config_apply"]);

        assert!(sync_to_platform(&config, "7", &project, "prod", &applying)
            .await
            .is_err());
        sync_to_platform(&config, "7", &project, "empty", &applying)
            .await
            .expect("nothing to sync");
        assert_eq!(
            asked.count(),
            0,
            "no key is written before the vault is read"
        );
    }

    #[test]
    fn a_pruning_apply_says_what_it_is_about_to_remove_and_from_where() {
        assert_eq!(
            removal_notice("notes", "staging", 3, &keys(&["OLD", "STALE"])),
            ["Removing 2 key(s) of notes that [environments.staging] does not declare: OLD, STALE"]
        );
        assert_eq!(
            removal_notice("notes", "staging", 0, &keys(&["A"])),
            [
                "[environments.staging] declares no config: --prune removes every key of notes",
                "Removing 1 key(s) of notes that [environments.staging] does not declare: A",
            ]
        );
        assert!(removal_notice("notes", "staging", 3, &[]).is_empty());
    }

    #[tokio::test]
    async fn a_project_that_names_its_service_does_not_prune_anothers() {
        let (_tmp, mut project) = make_project_with_vault("prod");
        project.environments.insert(
            "prod".to_string(),
            env_with(&[("ZONE", "eu")], &[("TOKEN", "missing:secret")]),
        );
        assert_eq!(foreign_refusal(&project, "other"), None);
        project.service.name = Some("notes".into());
        assert_eq!(foreign_refusal(&project, "notes"), None);

        let both = ApplyFlags {
            prune: true,
            check: true,
        };
        for flags in [ApplyFlags::default(), PRUNE, CHECK, both] {
            let (config, asked) = answering(Vec::new()).await;
            let refused = apply_from(&config, &project, flags, Some("other"), Some("prod"))
                .await
                .expect_err("another service's config");
            assert_eq!(
                refused.to_string(),
                "--service other is not this project's service: the Cufflink.toml here is of \
                 notes, whose config is not applied to, or checked against, other. Run it \
                 where Cufflink.toml is of other, or names no service",
                "{flags:?}: refused before the vault, which lacks the secret, is read"
            );
            assert_eq!(asked.count(), 0, "{flags:?}");
        }
    }

    #[test]
    fn a_platform_that_cannot_apply_is_told_what_can_be_done_instead() {
        let older = platform("0.29.2", &["async_deploy"]);
        assert_eq!(
            unsupported(&older, ApplyFlags::default()),
            "platform v0.29.2 cannot apply a config as one set (needs config_apply). Upgrade \
             the platform, or use `cufflink config sync`."
        );
        for flags in [CHECK, PRUNE] {
            assert_eq!(
                unsupported(&older, flags),
                "platform v0.29.2 cannot apply a config as one set (needs config_apply). \
                 Upgrade the platform: an older one can neither check a config nor remove a \
                 key (`cufflink config sync` only adds and changes).",
                "a sync would write what a check must not, and removes nothing"
            );
        }
    }

    #[tokio::test]
    async fn a_check_changes_nothing_and_fails_only_when_the_config_differs() {
        let entries = [entry("A", "1", false), entry("TOKEN", "t", true)];
        let checking = |answers| {
            let entries = &entries;
            async move {
                let (config, asked) = answering(answers).await;
                let checked = apply_to(
                    &config,
                    &config.http_client(),
                    &wasm(),
                    "staging",
                    entries,
                    CHECK,
                )
                .await;
                (checked, asked)
            }
        };

        let same = diff(&[], &[], &[], &["A", "TOKEN"]);
        let (matched, asked) = checking(vec![answer(&same, false)]).await;
        matched.expect("a config that matches");
        assert_eq!(asked.requests(), [APPLY]);
        assert_eq!(
            asked.bodies(),
            [serde_json::json!({
                "entries": [
                    {"key": "A", "value": "1", "is_secret": false},
                    {"key": "TOKEN", "value": "t", "is_secret": true},
                ],
                "prune": false,
                "dry_run": true,
            })]
        );

        let drift = diff(&["A"], &[], &[], &["TOKEN"]);
        let (drifted, asked) = checking(vec![answer(&drift, false)]).await;
        assert_eq!(
            drifted
                .expect_err("a config that differs")
                .downcast_ref::<Drifted>()
                .map(ToString::to_string),
            Some(
                "the config of notes differs from what Cufflink.toml declares; \
                 `cufflink config apply` brings the platform to it"
                    .to_string()
            )
        );
        assert_eq!(asked.count(), 1, "a check applies nothing");

        let (failed, _) = checking(vec![Some((
            404,
            serde_json::json!({"error": "Service not found"}),
        ))])
        .await;
        let failed = failed.expect_err("a check that was not answered");
        assert!(failed.downcast_ref::<Drifted>().is_none(), "exit 1, not 2");
        assert_eq!(
            failed.to_string(),
            r#"Failed to apply config (404 Not Found): {"error":"Service not found"}"#
        );

        let (failed, _) = checking(vec![Some((405, serde_json::Value::Null))]).await;
        assert_eq!(
            failed
                .expect_err("a replica of an older platform")
                .to_string(),
            "Failed to apply config (405 Method Not Allowed): the replica that answered \
             predates config_apply; is a platform upgrade in progress?"
        );

        let (config, asked) = answering(vec![answer(&same, false)]).await;
        let pruning = ApplyFlags {
            prune: true,
            check: true,
        };
        apply_to(
            &config,
            &config.http_client(),
            &wasm(),
            "staging",
            &entries,
            pruning,
        )
        .await
        .expect("a config that matches");
        assert_eq!(asked_to(&asked.bodies()), [(true, true)]);
    }

    #[tokio::test]
    async fn an_apply_is_one_request_and_a_pruning_one_is_looked_at_first() {
        let entries = [entry("A", "1", false)];
        let applying = |flags, answers| {
            let entries = &entries;
            async move {
                let (config, asked) = answering(answers).await;
                let applied = apply_to(
                    &config,
                    &config.http_client(),
                    &wasm(),
                    "staging",
                    entries,
                    flags,
                )
                .await;
                (applied, asked)
            }
        };

        let done = diff(&["A"], &[], &[], &[]);
        let (applied, asked) = applying(ApplyFlags::default(), vec![answer(&done, true)]).await;
        applied.expect("applied");
        assert_eq!(asked_to(&asked.bodies()), [(false, false)]);

        let pruned = diff(&[], &[], &["OLD"], &["A"]);
        let (applied, asked) =
            applying(PRUNE, vec![answer(&pruned, false), answer(&pruned, true)]).await;
        applied.expect("applied");
        assert_eq!(asked.requests(), [APPLY, APPLY]);
        assert_eq!(
            asked_to(&asked.bodies()),
            [(true, true), (true, false)],
            "what a prune removes is read, and printed, before it is removed"
        );

        let (applied, asked) = applying(
            PRUNE,
            vec![Some((503, serde_json::json!({"error": "down"})))],
        )
        .await;
        assert!(applied.is_err());
        assert_eq!(
            asked.count(),
            1,
            "nothing is removed when what would be could not be read"
        );
    }

    #[tokio::test]
    async fn a_sync_is_one_set_where_the_platform_applies_one_and_key_by_key_elsewhere() {
        let entries = [entry("A", "1", false), entry("TOKEN", "t", true)];
        let saved = || Some((200, serde_json::json!({"status": "saved"})));
        let syncing = |platform: PlatformVersion, answers| {
            let entries = &entries;
            async move {
                let (config, asked) = answering(answers).await;
                let synced = synced(&config, &config.http_client(), "7", entries, &platform).await;
                (synced, asked)
            }
        };
        let each_key = [
            serde_json::json!({"key": "A", "value": "1", "is_secret": false}),
            serde_json::json!({"key": "TOKEN", "value": "t", "is_secret": true}),
        ];

        let (synced, asked) = syncing(
            platform("0.30.0", &["async_deploy", "config_apply"]),
            vec![answer(&diff(&["A", "TOKEN"], &[], &[], &[]), true)],
        )
        .await;
        synced.expect("applied");
        assert_eq!(asked.requests(), [APPLY]);
        let sent = &asked.bodies()[0];
        assert_eq!(
            (
                asked_to(&asked.bodies()),
                sent["entries"].as_array().map(Vec::len)
            ),
            (vec![(false, false)], Some(2)),
            "a deploy's config step removes nothing: a key set by hand survives it"
        );

        let (synced, asked) = syncing(
            platform("0.29.2", &["async_deploy"]),
            vec![saved(), saved()],
        )
        .await;
        synced.expect("synced");
        assert_eq!(
            asked.requests(),
            [PUT, PUT],
            "a platform that predates the apply is written to as it always was"
        );
        assert_eq!(asked.bodies(), each_key);

        let (synced, asked) = syncing(
            platform("0.30.0", &["config_apply"]),
            vec![Some((405, serde_json::Value::Null)), saved(), saved()],
        )
        .await;
        synced.expect("synced key by key");
        assert_eq!(
            asked.requests(),
            [APPLY, PUT, PUT],
            "a replica that predates the apply answered it: it is written to key by key"
        );
        assert_eq!(asked.bodies()[1..], each_key);

        let (failed, asked) = syncing(
            platform("0.29.2", &[]),
            vec![saved(), Some((500, serde_json::json!({"error": "down"})))],
        )
        .await;
        assert_eq!(
            failed.expect_err("a key that was not saved").to_string(),
            r#"Failed to sync secret 'TOKEN' (500 Internal Server Error): {"error":"down"}"#
        );
        assert_eq!(asked.count(), 2);

        let (failed, asked) = syncing(
            platform("0.30.0", &["config_apply"]),
            vec![Some((
                404,
                serde_json::json!({"error": "Service not found"}),
            ))],
        )
        .await;
        assert!(failed.is_err());
        assert_eq!(
            asked.count(),
            1,
            "only a 405 is a platform that predates it"
        );
    }

    #[test]
    fn resolves_config_only_passes_values_through() {
        let (_tmp, mut project) = make_project_with_vault("staging");
        project.environments.insert(
            "staging".to_string(),
            env_with(&[("NEXT_PUBLIC_API_URL", "https://api.example")], &[]),
        );

        let envs = resolve_local_envs(&project, "staging").unwrap();
        assert_eq!(
            envs.get("NEXT_PUBLIC_API_URL").map(String::as_str),
            Some("https://api.example")
        );
    }

    #[test]
    fn resolves_secrets_against_local_vault() {
        let (_tmp, mut project) = make_project_with_vault("staging");
        project.environments.insert(
            "staging".to_string(),
            env_with(
                &[],
                &[("NEXT_PUBLIC_GOOGLE_MAPS_API_KEY", "google_maps:api_key")],
            ),
        );

        let envs = resolve_local_envs(&project, "staging").unwrap();
        assert_eq!(
            envs.get("NEXT_PUBLIC_GOOGLE_MAPS_API_KEY")
                .map(String::as_str),
            Some("AIzaSyTEST")
        );
    }

    #[test]
    fn resolves_mixed_config_and_secrets() {
        let (_tmp, mut project) = make_project_with_vault("staging");
        project.environments.insert(
            "staging".to_string(),
            env_with(
                &[("NEXT_PUBLIC_API_URL", "https://api.example")],
                &[
                    ("NEXT_PUBLIC_GOOGLE_MAPS_API_KEY", "google_maps:api_key"),
                    ("POSTMARK_API_KEY", "postmark:api_key"),
                ],
            ),
        );

        let envs = resolve_local_envs(&project, "staging").unwrap();
        assert_eq!(envs.len(), 3);
        assert_eq!(envs["NEXT_PUBLIC_API_URL"], "https://api.example");
        assert_eq!(envs["NEXT_PUBLIC_GOOGLE_MAPS_API_KEY"], "AIzaSyTEST");
        assert_eq!(envs["POSTMARK_API_KEY"], "pm-test-token");
    }

    #[test]
    fn errors_when_referenced_secret_missing_from_vault() {
        let (_tmp, mut project) = make_project_with_vault("staging");
        project.environments.insert(
            "staging".to_string(),
            env_with(&[], &[("MISSING_VAR", "missing:secret")]),
        );

        let err = resolve_local_envs(&project, "staging").unwrap_err();
        assert!(err.to_string().contains("missing:secret"));
        assert!(err.to_string().contains("staging"));
    }

    #[test]
    fn errors_for_unknown_environment() {
        let (_tmp, project) = make_project_with_vault("staging");

        let err = resolve_local_envs(&project, "nope").unwrap_err();
        assert!(err.to_string().contains("nope"));
    }
}