// SPDX-License-Identifier: AGPL-3.0-only OR LicenseRef-Commercial
// SPDX-FileCopyrightText: 2025-2026 Christian Galo

package cmd

import (
	"os"
	"path/filepath"
	"testing"
)

// The scaffold is the file the deployment's credentials are entered into
// (db-dsn, valkey-password, the OIDC and Temporal client secrets), so init
// creates it private (console-init: "The file SHALL be created with mode
// 0600"; security-audit-remediation-3). Under a 022 umask 0644 would have
// left it readable by every local user.
func TestInitWritesTheConfigFilePrivate(t *testing.T) {
	dir := filepath.Join(t.TempDir(), "instance")
	initCmd.Run(initCmd, []string{dir})

	info, err := os.Stat(filepath.Join(dir, "mc-config.yaml"))
	if err != nil {
		t.Fatalf("init wrote no mc-config.yaml: %v", err)
	}
	if mode := info.Mode().Perm(); mode != 0o600 {
		t.Fatalf("mc-config.yaml mode = %o, want 600", mode)
	}
}