//! Regression for A3-01: `SecretDeliveryMode::default()` is the
//! `RuntimeLeasedBroker` variant, not `Env`.
//!
//! # Why this is a regression test, not a doc-comment promise
//!
//! `SecretDeliveryMode` is the field a spec uses to choose how secrets get
//! exposed to the workload. Before A3-01, the implicit default (when
//! `run.secretDelivery` was omitted) was `Env` — values materialized
//! straight into the child process environment with no revoke path, no TTL,
//! and no broker mediating fetches.
//!
//! A3-01 makes the recommended `RuntimeLeasedBroker` mode the default so
//! that operators must opt **into** raw env injection rather than opt out
//! of broker-mediated delivery. Flipping this default silently — by
//! deleting or reordering enum variants — would erase the security gain.
//!
//! This test exists so any change to the default fails the test suite
//! before it can ship.

use cellos_core::{ExecutionCellSpec, RunSpec, SecretDeliveryMode};

#[test]
fn default_is_runtime_leased_broker() {
    assert_eq!(
        SecretDeliveryMode::default(),
        SecretDeliveryMode::RuntimeLeasedBroker,
        "A3-01: omitting run.secretDelivery must default to RuntimeLeasedBroker"
    );
}

#[test]
fn explicit_env_still_round_trips() {
    // Existing specs that set Env explicitly must keep working — the default
    // change is only for specs that omit the field.
    let json = r#"{
        "argv": ["/usr/bin/true"],
        "secretDelivery": "env"
    }"#;
    let run: RunSpec = serde_json::from_str(json).expect("valid run spec");
    assert_eq!(run.secret_delivery, SecretDeliveryMode::Env);
}

#[test]
fn omitting_field_yields_runtime_leased_broker() {
    // Specs that omit `secretDelivery` get the new default.
    let json = r#"{
        "argv": ["/usr/bin/true"]
    }"#;
    let run: RunSpec = serde_json::from_str(json).expect("valid run spec");
    assert_eq!(
        run.secret_delivery,
        SecretDeliveryMode::RuntimeLeasedBroker,
        "A3-01: deserialized spec without secretDelivery field must use the new default"
    );
}

#[test]
fn execution_spec_run_inherits_default() {
    // End-to-end: a parsed spec where run.secretDelivery is omitted should
    // surface RuntimeLeasedBroker through the typed accessor path the
    // policy/admission code uses.
    let json = r#"{
        "id": "cell-a3-default",
        "run": {
            "argv": ["/usr/bin/true"]
        },
        "authority": {},
        "lifetime": {"ttlSeconds": 60}
    }"#;
    let spec: ExecutionCellSpec = serde_json::from_str(json).expect("valid spec");
    let run = spec.run.expect("run present");
    assert_eq!(run.secret_delivery, SecretDeliveryMode::RuntimeLeasedBroker);
}
