//! Invariant: when `ENVSEAL_MCP_DISABLE_STORE` is set, `envseal_store` is refused
//! so plaintext is not sent over the MCP tool transport.

use std::sync::Mutex;

static ENV_LOCK: Mutex<()> = Mutex::new(());

#[test]
fn store_returns_error_when_disabled() {
    let _guard = ENV_LOCK
        .lock()
        .expect("serialize env var tests; env is process-global");

    std::env::set_var("ENVSEAL_MCP_DISABLE_STORE", "1");
    let runtime = tokio::runtime::Runtime::new().expect("create tokio runtime");
    let result = runtime.block_on(envseal_mcp::tools::store::execute(
        envseal_mcp::tools::store::StoreParams {
            name: "x".to_string(),
            value: "y".to_string(),
            force: false,
        },
    ));

    std::env::remove_var("ENVSEAL_MCP_DISABLE_STORE");

    let err = result.expect_err("envseal_store should be disabled");
    assert_eq!(
        err,
        envseal_mcp::settings::STORE_DISABLED_MESSAGE,
        "must match STORE_DISABLED_MESSAGE for operators and tests"
    );
}
