//! Invariant: whitespace-only non-executable command arguments are rejected.
//!
//! `validate_command` must trim all argument segments, not just the executable,
//! to prevent shell-confusion via invisible whitespace injection.

#[tokio::test]
async fn rejects_whitespace_only_arg_in_inject() {
    let result = envseal_mcp::tools::inject::execute(envseal_mcp::tools::inject::InjectParams {
        mappings: vec![envseal_mcp::tools::inject::InjectMapping {
            secret: "api-key".to_string(),
            env_var: "API_KEY".to_string(),
        }],
        command: vec!["/bin/echo".to_string(), "   ".to_string()],
    })
    .await;

    let err = result.expect_err("expected whitespace-only argument to be rejected");
    assert!(
        err.contains("command arguments must not be empty or whitespace-only"),
        "unexpected error: {err}"
    );
}

#[tokio::test]
async fn rejects_whitespace_only_arg_in_pipe() {
    let result = envseal_mcp::tools::pipe::execute(envseal_mcp::tools::pipe::PipeParams {
        secret_name: "token".to_string(),
        command: vec!["/bin/cat".to_string(), "\t".to_string()],
    })
    .await;

    let err = result.expect_err("expected tab-only argument to be rejected");
    assert!(
        err.contains("command arguments must not be empty or whitespace-only"),
        "unexpected error: {err}"
    );
}
