#!/usr/bin/env bash
set -x

cat >"$HOME/bin/sops" <<'EOF'
#!/usr/bin/env bash
set -euo pipefail

printf '%s\n' "$*" >>"$HOME/sops-invocations"
cat >/dev/null

if [[ ${FAKE_SOPS_FAIL:-0} == 1 ]]; then
  exit 42
fi

cat <<'YAML'
SECRET: kms-secret
YAML
EOF
chmod +x "$HOME/bin/sops"

cat >.env.yaml <<'YAML'
SECRET: ENC[AES256_GCM,data:ZmFrZQ==,iv:ZmFrZQ==,tag:ZmFrZQ==,type:str]
sops:
  kms:
    - arn: arn:aws:kms:us-east-1:123456789012:key/example
      enc: fake
  version: 3.9.4
YAML

cat >mise.toml <<'TOML'
[env]
_.file = ".env.yaml"
TOML

export MISE_SOPS_ROPS=0
export MISE_SOPS_STRICT=0
unset MISE_SOPS_AGE_KEY MISE_SOPS_AGE_KEY_FILE SOPS_AGE_KEY SOPS_AGE_KEY_FILE

# The external CLI decides how to decrypt the file, even when no age key exists.
assert_contains "mise env" "export SECRET=kms-secret"
assert_contains "cat \"$HOME/sops-invocations\"" "decrypt --input-type yaml --output-type yaml"
assert_not_contains "cat \"$HOME/sops-invocations\"" "/dev/stdin"

# Non-strict mode still skips a file when the external CLI actually fails.
export FAKE_SOPS_FAIL=1
assert_not_contains "mise env" "SECRET"

# Strict mode still propagates the external CLI failure.
export MISE_SOPS_STRICT=1
assert_fail "mise env"

# The built-in rops path still skips files without an age key in non-strict mode.
export FAKE_SOPS_FAIL=0
export MISE_SOPS_ROPS=1
export MISE_SOPS_STRICT=0
before="$(wc -l <"$HOME/sops-invocations")"
assert_not_contains "mise env" "SECRET"
after="$(wc -l <"$HOME/sops-invocations")"
assert "test \"$before\" = \"$after\""
