package auth

import (
	"os"
	"path/filepath"
	"runtime"
	"testing"
)

func TestSaveXVeraeToken(t *testing.T) {
	home := t.TempDir()
	t.Setenv("HOME", home)
	t.Setenv("USERPROFILE", home)        // os.UserHomeDir on Windows
	t.Setenv("XVERAE_TOKEN", "")         // force file path
	t.Setenv("VERAE_SKIP_KEYCHAIN", "1") // never touch the real login keychain
	if err := SaveXVeraeToken("xVerae-testtoken123"); err != nil {
		t.Fatal(err)
	}
	p := filepath.Join(home, ".verae", "xverae-token")
	b, err := os.ReadFile(p)
	if err != nil {
		t.Fatal(err)
	}
	if string(b) != "xVerae-testtoken123\n" {
		t.Fatalf("%q", b)
	}
	st, _ := os.Stat(p)
	if runtime.GOOS != "windows" && st.Mode().Perm()&0o077 != 0 { // NTFS uses ACLs, not mode bits
		t.Fatalf("perms %v", st.Mode())
	}
}