package store

import (
	"database/sql"
	"testing"
)

// The host-scoped consume-once contract (PBS DR SLICE 1): exactly one read per stored value,
// a re-save resets the consumed flag (re-issue supersedes), absence is sql.ErrNoRows.
func TestHostPBSSecret_ConsumeOnce(t *testing.T) {
	s := newTestStore(t)

	if _, err := s.ConsumeHostPBSSecret("h1"); err != sql.ErrNoRows {
		t.Fatalf("consume with nothing stored = %v, want sql.ErrNoRows", err)
	}

	if err := s.SaveHostPBSSecret("h1", "secret-1"); err != nil {
		t.Fatalf("save: %v", err)
	}
	got, err := s.ConsumeHostPBSSecret("h1")
	if err != nil || got != "secret-1" {
		t.Fatalf("first consume = (%q, %v), want (secret-1, nil)", got, err)
	}
	// Single use: the second consume MUST be ErrNoRows (red-proof: dropping the consumed_at
	// UPDATE in ConsumeHostPBSSecret makes this assert fail with the value returned again).
	if got, err := s.ConsumeHostPBSSecret("h1"); err != sql.ErrNoRows {
		t.Fatalf("second consume = (%q, %v), want sql.ErrNoRows — consume-once broken", got, err)
	}

	// Re-issue path: a fresh save resets consumption and serves the NEW value once.
	if err := s.SaveHostPBSSecret("h1", "secret-2"); err != nil {
		t.Fatalf("re-save: %v", err)
	}
	got, err = s.ConsumeHostPBSSecret("h1")
	if err != nil || got != "secret-2" {
		t.Fatalf("post-reissue consume = (%q, %v), want (secret-2, nil)", got, err)
	}

	// Host isolation: h2 never sees h1's rows.
	if _, err := s.ConsumeHostPBSSecret("h2"); err != sql.ErrNoRows {
		t.Fatalf("foreign host consume = %v, want sql.ErrNoRows", err)
	}
}