#2436 serve: boot token-secret migration deletes the source vault item

// serve's boot-time token secret migration deletes the source vault item.
//
// Runs swamp main's own migrateTokenSecrets() (src/serve/token_secret_migration.ts)
// with in-memory fakes: a "legacy" server token whose secret lives in a user vault
// ("team-vault", e.g. a 1Password vault that CI also reads). After migration the
// secret is copied to _token-secrets AND deleted from the user vault.
//
//   SWAMP_SRC=<swamp checkout> deno test -A migration_deletes_vault_item_test.ts
import { assertEquals } from "jsr:@std/assert@1";

const SRC = Deno.env.get("SWAMP_SRC")!;
const { migrateTokenSecrets } = await import(`${SRC}/src/serve/token_secret_migration.ts`);
const { TOKEN_SECRETS_VAULT_NAME } = await import(`${SRC}/src/domain/vaults/control_plane_vault_provider.ts`);

class FakeVaults {
  store = new Map<string, Map<string, string>>();
  log: string[] = [];
  constructor(init: Record<string, Record<string, string>>) {
    for (const [v, kv] of Object.entries(init)) this.store.set(v, new Map(Object.entries(kv)));
  }
  get(vault: string, key: string) {
    const v = this.store.get(vault)?.get(key);
    if (v === undefined) return Promise.reject(new Error(`missing ${vault}/${key}`));
    return Promise.resolve(v);
  }
  put(vault: string, key: string, value: string) {
    if (!this.store.has(vault)) this.store.set(vault, new Map());
    this.store.get(vault)!.set(key, value);
    this.log.push(`put ${vault}/${key}`);
    return Promise.resolve();
  }
  supportsDelete(_vault: string) { return true; }
  delete(vault: string, key: string) {
    this.store.get(vault)?.delete(key);
    this.log.push(`delete ${vault}/${key}`);
    return Promise.resolve();
  }
}

Deno.test("migrateTokenSecrets deletes the user-vault item after copying it", async () => {
  const vaults = new FakeVaults({ "team-vault": { "server-token-ci-deploy": "s3cr3t" } });
  const now = new Date().toISOString();
  const later = new Date(Date.now() + 86_400_000).toISOString();
  const record = {
    attributes: {
      name: "ci-deploy", state: "active", principalId: "user:ci", principalEmail: "ci@example.com",
      collectives: [], groups: [], createdAt: now, expiresAt: later,
      vaultName: "team-vault", secretKey: "server-token-ci-deploy",
    },
  };
  const result = await migrateTokenSecrets({
    tokenSecretsVaultName: TOKEN_SECRETS_VAULT_NAME,
    // deno-lint-ignore no-explicit-any
    vaultService: vaults as any,
    // deno-lint-ignore no-explicit-any
    dataQueryService: { query: () => Promise.resolve([record]) } as any,
    updateTokenVaultName: () => Promise.resolve(),
  });

  console.log("result:", JSON.stringify(result));
  console.log("vault operations:", vaults.log.join(" | "));
  console.log("team-vault still has server-token-ci-deploy:", vaults.store.get("team-vault")!.has("server-token-ci-deploy"));

  assertEquals(result.migrated, 1);
  assertEquals(vaults.store.get(TOKEN_SECRETS_VAULT_NAME)!.get("server-token-ci-deploy"), "s3cr3t");
  // The behaviour this issue is about: the external consumer's item is gone.
  assertEquals(vaults.store.get("team-vault")!.has("server-token-ci-deploy"), false);
});