package distworker

import (
	"os"
	"path/filepath"
	"testing"

	"github.com/stretchr/testify/assert"
	"github.com/stretchr/testify/require"
)

func TestWorkerStateRoundTripUsesPrivatePermissions(t *testing.T) {
	dir := filepath.Join(t.TempDir(), "state")
	require.NoError(t, os.Mkdir(dir, 0o700))
	path := filepath.Join(dir, "state.json")
	want := workerState{Token: "secret", WorkerID: "worker-1", VerificationKey: "key", SigningKeyID: "key-2026", AccountID: 7, ConfigVersion: 2}
	require.NoError(t, saveWorkerState(path, want))
	info, err := os.Stat(path)
	require.NoError(t, err)
	assert.Equal(t, os.FileMode(0o600), info.Mode().Perm())
	got, err := loadWorkerState(path)
	require.NoError(t, err)
	assert.Equal(t, want, got)
}

func TestWorkerStateRejectsInsecurePermissions(t *testing.T) {
	dir := filepath.Join(t.TempDir(), "state")
	require.NoError(t, os.Mkdir(dir, 0o700))
	path := filepath.Join(dir, "state.json")
	require.NoError(t, os.WriteFile(path, []byte(`{"token":"secret"}`), 0o644))
	_, err := loadWorkerState(path)
	require.Error(t, err)
}