"""Pinned base recipes need the secret versions declared by their own tag."""

import os
import sys

sys.path.insert(0, os.path.join(os.path.dirname(__file__), "..", "..", "runner"))
from harness import abra  # noqa: E402


def test_pinned_base_adds_removed_secret_without_overwriting_existing_version(
    monkeypatch, tmp_path
):
    monkeypatch.setenv("HOME", str(tmp_path))
    monkeypatch.setenv("ABRA_DIR", str(tmp_path / ".abra"))
    recipe = tmp_path / ".abra" / "recipes" / "lasuite-docs"
    recipe.mkdir(parents=True)
    (recipe / ".env.sample").write_text(
        "SECRET_COLLAB_SS_VERSION=v1\n"
        "SECRET_JWT_PK_VERSION=v1 # generate=false\n"
        "# SECRET_UNUSED_VERSION=v1\n"
    )
    env = tmp_path / ".abra" / "servers" / "default" / "test.example.env"
    env.parent.mkdir(parents=True)
    env.write_text("SECRET_JWT_PK_VERSION=v2\n")

    abra.ensure_secret_versions_from_recipe("lasuite-docs", "test.example")

    assert abra.env_get("test.example", "SECRET_COLLAB_SS_VERSION") == "v1"
    assert abra.env_get("test.example", "SECRET_JWT_PK_VERSION") == "v2"
    assert abra.env_get("test.example", "SECRET_UNUSED_VERSION") is None