import 'dart:io';

import 'package:flutter_test/flutter_test.dart';

/// ─────────────────────────────────────────────────────────────────────────
/// NO CREDENTIAL MAY BE A LITERAL IN THE BINARY
///
/// Three files carried a DigitalOcean Spaces access key and secret key as
/// `const String` literals, compiled into every APK the app has shipped.
/// Anyone with the binary could read them with `strings`, and the pair was
/// read-write on the whole `doormile` bucket — every rider's proof photo, for
/// every tenant, readable and deletable by anybody who had installed the app
/// once.
///
/// They come from `--dart-define` now. This is the guard that stops the next
/// one going in, because the failure is silent: the code works perfectly with a
/// literal, and nothing about it looks wrong in review.
///
/// **This test does not undo the exposure.** The pair is in this repository's
/// history and has been distributed; it has to be rotated, and the upload
/// belongs behind a server-issued signed URL.
/// ─────────────────────────────────────────────────────────────────────────
void main() {
  test('no source file assigns a credential-shaped literal', () {
    // Names that mean "this is a secret", assigned a quoted literal of any
    // length that is not obviously empty.
    final assignment = RegExp(
      r'''(accessKey|secretKey|apiKey|apiSecret|password|privateKey|'''
      r'''clientSecret|authToken)\s*=\s*["'][^"']{8,}["']''',
      caseSensitive: false,
    );

    final offenders = <String>[];
    for (final entity in Directory('lib').listSync(recursive: true)) {
      if (entity is! File || !entity.path.endsWith('.dart')) continue;
      final lines = entity.readAsLinesSync();
      for (var i = 0; i < lines.length; i++) {
        final code = lines[i].trim();
        if (code.startsWith('//') || code.startsWith('///')) continue;
        // `String.fromEnvironment('SPACES_KEY')` is the fix, not the fault.
        if (code.contains('fromEnvironment')) continue;
        if (assignment.hasMatch(code)) {
          offenders.add('${entity.path}:${i + 1}');
        }
      }
    }

    expect(
      offenders,
      isEmpty,
      reason:
          'a credential compiled into the app is readable by anyone who '
          'installs it — pass it with --dart-define and rotate anything that '
          'has already shipped',
    );
  });
}