use std::{

    collections::HashMap,

    path::{Path, PathBuf},

    sync::Arc,

};

#[cfg(feature = "async-std")]

use async_fs as fs;

#[cfg(feature = "async-std")]

use async_lock::{Mutex, RwLock};

#[cfg(feature = "async-std")]

use futures_lite::AsyncReadExt;

#[cfg(feature = "tokio")]

use tokio::{

    fs,

    io::AsyncReadExt,

    sync::{Mutex, RwLock},

};

use crate::{

    AsAttributes, Key, Secret,

    file::{Error, InvalidItemError, Item, LockedItem, LockedKeyring, UnlockedItem, api},

};

type ItemDefinition = (String, HashMap<String, String>, Secret, bool);

/// File backed keyring.

#[derive(Debug)]

pub struct UnlockedKeyring {

    pub(super) keyring: Arc<RwLock<api::Keyring>>,

    pub(super) path: Option<PathBuf>,

    /// Times are stored before reading the file to detect

    /// file changes before writing

    pub(super) mtime: Mutex<Option<std::time::SystemTime>>,

    pub(super) key: Mutex<Option<Arc<Key>>>,

    pub(super) secret: Mutex<Arc<Secret>>,

}

impl UnlockedKeyring {

    /// Load from a keyring file.

    ///

    /// # Arguments

    ///

    /// * `path` - The path to the file backend.

    /// * `secret` - The service key, usually retrieved from the Secrets portal.

    #[cfg_attr(feature = "tracing", tracing::instrument(skip(secret), fields(path = ?path.as_ref())))]

    }

    /// Load from a keyring file.

    ///

    /// # Arguments

    ///

    /// * `path` - The path to the file backend.

    /// * `secret` - The service key, usually retrieved from the Secrets portal.

    ///

    /// # Safety

    ///

    /// The secret is not validated to be the correct one to decrypt the keyring

    /// items. Allowing the API user to write new items with a different

    /// secret on top of previously added items with a different secret.

    ///

    /// As it is not a supported behaviour, this API is mostly meant for

    /// recovering broken keyrings.

    #[cfg_attr(feature = "tracing", tracing::instrument(skip(secret), fields(path = ?path.as_ref())))]

        path: impl AsRef<Path>,

        secret: Secret,

    ) -> Result<Self, Error> {

    }

    #[cfg_attr(feature = "tracing", tracing::instrument(skip(secret), fields(path = ?path.as_ref(), validate_items = validate_items)))]

        path: impl AsRef<Path>,

        secret: Secret,

        validate_items: bool,

    ) -> Result<Self, Error> {

        } else {

            unsafe {

            }

        }

    }

    /// Creates a temporary backend, that is never stored on disk.

    #[cfg_attr(feature = "tracing", tracing::instrument(skip(secret)))]

        })

    }

    #[cfg_attr(feature = "tracing", tracing::instrument(skip(file, secret), fields(path = ?path.as_ref())))]

        file: &mut fs::File,

        path: impl AsRef<Path>,

        secret: Secret,

    ) -> Result<Self, Error> {

            }),

            {

                #[cfg(feature = "tracing")]

                }

                })

            }

        }

    }

    /// Open a keyring with given name from the default directory.

    ///

    /// This function will automatically migrate the keyring to the

    /// latest format.

    ///

    /// # Arguments

    ///

    /// * `name` - The name of the keyring.

    /// * `secret` - The service key, usually retrieved from the Secrets portal.

    #[cfg_attr(feature = "tracing", tracing::instrument(skip(secret)))]

            tracing::debug!("Loading v1 keyring file");

        }

            tracing::debug!("Trying to load keyring file at {:?}", v0_path);

            }

        } else {

            tracing::debug!("Creating new keyring");

            })

        }

    }

    /// Lock the keyring.

        LockedKeyring {

        }

    }

    /// Lock an item using the keyring's key.

    #[cfg_attr(feature = "tracing", tracing::instrument(skip(self, item)))]

    }

    /// Unlock an item using the keyring's key.

    #[cfg_attr(feature = "tracing", tracing::instrument(skip(self, item)))]

    }

    /// Get the encryption key for this keyring.

    #[cfg_attr(feature = "tracing", tracing::instrument(skip(self)))]

    }

    /// Return the associated file if any.

    }

    /// Get the modification timestamp

    }

    /// Retrieve the number of items

    ///

    /// This function will not trigger a key derivation and can therefore be

    /// faster than [`items().len()`](Self::items).

    #[cfg_attr(feature = "tracing", tracing::instrument(skip(self)))]

    }

    /// Retrieve the list of available [`UnlockedItem`]s.

    ///

    /// If items cannot be decrypted, [`InvalidItemError`]s are returned for

    /// them instead of [`UnlockedItem`]s.

    #[cfg_attr(feature = "tracing", tracing::instrument(skip(self)))]

        #[cfg(feature = "tracing")]

            .items

                        )

                    })

            })

    }

    /// Search items matching the attributes.

    #[cfg_attr(feature = "tracing", tracing::instrument(skip(self, attributes)))]

            .into_iter()

            .collect::<Vec<Item>>();

        tracing::debug!("Found {} matching items", results.len());

    }

    /// Find the first item matching the attributes.

    #[cfg_attr(feature = "tracing", tracing::instrument(skip(self, attributes)))]

    }

    /// Find the index in the list of items of the first item matching the

    /// attributes.

    #[cfg_attr(feature = "tracing", tracing::instrument(skip(self, attributes)))]

        &self,

        attributes: &impl AsAttributes,

    ) -> Result<Option<usize>, Error> {

    }

    /// Delete an item.

    #[cfg_attr(feature = "tracing", tracing::instrument(skip(self, attributes)))]

        #[cfg(feature = "tracing")]

        {

        };

        #[cfg(feature = "tracing")]

        {

        }

    }

    /// Create a new item

    ///

    /// # Arguments

    ///

    /// * `label` - A user visible label of the item.

    /// * `attributes` - A map of key/value attributes, used to find the item

    ///   later.

    /// * `secret` - The secret to store.

    /// * `replace` - Whether to replace the value if the `attributes` matches

    ///   an existing `secret`.

    #[cfg_attr(feature = "tracing", tracing::instrument(skip(self, secret, attributes), fields(replace = replace)))]

        &self,

        label: &str,

        attributes: &impl AsAttributes,

        secret: impl Into<Secret>,

        replace: bool,

    ) -> Result<Item, Error> {

            }

        };

            }

            }

        }

    }

    /// Replaces item at the given index.

    ///

    /// The `index` refers to the index of the [`Vec`] returned by

    /// [`items()`](Self::items). If the index does not exist, the functions

    /// returns an error.

    #[cfg_attr(feature = "tracing", tracing::instrument(skip(self, item), fields(index = index)))]

        {

            } else {

            }

        }

    }

    /// Deletes item at the given index.

    ///

    /// The `index` refers to the index of the [`Vec`] returned by

    /// [`items()`](Self::items). If the index does not exist, the functions

    /// returns an error.

    #[cfg_attr(feature = "tracing", tracing::instrument(skip(self), fields(index = index)))]

        {

            } else {

            }

        }

    }

    /// Helper used for migration to avoid re-writing the file multiple times

    #[cfg_attr(feature = "tracing", tracing::instrument(skip(self, items), fields(item_count = items.len())))]

        #[cfg(feature = "tracing")]

            }

        }

        tracing::debug!("Writing keyring back to the file");

            // Update mtime after successful write

            }

        }

    }

    /// Write the changes to the keyring file.

    #[cfg_attr(feature = "tracing", tracing::instrument(skip(self)))]

        {

            }

        };

        };

        }

    }

    /// Return key, derive and store it first if not initialized

    #[cfg_attr(feature = "tracing", tracing::instrument(skip(self)))]

            #[cfg(feature = "async-std")]

            let key = blocking::unblock(move || {

                async_io::block_on(async { keyring.read().await.derive_key(&secret) })

            })

            .await?;

            #[cfg(feature = "tokio")]

            let key = {

                    .unwrap()?

            };

        }

    }

    /// Change keyring secret

    ///

    /// # Arguments

    ///

    /// * `secret` - The new secret to store.

    #[cfg_attr(feature = "tracing", tracing::instrument(skip(self, secret)))]

        #[cfg(feature = "tracing")]

            tracing::debug_span!("decrypt_for_reencrypt", total_items = keyring.items.len());

        }

        tracing::debug!("Updating secret and resetting key");

        // Unset the old key

        // Reset Keyring content before setting the new key

        // Set new key

        #[cfg(feature = "tracing")]

        }

    }

    /// Validate that a secret can decrypt the items in this keyring.

    ///

    /// For empty keyrings, this always returns `true` since there are no items

    /// to validate against.

    ///

    /// # Arguments

    ///

    /// * `secret` - The secret to validate.

    #[cfg_attr(feature = "tracing", tracing::instrument(skip(self, secret)))]

    }

    /// Delete any item that cannot be decrypted with the key associated to the

    /// keyring.

    ///

    /// This can only happen if an item was created using

    /// [`Self::load_unchecked`] or prior to 0.4 where we didn't validate

    /// the secret when using [`Self::load`] or modified externally.

    #[cfg_attr(feature = "tracing", tracing::instrument(skip(self)))]

        #[cfg(feature = "tracing")]

            }

        }

        tracing::info!("Found {} broken items to delete", n_broken_items);

        #[cfg(feature = "tracing")]

        }

    }

}

#[cfg(test)]

#[cfg(feature = "tokio")]

mod tests {

    use std::{collections::HashMap, path::PathBuf};

    use tempfile::tempdir;

    use super::*;

    use crate::file::{InvalidItemError, WeakKeyError};

    #[tokio::test]

    async fn repeated_write() -> Result<(), Error> {

        let path = PathBuf::from("../../tests/test.keyring");

        let secret = Secret::from(vec![1, 2]);

        let keyring = UnlockedKeyring::load(&path, secret).await?;

        keyring.write().await?;

        keyring.write().await?;

        Ok(())

    }

    #[tokio::test]

    async fn delete() -> Result<(), Error> {

        let path = PathBuf::from("../../tests/test-delete.keyring");

        let keyring = UnlockedKeyring::load(&path, strong_key()).await?;

        let attributes: HashMap<&str, &str> = HashMap::default();

        keyring

            .create_item("Label", &attributes, "secret", false)

            .await?;

        keyring.delete_item_index(0).await?;

        let result = keyring.delete_item_index(100).await;

        assert!(matches!(result, Err(Error::InvalidItemIndex(100))));

        Ok(())

    }

    #[tokio::test]

    async fn write_with_weak_key() -> Result<(), Error> {

        let path = PathBuf::from("../../tests/write_with_weak_key.keyring");

        let secret = Secret::from(vec![1, 2]);

        let keyring = UnlockedKeyring::load(&path, secret).await?;

        let attributes: HashMap<&str, &str> = HashMap::default();

        let result = keyring

            .create_item("label", &attributes, "my-password", false)

            .await;

        assert!(matches!(

            result,

            Err(Error::WeakKey(WeakKeyError::PasswordTooShort(2)))

        ));

        Ok(())

    }

    #[tokio::test]

    async fn write_with_strong_key() -> Result<(), Error> {

        let path = PathBuf::from("../../tests/write_with_strong_key.keyring");

        let keyring = UnlockedKeyring::load(&path, strong_key()).await?;

        let attributes: HashMap<&str, &str> = HashMap::default();

        keyring

            .create_item("label", &attributes, "my-password", false)

            .await?;

        Ok(())

    }

    fn strong_key() -> Secret {

        Secret::from([1, 2].into_iter().cycle().take(64).collect::<Vec<_>>())

    }

    #[tokio::test]

    async fn concurrent_writes() -> Result<(), Error> {

        let path = PathBuf::from("../../tests/concurrent_writes.keyring");

        let keyring = Arc::new(UnlockedKeyring::load(&path, strong_key()).await?);

        let keyring_clone = keyring.clone();

        let handle_1 = tokio::task::spawn(async move { keyring_clone.write().await });

        let handle_2 = tokio::task::spawn(async move { keyring.write().await });

        let (res_1, res_2) = futures_util::future::join(handle_1, handle_2).await;

        res_1.unwrap()?;

        res_2.unwrap()?;

        Ok(())

    }

    async fn check_items(keyring: &UnlockedKeyring) -> Result<(), Error> {

        assert_eq!(keyring.n_items().await, 1);

        let items: Result<Vec<_>, _> = keyring.items().await?.into_iter().collect();

        let items = items.expect("unable to retrieve items");

        assert_eq!(items.len(), 1);

        assert_eq!(items[0].as_unlocked().label(), "foo");

        assert_eq!(items[0].as_unlocked().secret(), Secret::blob("foo"));

        let attributes = items[0].as_unlocked().attributes();

        assert_eq!(attributes.len(), 2);

        assert_eq!(

            attributes

                .get(crate::XDG_SCHEMA_ATTRIBUTE)

                .map(|v| v.as_ref()),

            Some("org.gnome.keyring.Note")

        );

        Ok(())

    }

    #[tokio::test]

    #[serial_test::serial]

    async fn migrate_from_legacy() -> Result<(), Error> {

        let data_dir = tempdir()?;

        let v0_dir = data_dir.path().join("keyrings");

        let v1_dir = v0_dir.join("v1");

        fs::create_dir_all(&v1_dir).await?;

        let fixture_path = PathBuf::from(env!("CARGO_MANIFEST_DIR"))

            .join("fixtures")

            .join("legacy.keyring");

        fs::copy(&fixture_path, &v0_dir.join("default.keyring")).await?;

        unsafe {

            std::env::set_var("XDG_DATA_HOME", data_dir.path());

        }

        assert!(!v1_dir.join("default.keyring").exists());

        let secret = Secret::blob("test");

        let keyring = UnlockedKeyring::open("default", secret).await?;

        check_items(&keyring).await?;

        keyring.write().await?;

        assert!(v1_dir.join("default.keyring").exists());

        Ok(())

    }

    #[tokio::test]

    #[serial_test::serial]

    async fn migrate() -> Result<(), Error> {

        let data_dir = tempdir()?;

        let v0_dir = data_dir.path().join("keyrings");

        let v1_dir = v0_dir.join("v1");

        fs::create_dir_all(&v1_dir).await?;

        let fixture_path = PathBuf::from(env!("CARGO_MANIFEST_DIR"))

            .join("fixtures")

            .join("default.keyring");

        fs::copy(&fixture_path, &v0_dir.join("default.keyring")).await?;

        unsafe {

            std::env::set_var("XDG_DATA_HOME", data_dir.path());

        }

        let secret = Secret::blob("test");

        let keyring = UnlockedKeyring::open("default", secret).await?;

        assert!(!v1_dir.join("default.keyring").exists());

        check_items(&keyring).await?;

        keyring.write().await?;

        assert!(v1_dir.join("default.keyring").exists());

        Ok(())

    }

    #[tokio::test]

    #[serial_test::serial]

    async fn open_wrong_password() -> Result<(), Error> {

        let data_dir = tempdir()?;

        let v0_dir = data_dir.path().join("keyrings");

        let v1_dir = v0_dir.join("v1");

        fs::create_dir_all(&v1_dir).await?;

        let fixture_path = PathBuf::from(env!("CARGO_MANIFEST_DIR"))

            .join("fixtures")

            .join("default.keyring");

        fs::copy(&fixture_path, &v1_dir.join("default.keyring")).await?;

        unsafe {

            std::env::set_var("XDG_DATA_HOME", data_dir.path());

        }

        let secret = Secret::blob("wrong");

        let keyring = UnlockedKeyring::open("default", secret).await;

        assert!(keyring.is_err());

        assert!(matches!(keyring.unwrap_err(), Error::IncorrectSecret));

        let secret = Secret::blob("test");

        let keyring = UnlockedKeyring::open("default", secret).await;

        assert!(keyring.is_ok());

        Ok(())

    }

    #[tokio::test]

    #[serial_test::serial]

    async fn open() -> Result<(), Error> {

        let data_dir = tempdir()?;

        let v0_dir = data_dir.path().join("keyrings");

        let v1_dir = v0_dir.join("v1");

        fs::create_dir_all(&v1_dir).await?;

        let fixture_path = PathBuf::from(env!("CARGO_MANIFEST_DIR"))

            .join("fixtures")

            .join("default.keyring");

        fs::copy(&fixture_path, &v1_dir.join("default.keyring")).await?;

        unsafe {

            std::env::set_var("XDG_DATA_HOME", data_dir.path());

        }

        let secret = Secret::blob("test");

        let keyring = UnlockedKeyring::open("default", secret).await?;

        assert!(v1_dir.join("default.keyring").exists());

        check_items(&keyring).await?;

        keyring.write().await?;

        assert!(v1_dir.join("default.keyring").exists());

        Ok(())

    }

    #[tokio::test]

    #[serial_test::serial]

    async fn open_nonexistent() -> Result<(), Error> {

        let data_dir = tempdir()?;

        let v0_dir = data_dir.path().join("keyrings");

        let v1_dir = v0_dir.join("v1");

        fs::create_dir_all(&v1_dir).await?;

        unsafe {

            std::env::set_var("XDG_DATA_HOME", data_dir.path());

        }

        let secret = Secret::blob("test");

        let keyring = UnlockedKeyring::open("default", secret).await?;

        assert!(!v1_dir.join("default.keyring").exists());

        keyring

            .create_item(

                "foo",

                &[(crate::XDG_SCHEMA_ATTRIBUTE, "org.gnome.keyring.Note")],

                "foo",

                false,

            )

            .await?;

        keyring.write().await?;

        assert!(v1_dir.join("default.keyring").exists());

        Ok(())

    }

    #[tokio::test]

    async fn delete_broken_items() -> Result<(), Error> {

        const VALID_TO_ADD: usize = 5;

        const BROKEN_TO_ADD: usize = 3;

        let data_dir = tempdir()?;

        let v0_dir = data_dir.path().join("keyrings");

        let v1_dir = v0_dir.join("v1");

        fs::create_dir_all(&v1_dir).await?;

        let fixture_path = PathBuf::from(env!("CARGO_MANIFEST_DIR"))

            .join("fixtures")

            .join("default.keyring");

        let keyring_path = v1_dir.join("default.keyring");

        fs::copy(&fixture_path, &keyring_path).await?;

        // 1) Load with the correct password and add several valid items. This ensures

        //    valid_items > broken_items that we'll add later.

        let keyring = UnlockedKeyring::load(&keyring_path, Secret::blob("test")).await?;

        for i in 0..VALID_TO_ADD {

            keyring

                .create_item(

                    &format!("valid {}", i),

                    &[("attr_valid", "value")],

                    format!("password_valid_{}", i),

                    false,

                )

                .await?;

        }

        drop(keyring);

        // 2) Load_unchecked with the wrong password and add a few "broken" items.

        let keyring = unsafe {

            UnlockedKeyring::load_unchecked(&keyring_path, Secret::blob("wrong_password")).await?

        };

        for i in 0..BROKEN_TO_ADD {

            keyring

                .create_item(

                    &format!("bad{}", i),

                    &[("attr_bad", "value_bad")],

                    format!("pw_bad{}", i),

                    false,

                )

                .await?;

        }

        drop(keyring);

        // 3) Load with the correct password and run the deletion.

        let keyring = UnlockedKeyring::load(&keyring_path, Secret::blob("test")).await?;

        let removed = keyring.delete_broken_items().await?;

        assert!(

            removed >= BROKEN_TO_ADD,

            "expected at least {} broken items removed, got {}",

            BROKEN_TO_ADD,

            removed

        );

        // Second call should find nothing left to clean up.

        assert_eq!(keyring.delete_broken_items().await?, 0);

        fs::remove_file(keyring_path).await?;

        Ok(())

    }

    #[tokio::test]

    async fn change_secret() -> Result<(), Error> {

        let data_dir = tempdir()?;

        let v0_dir = data_dir.path().join("keyrings");

        let v1_dir = v0_dir.join("v1");

        fs::create_dir_all(&v1_dir).await?;

        let fixture_path = PathBuf::from(env!("CARGO_MANIFEST_DIR"))

            .join("fixtures")

            .join("default.keyring");

        let keyring_path = v1_dir.join("default.keyring");

        fs::copy(&fixture_path, &keyring_path).await?;

        let keyring = UnlockedKeyring::load(&keyring_path, Secret::blob("test")).await?;

        let attributes = &[("attr", "value")];

        let item_before = keyring

            .create_item("test", attributes, "password", false)

            .await?;

        let item_before = item_before.as_unlocked();

        let secret = Secret::blob("new_secret");

        keyring.change_secret(secret).await?;

        let secret = Secret::blob("new_secret");

        let keyring = UnlockedKeyring::load(&keyring_path, secret).await?;

        let item_now = keyring.lookup_item(attributes).await?.unwrap();

        let item_now = item_now.as_unlocked();

        assert_eq!(item_before.label(), item_now.label());

        assert_eq!(item_before.secret(), item_now.secret());

        assert_eq!(item_before.attributes(), item_now.attributes());

        // No items were broken during the secret change

        assert_eq!(keyring.delete_broken_items().await?, 0);

        fs::remove_file(keyring_path).await?;

        Ok(())

    }

    #[tokio::test]

    async fn content_type() -> Result<(), Error> {

        use crate::secret::ContentType;

        let keyring = UnlockedKeyring::temporary(Secret::blob("test_password")).await?;

        // Add items with different MIME types

        keyring

            .create_item(

                "Text",

                &[("type", "text")],

                Secret::text("Hello, World!"),

                false,

            )

            .await?;

        keyring

            .create_item(

                "Password",

                &[("type", "password")],

                Secret::blob("super_secret_password"),

                false,

            )

            .await?;

        let items = keyring.search_items(&[("type", "text")]).await?;

        assert_eq!(items.len(), 1);

        assert_eq!(

            items[0].as_unlocked().secret().content_type(),

            ContentType::Text

        );

        let items = keyring.search_items(&[("type", "password")]).await?;

        assert_eq!(items.len(), 1);

        assert_eq!(

            items[0].as_unlocked().secret().content_type(),

            ContentType::Blob

        );

        Ok(())

    }

    #[tokio::test]

    async fn wrong_password_error_type() -> Result<(), Error> {

        let temp_dir = tempdir().unwrap();

        let keyring_path = temp_dir.path().join("wrong_password_test.keyring");

        let correct_secret = Secret::from("correct-password-that-is-long-enough".as_bytes());

        let wrong_secret = Secret::from("wrong-password-that-is-long-enough".as_bytes());

        // Create a keyring with the correct password

        let keyring = UnlockedKeyring::load(&keyring_path, correct_secret).await?;

        keyring

            .create_item("Test Item", &[("app", "test")], "my-secret", false)

            .await?;

        // Try to load with wrong password

        let result = UnlockedKeyring::load(&keyring_path, wrong_secret).await;

        // Verify this returns IncorrectSecret, not ChecksumMismatch

        assert!(matches!(result, Err(Error::IncorrectSecret)));

        Ok(())

    }

    #[tokio::test]

    async fn comprehensive_search_patterns() -> Result<(), Error> {

        let temp_dir = tempdir().unwrap();

        let keyring_path = temp_dir.path().join("search_test.keyring");

        let keyring = UnlockedKeyring::load(&keyring_path, strong_key()).await?;

        // Create diverse test data

        let test_items = vec![

            (

                "Email Password",

                vec![

                    ("app", "email"),

                    ("user", "alice@example.com"),

                    ("type", "password"),

                ],

            ),

            (

                "Email Token",

                vec![

                    ("app", "email"),

                    ("user", "alice@example.com"),

                    ("type", "token"),

                ],

            ),

            (

                "SSH Key",

                vec![("app", "ssh"), ("user", "alice"), ("type", "key")],

            ),

            (

                "Database Password",

                vec![

                    ("app", "database"),

                    ("env", "production"),

                    ("type", "password"),

                ],

            ),

            (

                "API Key",

                vec![("app", "api"), ("service", "github"), ("type", "key")],

            ),

        ];

        for (i, (label, attrs)) in test_items.iter().enumerate() {

            let attrs_map: HashMap<&str, &str> = attrs.iter().cloned().collect();

            keyring

                .create_item(label, &attrs_map, format!("secret{}", i), false)

                .await?;

        }

        // Test exact match

        let exact = keyring

            .search_items(&[

                ("app", "email"),

                ("user", "alice@example.com"),

                ("type", "password"),

            ])

            .await?;

        assert_eq!(exact.len(), 1);

        assert_eq!(exact[0].as_unlocked().label(), "Email Password");

        // Test partial match - by app

        let email_items = keyring.search_items(&[("app", "email")]).await?;

        assert_eq!(email_items.len(), 2);

        // Test partial match - by type

        let passwords = keyring.search_items(&[("type", "password")]).await?;

        assert_eq!(passwords.len(), 2);

        let keys = keyring.search_items(&[("type", "key")]).await?;

        assert_eq!(keys.len(), 2);

        // Test no match

        let nonexistent = keyring.search_items(&[("app", "nonexistent")]).await?;

        assert_eq!(nonexistent.len(), 0);

        Ok(())

    }

    #[tokio::test]

    async fn item_replacement_behavior() -> Result<(), Error> {

        let temp_dir = tempdir().unwrap();

        let keyring_path = temp_dir.path().join("replace_test.keyring");

        let keyring = UnlockedKeyring::load(&keyring_path, strong_key()).await?;

        let attrs = &[("app", "test"), ("user", "alice")];

        // Create initial item

        keyring

            .create_item("Original", attrs, "secret1", false)

            .await?;

        // Verify initial state

        let items = keyring.search_items(attrs).await?;

        assert_eq!(items.len(), 1);

        assert_eq!(items[0].as_unlocked().label(), "Original");

        assert_eq!(items[0].as_unlocked().secret(), Secret::text("secret1"));

        // With replace=false, allows duplicates (discovered behavior)

        keyring

            .create_item("Duplicate", attrs, "secret2", false)

            .await?;

        // Verify we now have 2 items with same attributes

        let items = keyring.search_items(attrs).await?;

        assert_eq!(items.len(), 2);

        // Verify both items exist with different content

        let labels: Vec<_> = items.iter().map(|i| i.as_unlocked().label()).collect();

        assert!(labels.contains(&"Original"));

        assert!(labels.contains(&"Duplicate"));

        // Now test replace=true behavior - should remove existing items with same

        // attributes

        keyring

            .create_item("Replacement", attrs, "secret3", true)

            .await?;

        // After replace=true, should only have the new item

        let items = keyring.search_items(attrs).await?;

        assert_eq!(items.len(), 1);

        assert_eq!(items[0].as_unlocked().label(), "Replacement");

        assert_eq!(items[0].as_unlocked().secret(), Secret::text("secret3"));

        // Test replace=true on empty attributes (should just add)

        let unique_attrs = &[("app", "unique"), ("user", "bob")];

        keyring

            .create_item("Unique Item", unique_attrs, "unique_secret", true)

            .await?;

        let unique_items = keyring.search_items(unique_attrs).await?;

        assert_eq!(unique_items.len(), 1);

        assert_eq!(unique_items[0].as_unlocked().label(), "Unique Item");

        // Test replace=true again on the unique item - should replace it

        keyring

            .create_item("Updated Unique", unique_attrs, "updated_secret", true)

            .await?;

        let unique_items = keyring.search_items(unique_attrs).await?;

        assert_eq!(unique_items.len(), 1);

        assert_eq!(unique_items[0].as_unlocked().label(), "Updated Unique");

        assert_eq!(

            unique_items[0].as_unlocked().secret(),

            Secret::text("updated_secret")

        );

        Ok(())

    }

    #[tokio::test]

    async fn empty_keyring_operations() -> Result<(), Error> {

        let temp_dir = tempdir().unwrap();

        let keyring_path = temp_dir.path().join("empty_test.keyring");

        let keyring = UnlockedKeyring::load(&keyring_path, strong_key()).await?;

        // Test operations on empty keyring

        let items = keyring.items().await?;

        assert_eq!(items.len(), 0);

        let search_results = keyring.search_items(&[("any", "thing")]).await?;

        assert_eq!(search_results.len(), 0);

        // Delete on empty keyring should succeed

        keyring.delete(&[("nonexistent", "key")]).await?;

        // Verify still empty after delete

        assert_eq!(keyring.n_items().await, 0);

        // Test lookup on empty keyring

        let lookup_result = keyring.lookup_item(&[("test", "value")]).await?;

        assert!(lookup_result.is_none());

        Ok(())

    }

    #[tokio::test]

    async fn secret_types_handling() -> Result<(), Error> {

        let temp_dir = tempdir().unwrap();

        let keyring_path = temp_dir.path().join("secret_types_test.keyring");

        let keyring = UnlockedKeyring::load(&keyring_path, strong_key()).await?;

        // Test text secret

        keyring

            .create_item(

                "Text Secret",

                &[("type", "text")],

                Secret::text("Hello, World!"),

                false,

            )

            .await?;

        // Test binary secret

        keyring

            .create_item(

                "Binary Secret",

                &[("type", "binary")],

                Secret::blob(&[0x00, 0x01, 0x02, 0xFF]),

                false,

            )

            .await?;

        // Test large secret

        let large_data = vec![42u8; 10000];

        keyring

            .create_item(

                "Large Secret",

                &[("type", "large")],

                Secret::blob(&large_data),

                false,

            )

            .await?;

        // Test empty secret

        keyring

            .create_item(

                "Empty Secret",

                &[("type", "empty")],

                Secret::text(""),

                false,

            )

            .await?;

        // Verify all secrets can be retrieved correctly

        let text_items = keyring.search_items(&[("type", "text")]).await?;

        assert_eq!(text_items.len(), 1);

        assert_eq!(

            text_items[0].as_unlocked().secret(),

            Secret::text("Hello, World!")

        );

        assert_eq!(

            text_items[0].as_unlocked().secret().content_type(),

            crate::secret::ContentType::Text

        );

        let binary_items = keyring.search_items(&[("type", "binary")]).await?;

        assert_eq!(binary_items.len(), 1);

        assert_eq!(

            &*binary_items[0].as_unlocked().secret(),

            &[0x00, 0x01, 0x02, 0xFF]

        );

        assert_eq!(

            binary_items[0].as_unlocked().secret().content_type(),

            crate::secret::ContentType::Blob

        );

        let large_items = keyring.search_items(&[("type", "large")]).await?;

        assert_eq!(large_items.len(), 1);

        assert_eq!(&*large_items[0].as_unlocked().secret(), &large_data);

        let empty_items = keyring.search_items(&[("type", "empty")]).await?;

        assert_eq!(empty_items.len(), 1);

        assert_eq!(empty_items[0].as_unlocked().secret(), Secret::text(""));

        Ok(())

    }

    #[tokio::test]

    async fn item_lifecycle_operations() -> Result<(), Error> {

        let temp_dir = tempdir().unwrap();

        let keyring_path = temp_dir.path().join("lifecycle_test.keyring");

        let keyring = UnlockedKeyring::load(&keyring_path, strong_key()).await?;

        // Test creating multiple items

        keyring

            .create_item(

                "Test Item 1",

                &[("app", "myapp"), ("user", "alice")],

                "secret1",

                false,

            )

            .await?;

        keyring

            .create_item(

                "Test Item 2",

                &[("app", "myapp"), ("user", "bob")],

                "secret2",

                false,

            )

            .await?;

        // Test retrieving all items

        let items = keyring.items().await?;

        let valid_items: Vec<_> = items.into_iter().map(|r| r.unwrap()).collect();

        assert_eq!(valid_items.len(), 2);

        // Test searching by user

        let alice_items = keyring.search_items(&[("user", "alice")]).await?;

        assert_eq!(alice_items.len(), 1);

        assert_eq!(alice_items[0].as_unlocked().label(), "Test Item 1");

        assert_eq!(