using w4c_workflows.Services.Audit;
using Xunit;

namespace w4c_workflows.Tests;

public class SecretRedactorTests
{
    [Theory]
    [InlineData("api_key=abc123def", "abc123def")]
    [InlineData("apiKey: abc123def", "abc123def")]
    [InlineData("password=hunter2", "hunter2")]
    [InlineData("""{"client_secret":"s3cr3t-value"}""", "s3cr3t-value")]
    [InlineData("Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.abc", "eyJhbGciOiJIUzI1NiJ9")]
    [InlineData("Authorization: Basic YWRhOnNlY3JldA==", "YWRhOnNlY3JldA")]
    [InlineData("https://user:p4ssw0rd@example.com/x", "p4ssw0rd")]
    [InlineData("access_token=opaque-token-value", "opaque-token-value")]
    public void Redacts_secret_values(string input, string secret)
    {
        var redacted = SecretRedactor.Redact(input);

        Assert.DoesNotContain(secret, redacted);
        Assert.Contains(SecretRedactor.Placeholder, redacted);
    }

    [Fact]
    public void Keeps_the_field_name_for_context()
    {
        Assert.Contains("api_key", SecretRedactor.Redact("api_key=abc123"));
    }

    [Fact]
    public void Leaves_ordinary_text_untouched()
    {
        Assert.Equal("hello world", SecretRedactor.Redact("hello world"));
    }

    [Fact]
    public void Handles_null_and_empty()
    {
        Assert.Null(SecretRedactor.Redact(null));
        Assert.Equal(string.Empty, SecretRedactor.Redact(string.Empty));
    }
}