package output

import (
	"os"
	"path/filepath"
	"testing"
)

func TestSanitizeRedactsPasswordTokenAndKeyFields(t *testing.T) {
	t.Parallel()

	got := Sanitize("DB_PASSWORD=hunter2\naccess_token: abc123\napi-key = quoted-value\nplain=safe\n", nil)
	want := "DB_PASSWORD=[REDACTED]\naccess_token: [REDACTED]\napi-key = [REDACTED]\nplain=safe\n"
	if got != want {
		t.Errorf("Sanitize() = %q, want %q", got, want)
	}
}

func TestSanitizeRedactsSecretFileContents(t *testing.T) {
	t.Parallel()

	secretFile := filepath.Join(physicalTempDir(t), "provider-token")
	if err := os.WriteFile(secretFile, []byte("top-secret-value\n"), 0o600); err != nil {
		t.Fatal(err)
	}

	secrets, err := SecretValuesFromFiles([]string{secretFile})
	if err != nil {
		t.Fatalf("SecretValuesFromFiles() error = %v", err)
	}
	got := Sanitize("request failed for top-secret-value", secrets)
	if got != "request failed for [REDACTED]" {
		t.Errorf("Sanitize() = %q, want redacted secret", got)
	}
}

func TestSecretValuesFromFilesRejectsOversizedFiles(t *testing.T) {
	t.Parallel()

	secretFile := filepath.Join(physicalTempDir(t), "oversized-token")
	if err := os.WriteFile(secretFile, make([]byte, 64*1024+1), 0o600); err != nil {
		t.Fatal(err)
	}

	if _, err := SecretValuesFromFiles([]string{secretFile}); err == nil {
		t.Fatal("SecretValuesFromFiles() error = nil, want oversized-file error")
	}
}

func physicalTempDir(t *testing.T) string {
	t.Helper()
	root, err := filepath.EvalSymlinks(os.TempDir())
	if err != nil {
		t.Fatal(err)
	}
	directory, err := os.MkdirTemp(root, "thothctl-output-test-")
	if err != nil {
		t.Fatal(err)
	}
	t.Cleanup(func() { _ = os.RemoveAll(directory) })
	return directory
}