import { describe, expect, it } from "vitest";
import { formatStartupFailure } from "../src/startup-error.js";

describe("formatStartupFailure", () => {
  it.each([
    [new Error("auth_session_store_invalid"), "backend startup failed: auth_session_store_invalid"],
    [new Error("auth_config_invalid"), "backend startup failed: auth_config_invalid"],
    [new Error("workspace_registry_invalid"), "backend startup failed: workspace_registry_invalid"],
  ])("emits only an allowlisted startup cause", (error, expected) => {
    expect(formatStartupFailure(error)).toBe(expected);
  });

  it("collapses unknown errors without exposing their message, stack, token, or path", () => {
    const error = new Error(
      "EACCES password=plain-secret token=token-secret at /run/secrets/private-token",
    );
    error.stack = "Error: raw failure\n    at /app/backend/dist/server.js:42:1";

    const formatted = formatStartupFailure(error);

    expect(formatted).toBe("backend startup failed: startup_unknown");
    for (const leaked of [
      "EACCES", "plain-secret", "token-secret", "/run/secrets", "raw failure", "server.js",
    ]) {
      expect(formatted).not.toContain(leaked);
    }
  });
});