package output

import (
	"os"
	"path/filepath"
	"testing"
)

func TestSanitizeRedactsPasswordTokenAndKeyFields(t *testing.T) {
	t.Parallel()

	got := Sanitize("DB_PASSWORD=hunter2\naccess_token: abc123\napi-key = quoted-value\nplain=safe\n", nil)
	want := "DB_PASSWORD=[REDACTED]\naccess_token: [REDACTED]\napi-key = [REDACTED]\nplain=safe\n"
	if got != want {
		t.Errorf("Sanitize() = %q, want %q", got, want)
	}
}

func TestSanitizeRedactsSecretFileContents(t *testing.T) {
	t.Parallel()

	secretFile := filepath.Join(t.TempDir(), "provider-token")
	if err := os.WriteFile(secretFile, []byte("top-secret-value\n"), 0o600); err != nil {
		t.Fatal(err)
	}

	secrets, err := SecretValuesFromFiles([]string{secretFile})
	if err != nil {
		t.Fatalf("SecretValuesFromFiles() error = %v", err)
	}
	got := Sanitize("request failed for top-secret-value", secrets)
	if got != "request failed for [REDACTED]" {
		t.Errorf("Sanitize() = %q, want redacted secret", got)
	}
}