/**
 * TASK-0134 (F-121) — log-scrubber regression test.
 *
 * A secret-bearing request (Bearer token, JWT, factory/third-party tokens,
 * credential query params, cookies) must never reach the structured logs
 * verbatim. The scrubber runs at the API's request-coupled log boundary
 * (AllExceptionsFilter); this test pins the redaction contract.
 */
import { describe, expect, it } from "vitest";
import { scrubSecrets, REDACTED } from "./log-scrubber.js";

describe("log-scrubber (F-121)", () => {
  it("redacts a Bearer access token", () => {
    expect(scrubSecrets("unhandled error on POST /api/v1/pages Authorization=Bearer fk_live_abcdef1234567890abcdef")).toBe(
      "unhandled error on POST /api/v1/pages Authorization=Bearer [REDACTED]"
    );
  });

  it("redacts a raw JWT-shaped token", () => {
    const jwt = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0In0.dozjgNryP4J3jVmNHl0w5N_XgL0n3I9PlFUP0THsR8U";
    expect(scrubSecrets(`token: ${jwt}`)).toBe(`token: ${REDACTED}`);
  });

  it("redacts factory + common third-party token prefixes", () => {
    expect(scrubSecrets("key fk_live_abcdef1234567890abcdef")).toContain(REDACTED);
    expect(scrubSecrets("whsec_live_abcdef1234567890abcdef1234567890abcdef")).toContain(REDACTED);
    expect(scrubSecrets("xoxb-1234567890-abcdef")).toContain(REDACTED);
    expect(scrubSecrets("AKIAIOSFODNN7EXAMPLE")).toContain(REDACTED);
    // reserved test-syntax values are still recognized (they match the prefix):
    expect(scrubSecrets("fk_test_abcdef1234567890abcdef")).toContain(REDACTED);
  });

  it("redacts credential query parameters but not innocent ones", () => {
    expect(scrubSecrets("failed on /api/v1/auth/reset?token=abc123def456&next=/in")).toBe(
      `failed on /api/v1/auth/reset?token=${REDACTED}&next=/in`
    );
    expect(scrubSecrets("GET /api/v1/pages?api_key=sk_test_123&sort=created")).toBe(
      `GET /api/v1/pages?api_key=${REDACTED}&sort=created`
    );
    // an innocent param must NOT be redacted:
    expect(scrubSecrets("GET /api/v1/pages?limit=20&sort=name")).toBe("GET /api/v1/pages?limit=20&sort=name");
  });

  it("redacts Cookie / Set-Cookie values", () => {
    expect(scrubSecrets("cookie: factory_refresh=abc123; Path=/; HttpOnly")).toBe("cookie: [REDACTED]");
    expect(scrubSecrets("set-cookie: factory_refresh=xyz; Secure; SameSite=Lax")).toBe("set-cookie: [REDACTED]");
  });

  it("passes non-strings and clean strings through unchanged", () => {
    expect(scrubSecrets(42)).toBe(42);
    expect(scrubSecrets(undefined)).toBe(undefined);
    expect(scrubSecrets("plain log line about pagination")).toBe("plain log line about pagination");
  });
});